Sign inJoin
1
5 Comments

Ask IH: GDPR and Google Fonts

By Taras Dashkevych
April 21, 2018

Hi,

There is a discussion regarding to GDPR compliance when using Google Fonts in your project: https://github.com/google/fonts/issues/1495

It looks like loading fonts from the Google Web Fonts API might be not compliant with the GDPR because Google collects some data from the visitors of your site.

What are your thoughts regarding to GDPR and Google Fonts?

Taras Dashkevych's avatarTaras Dashkevych
Say something nice to taras…
Post Comment
  1. 1

    I always try using Google fonts for fast concept but then I download them and include in my own css. Doesn't take that much time :)

    Dmitry Belyaev's avatar Dmitry Belyaev
    ·
    8 years ago
    ·
    Reply
    1. 1

      How does it affect your site performance?

      Taras Dashkevych's avatar Taras Dashkevych
      ·
      8 years ago
      ·
      Reply
      1. 2

        There is a possible minor downside that users won't have the font in their cash like it can happen with google font. However it's a tiny bit of the page so doesn't matter a lot + if it's a returning user, he'll get of the benefits of the caching.
        Additionally it gives you more control over the fonts and their styling.

        Dmitry Belyaev's avatar Dmitry Belyaev
        ·
        8 years ago
        ·
        Reply
  2. 1
    • Legitimate interest (art. 1f) is the strongest argument for hosted fonts, not consent.
    • You need to be aware of all of the processing that your font host does. It's their legal obligation to communicate this clearly, so you can contact them and ask for their records of processing.
    • You yourself need to maintain records of processing activities, which includes third parties and the specific type of processing they do (+ link to their records of processing activities + link to an opt-out).
    • You need to comply with all of the rights of the data subject at all times. Use this as a checklist before publishing anything publicly.

    You don't always need explicit consent for processing personal data (I'm mostly referring to IP addresses), but you do need very clear and easily available communication.

    If you'd like to have a chat about this, don't hesitate to send me an email. I'm making GDPR Wall, so I'd like to hear your thoughts/concerns.

    Sébastien Vercammen's avatar Sébastien Vercammen
    ·
    8 years ago
    ·
    Reply
  3. 1

    Take a look at my answer on the StackOverflow: https://stackoverflow.com/questions/49250733/google-hosted-fonts-and-gdpr/49318990#49318990

    Nino's avatar Nino
    ·
    8 years ago
    ·
    Reply