Google Fonts GDPR-compliant in Shopware
Loading Google Fonts directly from Google is a GDPR risk – and a target for warnings in Germany. Here's how to embed fonts in your Shopware shop locally and safely.
Why are Google Fonts a GDPR issue?
If you embed Google Fonts the classic way (via fonts.googleapis.com), your visitors' browsers load the fonts directly from Google's servers. This transmits, among other things, the IP address to Google – often to the US and without consent. That's the data protection problem.
The fix is simple: serve fonts locally (from your own server). Then no IP address leaves your shop towards Google.
The legal background
A widely cited ruling by the Regional Court of Munich I (judgment of 20 January 2022, case 3 O 17493/20) found that dynamically embedding Google Fonts via Google's servers without consent violates the GDPR – and awarded the claimant damages. A wave of warning letters followed in Germany.
Regardless of individual rulings, the privacy-by-design principle applies: only transfer personal data (such as the IP) when necessary and on a legal basis. For fonts that is avoidable – through local hosting.
Hosting Google Fonts locally – step by step
How to switch your Shopware shop to privacy-friendly, locally hosted fonts.
1) Check which fonts are loaded
Find out whether your shop loads fonts from Google – e.g. with the browser's developer tools (the "Network" tab, filtered for googleapis or gstatic) or a common Google Fonts checker.
2) Download the fonts
Download the required font families as local webfont files (e.g. woff2). Mind each font's licence.
3) Serve locally instead of from Google
Place the fonts in your theme and reference them via @font-face from your own directory. Remove all references to fonts.googleapis.com and fonts.gstatic.com.
4) Especially easy with ThemeWare®
With ThemeWare® you choose fonts conveniently in the theme configuration. Using system fonts or locally served webfonts avoids the Google request entirely – with no external loading paths.
5) Verify
After switching, check the Network tab again to confirm that no requests go to Google domains anymore. Only then is the change truly complete.
Frequently asked questions
No. The issue is the dynamic embedding via Google's servers without consent. If you host the same fonts locally on your own server, the critical data transfer no longer happens.
The cleanest and simplest solution is local hosting – then you don't need any consent for the fonts at all. That avoids dependencies on consent logic and keeps the page fast.
You control typography directly in the ThemeWare® configuration. With system fonts or locally served fonts you avoid external Google requests – keeping your shop privacy-friendly and fast.
More legal certainty for your shop
From accessibility to the EU warranty label: we bundle the most important compliance topics in a practical way for ThemeWare® shops.
To the accessibility guide