Designing an appealing website is often a sophisticated art. Many designers and website operators readily utilize the extensive Google Fonts (typefaces) for the textual design of their websites. However, not a few users overlook that the use of these Google Fonts involves the transmission of website visitors' personal data to Google. The Munich I Regional Court (judgment of January 20, 2022, Ref. 3 O 17493/20) has now ruled that the use of Google Fonts is generally unlawful.
Is the use of Google Fonts permissible?
The defendant had integrated Google Fonts on its website. It was undisputed that the plaintiff's dynamic IP address was transmitted to Google when the defendant's website was accessed.
The plaintiff had not consented to the transmission of his dynamic IP address to Google. According to the Munich Regional Court, the defendant could also not invoke a legitimate interest under Art. 6 para. 1 lit. f) GDPR. The defendant could also use Google Fonts without establishing a connection to a Google server and transmitting the website visitor's IP address to Google when the website is accessed.
Are website visitors required to conceal their IP address?
The website visitor is not obligated to conceal their dynamic IP address before visiting a website. This would contravene the purpose of the GDPR, namely the protection of natural persons from the unlawful processing of their personal data. An independent obligation for a website visitor to protect themselves would restrict their protectable rights (cf. Dresden Regional Court, judgment of January 11, 2019, Ref. 1 O 1582/18).
What rights can plaintiffs assert when Google Fonts are used?
According to the Munich Regional Court, the plaintiff was entitled to an injunction claim under §§ 823 para. 1 in conjunction with § 1004 BGB. A claim that the Wiesbaden Regional Court completely denied a plaintiff in another proceeding (cf. Wiesbaden Regional Court, judgment of January 22, 2022, Ref. 10 O 14/21). Furthermore, the plaintiff was entitled to a right of access under Art. 15 GDPR and a claim for damages for pain and suffering under Art. 82 para. 1 GDPR.
What is the amount of damages for pain and suffering when Google Fonts are used?
The Munich Regional Court awarded the plaintiff damages for pain and suffering amounting to merely €100. It deemed the infringement of the general right of personality, in light of the plaintiff's loss of control over personal data transmitted to Google, to be significant, thus justifying a claim for compensation. However, considering the substantive severity and duration of the legal violation, the Munich Regional Court considered the awarded damages for pain and suffering to be appropriate.
What You Should Do NOW
The judgment of the Munich Regional Court indicates that you should not handle cookies and tools carelessly. You may commit a GDPR violation more quickly than you realize and risk conviction.
Regarding Google Fonts, you should store the fonts locally on your server. Even if this leads to performance degradation, it ensures compliance with data protection regulations.
However, the data protection issues extend beyond Google Fonts. Courts are increasingly addressing data protection questions related to cookies and various online tools. Data subjects are evidently becoming more assertive in pursuing their rights, making it crucial to proactively and comprehensively secure both yourself and your website.
Please do not hesitate to contact us if you require consultation regarding your website. We look forward to discussing your needs. Furthermore, we are readily available as consultants across the entire spectrum of IT/IP and data protection law.
GoldbergUllrich Attorneys-at-Law 2022
Julius Oberste-Dommes LL.M. (Information Law)
Lawyer and Specialist Lawyer for Information Technology Law
