A typeface chosen for the look of the site, a video on a product page, a map on the access page. These are "display parts", and it is easy to treat them as a different matter from cookie banners. Yet many of them work by having the visitor's browser fetch something directly from a third party's server. The moment it does, the visitor's IP address reaches that third party.
This article looks at non-measurement external parts through the GDPR: Google Fonts, YouTube, Google Maps, social media embeds and external CDNs. Measurement tools and consent design for GA4 are covered in "Is GA4 GDPR-compliant?". This article comes before that step: do you need to load the part at all?
By the end you should be able to judge three things for your own site. Which part talks to whom, and when. How to split parts into those you can host yourself and those you load only after a click. And how to confirm the result in the browser's DevTools Network panel.
Main sources: the Munich I Regional Court judgment of 20 January 2022 (3 O 17493/20), EDPB Guidelines 2/2023 (final version of 16 October 2024), the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) cookie guidance, Google's Fonts privacy FAQ, YouTube help, Google's privacy policy and the Maps Embed API guide. All checked on 1 November 2026.
| What you will learn | Short answer |
|---|---|
| Why embeds are a problem | The visitor's IP reaches a third party at load time (chapter 1) |
| What the Munich ruling said | Stop sending IPs; EUR 100 damages (chapter 2) |
| The EU and Dutch view | IP-only tracking can fall under the device rule; AP mentions cookieless embeds (chapter 3) |
| Part-by-part overview | Fonts, video, maps, social, CDN, reCAPTCHA (chapter 4) |
| Fixing fonts | Self-hosting (chapter 5) |
| Fixing video and maps | Do not load until a click (chapter 6) |
| Linking to consent management | What the CMP does and what the embed must do (chapter 7) |
| How to verify | DevTools Network panel (chapter 8) |
1. Display parts are also third-party connections
First, what happens inside the browser. Once this is clear, you can tell for yourself which parts can be a problem.
1-1. The browser fetches every URL written in the HTML
When a visitor opens a page, the browser receives HTML from your server. The HTML contains URLs for font CSS, images, a video iframe, a map iframe and so on. The browser sends requests to those URLs straight from the visitor's own device. Your server does not relay them.
The server that receives such a request technically gets the visitor's IP address, the requested URL and the browser type (user agent). In its Google Fonts privacy FAQ, Google describes font requests as carrying the IP address, the requested URL and HTTP headers including the user agent, which it says it uses to respond to the request and for security.
Steps 3 and 4 happen as soon as the HTML is read. It does not matter whether a cookie banner is on screen. The traffic can already be done before the banner appears.
1-2. "No cookies" does not mean "no problem"
For Google Fonts, Google says the API is unauthenticated and does not set or log cookies. That statement is one reason fonts are rarely treated as a "cookie consent" issue.
But no cookies is not the same as no personal data reaching anyone. Article 4(1) of the GDPR lists an "online identifier" in its definition of personal data. Whether an IP address counts was a point in dispute in the ruling in the next chapter. What matters is whether the IP address reaches a third party, not whether a cookie exists.
| Point to check | Cookie-centred view | Traffic-centred view |
|---|---|---|
| The question | What is written to the device | Who receives what |
| Fonts | Google says it sets no cookies | IP and URL reach Google |
| Video | Does the player write cookies | Reaches YouTube at load time |
| Can a consent banner prevent it | Yes, if it stops the write | Only if the request itself is stopped |
| How to check | Browser cookie panel | Network panel |
The point of the table is to change where you look. Instead of seeing an empty cookie panel and relaxing, look in the Network panel to see which domains are contacted.
2. The Munich Regional Court ruling (20 January 2022)
There is a case where loading fonts from an external server was actually litigated: the Munich I Regional Court judgment of 20 January 2022 (case 3 O 17493/20). I read the summary of the ruling in the Bavarian legal database.
2-1. What was ordered
The court largely upheld the claimant's requests.
| Item | Content |
|---|---|
| Injunction | The operator must not pass the visitor's IP address to Google via Google Fonts. Up to EUR 250,000 per violation, or up to six months of custody |
| Information | Under GDPR Article 15, disclose whether and which personal data about the claimant is processed |
| Damages | EUR 100 plus interest (non-material damage, GDPR Article 82) |
The defendant was the operator of a site that loaded fonts from Google's servers. Each time a visitor opened a page, the IP address was forwarded automatically to Google.
