Why Google Fonts are a problem
Embedding fonts directly from fonts.googleapis.com sends the visitor’s IP address to Google on every page view, without consent. In 2022 the Munich Regional Court saw this as a violation of personality rights (case 3 O 17493/20) and awarded damages. Waves of warning letters followed. The fix is simple: download the fonts and serve them from your own server. The check also recognises other font services such as Adobe Fonts.
Tracking before consent
Analytics, pixels and tag managers may only load after the visitor has consented. A consent banner alone is not enough: what matters is that the script does not run before consent. The check reads the delivered HTML and sees whether a script is embedded actively or blocked by a consent manager (for example via type="text/plain" and data-cookieconsent). Blocked services are listed as information, active ones as a warning.
What the check sees – and what it does not
The check reads the HTML the server delivers, without executing JavaScript. Whatever a tag manager loads later is therefore invisible – but the tag manager itself is already a tracking script and is reported as one. Cookies are not counted: they only appear in the browser. For a reliable statement about cookies you need your browser’s developer tools or a check with a real browser.
Watched continuously
The check is a snapshot. In DomainWarn it runs daily for every customer domain: if a new service appears – because someone embedded a video or installed a plugin – it shows up in the timeline, and Google Fonts or active tracking open an incident with an alert.