The design of an attractive website is often a fine art. Some designers and website operators like to use the extensive Google Fonts for the textual design of their website. However, many users forget that when using these Google Fonts, personal data of the website visitors are transmitted to Google. The Regional Court of Munich I (judgement of 20.01.2022, ref. 3 O 17493/20) has now ruled that the use of Google Fonts is generally unlawful.
May Google Fonts be used?
The defendant had integrated Google Fonts on its website. It was undisputed that the plaintiff's dynamic IP address was forwarded to Google when the defendant's website was accessed.
The plaintiff had not consented to the forwarding of his dynamic IP address to Google. According to the Munich Regional Court, the defendant could not invoke a legitimate interest under Article 6(1)(f) of the GDPR. The defendant could also use Google Fonts without establishing a connection to a Google server and transmitting the IP address of the website visitor to Google when the website was accessed.
Do website visitors have to hide their IP address?
The website visitor is not obliged to hide his dynamic IP address before visiting a website. This would run counter to the purpose of the GDPR, namely the protection of natural persons against the unlawful processing of their personal data. An own protection obligation of the visitor of an internet page would restrict him in his rights worthy of protection (cf. LG Dresden, judgement of 11.01.2019, Az. 1 O 1582/18).
What rights can plaintiffs assert when using Google Fonts?
According to the Munich Regional Court, the plaintiff was entitled to injunctive relief under §§ 823 para. 1 in conjunction with § 1004 BGB. § 1004 BGB. This claim was completely denied by the Wiesbaden Regional Court to a plaintiff in other proceedings(see Wiesbaden Regional Court, judgement of 22 January 2022, file no. 10 O 14/21). In addition, the plaintiff was entitled to information pursuant to Article 15 of the GDPR and damages for pain and suffering pursuant to Article 82 (1) of the GDPR.
How much is the compensation for pain and suffering when using Google Fonts?
The Munich Regional Court awarded the plaintiff damages for pain and suffering in the amount of only €100. It found the encroachment on the general right of personality with regard to the plaintiff's loss of control over a personal data to Google to be significant, so that a claim for damages was justified. However, the Munich Regional Court considered the damages awarded to be appropriate in view of the seriousness and duration of the infringement.
What you should do NOW
The ruling of the LG Munich shows that you should not handle cookies and tools lightly. You will commit a GDPR violation faster than you think and have to fear a conviction.
With regard to Google Fonts, you should save the fonts locally on your server. Even if this leads to performance losses, you are "on the safe side" in terms of data protection.
However, the data protection issues extend beyond Google Fonts. The judiciary is increasingly dealing with data protection issues around cookies and tools. Those affected are apparently becoming more and more "eager to attack", so you should protect yourself and your website comprehensively at an early stage.
Feel free to contact us if you need advice regarding your website. We look forward to talking to you. We are also available to advise you on all aspects of IT/IP and data protection law.
GoldbergUllrich Lawyers 2022
Julius Oberste-Dommes LL.M. (Information Law)
Lawyer and specialist in information technology law