2-2. The court's reasoning
The reasoning in the summary falls into five parts.
- A dynamic IP address is personal data for the operator. It is enough that the operator abstractly has legal means, with help from authorities and the internet provider, to identify the person. Whether Google or the operator actually linked it to the claimant did not matter (the ruling cites the Federal Court of Justice, VI ZR 135/13).
- There was no consent. Automatically forwarding the IP address infringed the general right of personality (informational self-determination).
- Legitimate interest could not justify it. Google Fonts can be integrated without contacting a Google server and without sending visitors' IP addresses, so the transfer was not necessary.
- Visitors need not hide their IP. The court held that expecting visitors to mask their own address before visiting would invert the purpose of data protection.
- Risk of repetition. Past unlawful transfers create a presumption of future ones. Changing the set-up afterwards does not remove it; something like a cease-and-desist declaration with a penalty clause would be needed.
The third point matters most in practice. Loading from outside something you could simply host yourself is what made justification difficult.
2-3. How to read this ruling
Some caution is needed.
| Point | How to read it |
|---|---|
| The court | A German regional court at first instance. It does not bind Dutch courts |
| Scope | A judgment on that dispute and its facts |
| Amount | EUR 100 is small, but the ruling also granted an injunction and found a risk of repetition |
| Who paid | The site operator, not Google |
| Other parts | The case concerned Google Fonts. YouTube or maps do not necessarily get the same result |
Our reading: the ruling clearly shows that loading an external part can be assessed as sending an IP to a third party. The same reasoning could apply to other recipients, but the outcome depends on the facts. For something you can host yourself, such as fonts, the practical lesson is that it is harder to explain why you did not.
We have not checked any appeal or later practice in Germany. Do not read the reach of the ruling from this article.
3. How the EU and the Netherlands see it
Here I look at the EDPB (European Data Protection Board) guidelines and the guidance of the Dutch AP (Autoriteit Persoonsgegevens, the Data Protection Authority). Neither names fonts, so I separate what can and cannot be said.
3-1. EDPB Guidelines 2/2023: the technical scope of the device rule
The EDPB published Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive (storing information on, and accessing information stored on, a device) as a final version dated 16 October 2024. It works through use cases such as URL and pixel tracking, local processing and IP-only tracking.
| Section | Summary |
|---|---|
| 3.1 URL and pixel tracking | A pixel is a link to a resource embedded in content, and some exist only to trigger communication with the host. Adding and collecting identifiers this way is "gaining access" under Article 5(3) |
| 3.3 IP-only tracking | Tracking based only on the IP address can fall under Article 5(3) even if the instruction comes from a different entity from the one receiving it |
| Para. 55 | Only where the IP address originates from the user's terminal equipment. Not always the case, for example with CGNAT |
| Para. 56 | That Article 5(3) applies does not mean consent is always required. Whether an exemption applies is assessed case by case |
Two things follow. First, passing on an IP address can come within the scope of the device rule. Second, the guidelines do not say consent is always required.
We want to be careful here: the guidelines' pixel example has in mind resources whose purpose is only to trigger communication with the host. Fonts and video have a content purpose, displaying something. So how font requests fit Article 5(3) is not settled by these guidelines alone, and we do not assert it.
3-2. The AP: consent for tracking cookies, and cookieless embeds can exist
In its cookie guidance, the Dutch AP says the following (checked 1 November 2026).
| Item | AP guidance (summary) |
|---|---|
| Tracking cookies | The legal basis must be unambiguous consent |
| Valid consent | An unambiguous, active action is needed. Pre-ticked boxes are not allowed. Scrolling or "continuing means you agree" is not allowed either |
| Cookie walls | Blocking visitors who refuse tracking cookies is not allowed (AP news item) |
| Withdrawal | Provide a way to withdraw consent |
| Video embeds | Embedding is often possible without the player placing cookies. Some video platforms offer a privacy-friendly version of the embed |
The last row is the important one here. The AP says embeds that place no cookies can exist. That means the regulator accepts that a platform's "privacy-enhanced" option may be a route.
