Google Fonts, CDNs and embeds: third parties you didn't order

On most websites scanned for the first time, the list of third-party requests before consent contains at least one entry nobody deliberately added. Not a tracking pixel, not analytics, but a font, a JavaScript library or an embedded map.

Entries like these rarely come from a decision. They arrive with the theme, with a plugin or with a copied embed code. That is exactly why they slip through when the consent tool is set up: they are on no list, because nobody perceived them as a service.

When the browser loads a file from another server, it opens a connection to it. That server necessarily sees the visitor's IP address, usually the user agent as well, and through the referrer the page the request came from. This holds for a font file just as much as for an ad script. Whether the provider stores, analyses or immediately discards the data is set out in its terms and cannot be measured from outside.

For Google Fonts, Google describes it like this: the Web API does not set or log cookies, but it receives the visitor's IP address in order to respond to the request and for security purposes. That is the typical situation with such services. Nothing is stored on the device, and still a piece of information leaves the browser towards a third party.

The topic became widely known through a judgment of the Munich Regional Court I of 20 January 2022 (ref. 3 O 17493/20). The court held that embedding Google Fonts dynamically without consent passed the IP address to Google in a way the visitor did not have to accept, and awarded the claimant 100 euros. In autumn 2022 a wave of warning letters followed in Germany, all citing that judgment.

That wave has largely run its course, on several fronts. In December 2022 the Berlin public prosecutor had the premises of a lawyer and his client searched, on suspicion of attempted fraud and attempted extortion in more than 2,400 cases. In March 2023 the same regional court ruled in a different case (ref. 4 O 13063/22) that violations found automatically by a crawler give rise to no claim, and called the approach an abuse of rights.

What remains is the technical question the debate was about from the start: the page sends the visitor's IP address to a third party without the visitor doing anything. How to assess that in a given case is something to settle with your privacy counsel. What can be measured is whether it happens.

These sources show up most often in scans as requests before consent, without the site owner being aware of them:

With fonts and libraries it usually stops at the request. Embedded content is different, because an iframe is a complete page of the provider, with its own scripts and its own storage. What happens inside it is decided by the provider, not by the embedding website.

YouTube's privacy-enhanced mode on youtube-nocookie.com is a good example. It sets no cookies on load, that much is true. Several independent tests report, however, that the player writes entries to LocalStorage before anything is played, a device identifier among them, and sets the usual YouTube cookies once Play is clicked. Storage access on the device is not limited to cookies, as our article on web storage describes in detail. The domain name therefore says little about what actually gets written in the browser.

For a long time the claim was that external CDNs were faster because the browser already had a popular file cached from another website. That argument has been outdated since 2020. Chrome has partitioned its HTTP cache by the visited site since version 86, and Firefox and Safari work in a similar way. A font loaded while visiting site A has to be loaded again for site B, even if it comes from the same address.

That removes a major reason for pulling standard fonts and libraries from elsewhere. A file served locally also saves the connection to one more host.

Most cases have one of two solutions, depending on whether the content works without the provider:

Open the website in a private window, open the developer tools and switch to the network tab, then reload the page without touching the banner. Sort the list by domain or filter for everything that does not belong to your own domain. Every entry that appears at this point is a request before consent.

Check more than one page: the home page is often clean, while the contact page with its map and form is not. After every theme or plugin update it is worth another look, because the local font setting in particular tends to get reset.