I think hosting it by yourself is the solution here, but it's getting difficult to keep up with all the rules, especially when the fundamental design of the web moves in the opposite direction.
Browsers partition their caches by origin and third-party origin (it's a bit more complex than that in reality) so common third-party resource e.g. fonts, used on one site won't be reused on another
Instead a fresh version of the font will will be fetched
Safari's done this since 2013 (?), and Chromium & Firefox adopting the same behaviour in 2020 (?)
Do you have a source for this? I believe(d?) it too, but when re-checking just now, I could not find any.
Safari: https://webkit.org/blog/8613/intelligent-tracking-prevention...
Chrome: https://developers.google.com/web/updates/2020/10/http-cache...
Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1536058
1. In Germany an IP address is considered PI under GDPR because it is easily associated to a natural person.
2. Google is open about the fact that they log IP address with Google Font request activity, which includes the page you are on.
3. GDPR requires justification by necessity to collect and/or send PI to a 3rd party without consent.
4. No consent was given.
5. It is not necessary in this case because it is possible to use Google Fonts in other ways that don't send PI to Google, without significant burden.
I'm not a lawyer but I am responsible for GDPR compliance at a German startup.
edit: typo
This is called a Data Processing Agreement and is also part of GDPR compliance.
We have the same thing in place with all 3rd party vendors.
Leaking extremely sensitive user data, like their IP addresses, to third parties, enable them to finger print users.
Leaking those to third parties outside the EU, and in particular to companies whose revenue depends on this finger printing, like Google, just to serve a font, it’s the dumbest thing I’ve heard all week.
The whole purpose of the GDPR is to discourage this behavior, requiring websites to inform users of all their crappy unnecessary things they want to do before they do it.
The only reason Google gives you hot loading for free is to get your users data. Trading your users personal data to serve a font is brain dead.
IMO this fine of 100€ is too small. They should have made it 10% of their revenue to send the clear message that this is not ok.
100€ was fine in my opinion, because a) it isn't that big of an infraction b) it probably was their first offense and c) this legal ruling is indeed setting some kind of precedence and therefore was unexpected given industry practices. If the ruling stands and other courts follow a similar reasoning I would expect higher fines in the future.
In fact I would argue that most devs don’t assume that this is a problem at first glance. The general awareness and education should be better here.