Google Fonts, Analytics and co., the privacy-friendly way

Does my website load Google Fonts, Analytics or other trackers?Check it for free with our Tracker Check

A font from Google, an embedded YouTube video, a map with directions, an analytics service: hardly any website gets by without third-party services. For each of them, your visitors’ browser connects to someone else’s server and transmits at least the IP address. Many website owners don’t even know everything their site loads, because it comes bundled with a theme, plugin or website builder.

Our tracker check shows which services your website embeds.

This article explains the technical background and gives an overview. It is not legal advice. For a legal assessment of your website, please consult a professional.

Why this matters

Under the EU’s General Data Protection Regulation (GDPR), an IP address counts as personal data. Passing it on to third parties requires a legal basis. For analytics, advertising and tracking, that is usually prior consent, meaning a cookie banner in which visitors actively agree before the service loads. The GDPR applies to websites aimed at people in the EU, regardless of where the site owner is based.

How seriously this is taken was shown in 2022 by a ruling of the Munich Regional Court (Landgericht München I). It awarded damages to a visitor because a website had transmitted his IP address to Google without consent when loading Google Fonts. Shortly afterwards, thousands of website owners in Germany and Austria received demand letters making exactly this claim.

The most common third parties and their alternatives

Google Fonts

Problem: the font is loaded from Google’s servers on every page view.

Solution: download the font files and host them on your own server. This is allowed; the fonts are under open licences. In WordPress, plugins can do this automatically. Many themes also offer a setting such as “load fonts locally”. Afterwards, use the tracker check to confirm that there really is no connection to fonts.googleapis.com or fonts.gstatic.com any more. Often a single plugin still loads the font anyway.

Google Analytics and other analytics services

Problem: Analytics sends extensive data to Google and requires consent. Many visitors decline, which makes the numbers inaccurate.

Solution: privacy-friendly analytics tools such as Matomo (self-hosted), Plausible or Umami work without cookies and don’t store personal profiles. Whether that lets you do without a cookie banner depends on the configuration and the law that applies to you. If in doubt, have it checked.

YouTube videos and Google Maps

Problem: embedded videos and maps load content from Google as soon as the page opens, even if nobody presses play.

Solution: a “two-click solution”. Instead of the video, show a preview image with a note such as “Playing this video sends data to YouTube”. Only after the click is the video loaded. For maps, an image of the area with a link to Google Maps or OpenStreetMap is often enough. Many cookie banner tools offer such placeholders ready-made.

Meta Pixel, Google Ads and other ad trackers

Problem: ad trackers record your visitors’ behaviour for advertising purposes. They must not load without consent.

Solution: if you don’t run ads, remove them entirely. They often come from a previous agency or an old campaign test. If you need them, they must be controlled by your cookie banner and may only load after consent.

Google reCAPTCHA

Problem: the spam protection for forms sends data to Google.

Solution: privacy-friendly alternatives include Friendly Captcha or an invisible “honeypot” field that only bots fill in. For small websites, a honeypot is often enough.

Files from CDNs

Problem: libraries such as jQuery or icon fonts such as Font Awesome are loaded from external servers.

Solution: almost all of these files can simply be downloaded and served from your own server. That is often even faster.

Using the cookie banner correctly

A cookie banner alone is not enough. What matters is that the services really only load after consent. Our check reads the HTML without giving consent. If an ad tracker shows up there despite a banner, it is probably loading too early.

Here is how to check it yourself as well:

1. Open your website in a private browser window.
2. Press F12 and switch to the “Network” tab.
3. Reload the page without clicking anything in the banner.
4. Search the list for addresses such as google, facebook or doubleclick. Nothing should appear there before consent.

Less is more

Every third party is not just a privacy issue, but also an extra connection that slows the page down and a dependency that can fail. Often the best solution is not to use a service at all. Go through the list from the tracker check and ask yourself for each entry: do I really need this?