Why Google Fonts are a problem
Embedding fonts directly from fonts.googleapis.com sends the visitor’s IP address to Google on every page view, without consent. In 2022 the Munich Regional Court saw this as a violation of personality rights (case 3 O 17493/20) and awarded damages. Waves of warning letters followed. The fix is simple: download the fonts and serve them from your own server. The check also recognises other font services such as Adobe Fonts.
Tracking before consent
Analytics, pixels and tag managers may only load after the visitor has consented. A consent banner alone is not enough: what matters is that the script does not run before consent. The check reads the delivered HTML and sees whether a script is embedded actively or blocked by a consent manager (for example via type="text/plain" and data-cookieconsent). Blocked services are listed as information, active ones as a warning.
What the check sees – and what it does not
The check reads the HTML the server delivers, without executing JavaScript. Whatever a tag manager loads later is therefore invisible – but the tag manager itself is already a tracking script and is reported as one. Cookies are not counted: they only appear in the browser. For a reliable statement about cookies you need your browser’s developer tools or a check with a real browser.
Watched continuously
The check is a snapshot. In DomainWarn it runs daily for every customer domain: if a new service appears – because someone embedded a video or installed a plugin – it shows up in the timeline, and Google Fonts or active tracking open an incident with an alert.
Frequently asked questions
- Does this replace legal advice?
- No. The check shows technically which third parties the home page loads. Whether consent is required in a specific case depends on the service, the configuration and the legal basis – that is for a lawyer or data protection officer to judge.
- Only the home page?
- Yes, the home page is checked. It usually embeds the same fonts, scripts and consent tooling as the rest of the site. Individual subpages with embedded maps or videos may load further services.
- My consent manager blocks it, why is the service still listed?
- Blocked services are listed as information with a “blocked” note – that is not a finding but confirmation that the blocking is visible in the HTML.
- What about services the check does not know?
- Unknown third-party hosts are collected and listed without judgement, so you can see niche services and classify them yourself.