# Self-hosting Google Fonts: the 15-minute fix for a classic GDPR finding > Source: > Published: 2026-08-11 21:52:15+00:00 *Originally published on howsafeismyapp.com.* If your app's `` contains a line like `` then every visitor's browser contacts Google's servers before your page even renders — transmitting their IP address along the way. In 2022, a German court (LG München I) ruled that exactly this, done without consent, violates visitors' rights, and awarded damages to a website visitor. The decision triggered a wave of warning letters (Abmahnungen) against site operators, aimed precisely at small sites that had copied the standard embed code. It remains one of the most common findings on AI-built apps, because font embeds are baked into templates and AI-generated layouts. It is also one of the easiest to fix. (Practical guidance, not legal advice.) An IP address is personal data. Sending it to a third party requires a legal basis (**Art. 6 GDPR**), and transfers to US providers raise the additional third-country questions of **Art. 44 GDPR**. "The CSS loads faster from Google's CDN" is not a legal basis — especially since self-hosting is equivalent in practice: fonts served from your own domain are cached, local, and remove a DNS lookup and TLS handshake to a foreign origin. The details are on our check page: [Google Fonts loaded directly from Google](https://howsafeismyapp.com/checks/google-fonts-gdpr). Fonts are the famous example, but the same logic applies to anything your page pulls from third-party CDNs on first load — icon fonts, CSS frameworks, JS libraries. Fastest way: our free [Google Fonts checker](https://howsafeismyapp.com/tools/google-fonts-checker) answers this in seconds. Manually: open your app in a private window with DevTools → Network, reload, and filter for `fonts.googleapis.com` or `fonts.gstatic.com` . In a Lovable/Bolt/v0 project you can also just search the code for `googleapis` — the embed usually sits in `index.html` or a global CSS file. `.woff2` files with ready-made CSS — or download from the font's official repository. `.woff2` alone is enough for every current browser.`public/fonts/inter-v13-latin-regular.woff2` . In Lovable, add them to the project's public assets.`` with local `@font-face` rules: ``` @font-face { font-family: "Inter"; font-style: normal; font-weight: 400; font-display: swap; src: url("/fonts/inter-v13-latin-regular.woff2") format("woff2"); } ``` `fonts.googleapis.com` link tagTotal effort for a typical two-font app: about 15 minutes. `Cache-Control` header makes repeat visits faster than the Google CDN ever was.The nice thing about this class of problem: it is fully visible from the outside, no access to your code needed. Our free passive scan requests your app like any anonymous browser would and reports every third-party request on first load — fonts included — plus 14 other checks. Takes about a minute; nothing gets stored. `font-display: swap` or preconnect help legally? No. Those are performance tweaks — the legal issue is the request to Google's servers itself, which transmits the visitor's IP address. Only removing the request fixes it. Same logic. Any resource loaded from a third-party CDN on first paint transmits visitor IPs to that provider without a legal basis. Self-host what you can; whatever remains needs a justification and a mention in your privacy policy. In practice, warning letters and small damages claims — the 2022 Munich decision awarded a visitor damages, and copycat claims followed in waves. The cost of a single response letter to a lawyer exceeds the cost of self-hosting many times over. If you're doing a broader consent cleanup anyway, start here: [Do you need a cookie banner?](https://howsafeismyapp.com/blog/cookie-banner-lovable-app).