Google Fonts loaded directly from Google

What is fonts.gstatic.com?

fonts.gstatic.com is the Google server that delivers the actual font files (the .woff2 binaries), while fonts.googleapis.com serves the stylesheet that points to them. Neither is malicious — but if your page references either domain, every visitor's browser opens a connection to Google and transmits their IP address to do it. That transfer, not the font itself, is what German courts have ruled on.

What it means

Your app loads fonts from fonts.googleapis.com / fonts.gstatic.com. Every visitor's IP address is sent to Google servers in the US.

Why it matters

German courts (LG München, 2022) ruled this transfer unlawful without consent; Art. 44 GDPR restricts transfers to third countries. It's also the single most common warning-letter trigger.

How to fix it

Self-host the font files (they're openly licensed) and remove the Google request. Takes minutes with google-webfonts-helper.

Further reading

• I scanned 55 public Lovable apps — all 55 had a GDPR or security finding
• Is your Bolt.new app GDPR compliant? What to check before taking EU users
• Do you need a cookie banner for your Lovable app?