But the AP guidance does not guarantee which setting places no cookies. That is for you to confirm on your own site (chapter 8). The AP's nine principles for banners are collected in Clear cookie banners.
On its own site's cookie statement, the AP says it uses only functional cookies and includes no third-party embedded content. It is one example of a regulator itself choosing not to place embeds.
3-3. Do not mix traffic and law
For clarity, here are three separate questions, in the same spirit as the three layers in the GA4 article.
| Layer | Question | Law |
|---|---|---|
| Storage on and access to the device | Are cookies written? Is passing on an IP included? | ePrivacy Directive Article 5(3), Dutch Telecommunications Act |
| Processing of personal data | Is the IP address personal data? What is the legal basis? | GDPR Articles 4 and 6 |
| Transfer to the US | If the recipient is a US company, is there a basis? | GDPR Chapter V (now the EU-US DPF and others) |
The basis for transfers to the US (the DPF) and the status of its appeal are covered in chapter 4 of the GA4 article, so I do not repeat them. But before asking whether to obtain consent, the surest step is not to create the traffic at all.
4. Part by part: what goes where, and how to fix it
Now the practical side: the external parts that commonly sit on websites, one by one.
4-1. Overview table
| Part | Contacts (example) | What was confirmed | Basic fix |
|---|---|---|---|
| Google Fonts (CDN) | fonts.googleapis.com, fonts.gstatic.com | IP and URL arrive. Google says it sets no cookies | Self-host |
| YouTube (standard embed) | www.youtube.com | Embed URL is www.youtube.com/embed/VIDEO_ID. Autoplay: data collection at page load is noted | Load after a click |
| YouTube (youtube-nocookie) | www.youtube-nocookie.com | No official document asserting cookie behaviour was found in what we could confirm | Judge from measured requests |
| Google Maps (embed) | www.google.com/maps/embed | Loaded in an iframe. Google's policy lists embedded Google Maps as an integrated product | Load after a click, or link |
| Social posts (embeds) | Each provider's domains | Depends on each provider | Link or image |
| External CDN (JS, CSS) | The CDN's domain | Reaches the library's host | Host yourself |
| reCAPTCHA | www.google.com/recaptcha | Used to protect forms | Only where needed, with a decided consent approach |
The "confirmed" column covers only what we could verify in official documents on 1 November 2026. What we could not verify is not written there.
4-2. A three-way split
Splitting parts by how they are fixed makes decisions easier.
"Host it" removes the traffic altogether. "After click" does not start traffic until the visitor chooses. "After consent" is controlled by a consent mechanism. The further left, the more reliable and the less work; the further right, the more to manage. First consider whether you can move parts to the left.
5. Switching fonts to self-hosting
Google Fonts is the easiest part to fix. In the ruling too, the fact that the fonts could be hosted locally yet were loaded externally made justification hard.
5-1. How it works: what is replaced with what
The standard way to use Google Fonts is to link a stylesheet at fonts.googleapis.com/css from the HTML. The official guide says you add a special stylesheet link to the HTML and refer to the font in CSS. That stylesheet in turn references the font files. From Google's privacy FAQ, the CSS and font files come from the dedicated domains fonts.googleapis.com and fonts.gstatic.com.
Self-hosting replaces both with files on your own server.
| External loading | Self-hosting |
|---|---|
| The HTML links to an external CSS file | The HTML has no link; your own CSS has @font-face |
| Font files are on Google's server | Font files are on your server |
| Contacts Google on every visit | Stays within your own server |
| Google ships font updates | You update the files |
| Adding a typeface is easy | Adding one takes work |
Google states that when a font is loaded from the site operator's own servers, Google receives no data about visits to the site. That is the basis of the self-hosting approach.
5-2. Steps (custom and static sites)
For a hand-built or static site, the steps are as follows. Before starting, it matters to list the typefaces and weights you actually use. Hosting unused weights only makes files larger.
- Search the site's HTML and CSS for fonts.googleapis.com and fonts.gstatic.com, and list the families (for example Noto Sans) and weights (for example 400 and 700)
- Get those families and weights as woff2 files. You can download them from the Google Fonts download page. Check each typeface's licence information at the same time
- Put the files in a public directory on your server (for example
/fonts/) - Write
@font-facerules in your CSS, specifying thefont-familyname, thesrcURL,font-weightandfont-display: swap - Delete the
<link>elements pointing to fonts.googleapis.com and fonts.gstatic.com, and anypreconnecthints - Japanese and other large-character-set typefaces produce big files. Consider limiting the character set or combining with system fonts
- After release, confirm in DevTools that traffic to Google is gone (chapter 8)
5-3. Steps (WordPress)
On WordPress, font loading can come from three places: the theme, the page builder and plugins. Fixing one place while another keeps loading is the most common failure.
| Place | What to check | Fix |
|---|---|---|
| Theme | Whether the theme settings offer a font option, and whether functions.php registers an external CSS file | Use a self-hosting option if present. If not, remove the registration in a child theme and add @font-face |
| Page builder | Whether the builder has a "load Google Fonts" or "save locally" setting | Enable local saving and recheck after updates |
| Plugins | Whether you use a plugin built to host fonts locally | If so, clear the cache after configuring and check the Network panel |
| Additional CSS | Whether additional CSS contains an @import of an external stylesheet | Delete the import and replace it with your own CSS |
| Caching and optimisation | Whether an optimiser keeps old loading code | Clear caches, then check |
On WordPress, clearing caches after changing settings, then checking the Network panel is one unit of work. The look may not change while traffic to outside still remains behind the scenes.
5-4. What you give up by self-hosting
Self-hosting has a cost in effort.
| Item | Content | Response |
|---|---|---|
| Updates | Font updates are not applied automatically | Set a yearly review, for example |
| Adding typefaces | Each addition means getting and placing files | Limit the typefaces you use |
| Speed | You cannot rely on a shared CDN cache | woff2, only needed weights, font-display |
| Licensing | You must check terms yourself | Keep each typeface's licence information |
In our view these are small costs. If the only reason to keep loading externally is "it is easy", moving to self-hosting is worth it.
6. Video and maps: do not load until a click
Unlike fonts, video and maps cannot be hosted by you. The video lives on YouTube's servers; map data lives with Google. Here the approach is to not load anything until the visitor signals they want to see it.
6-1. The idea of a two-step embed
A two-step embed puts a stand-in on the page in place of the iframe. Only when the visitor clicks is the iframe inserted.
The benefit is that the visitor chooses before anything loads. But this does not automatically mean consent was obtained. A click is a conscious choice to load, but whether it meets the conditions for valid consent (clear information, a record) depends on the design. Decide this together with consent management in chapter 7.
6-2. What the stand-in should say
A stand-in is not just an image. It is the place that tells the visitor what will happen.
| What to write | Example | Why |
|---|---|---|
| What will load | "This loads a YouTube video" | Shows it is an external service |
| Who it connects to | "Playing connects to YouTube (Google)" | Names the recipient |
| What reaches them | "Connecting sends your IP address and similar data to them" | Shows the effect |
| Where to read more | Link to the privacy policy | A basis for the explanation |
| An alternative | A link to the video, a text summary | Information for those who do not load it |
"Click to watch the video" alone does not say what will happen. Name the service and what reaches it.
6-3. Handling YouTube
The standard YouTube embed is an iframe at www.youtube.com/embed/VIDEO_ID (per the YouTube player parameters guide). The same guide notes that enabling autoplay means playback data collection and sharing occurs when the page loads. Avoid autoplay to stay on the safe side.
About youtube-nocookie.com, let me be clear. YouTube's help page explains that privacy-enhanced mode prevents views of embedded content from influencing the viewer's browsing experience on YouTube. But as far as we could confirm in YouTube's documentation, it does not say under which conditions cookies or on-device storage occur. So this article does not say "youtube-nocookie.com means no cookies".
| Claim | Confirmed? | Treatment here |
|---|---|---|
| Privacy-enhanced mode keeps views from influencing the viewer's YouTube experience | Confirmed (YouTube help) | Reported as is |
| youtube-nocookie.com places no cookies | Not confirmed | Not asserted |
| Nothing is stored on the device before play | Not confirmed | Not asserted |
| The IP address reaches the recipient once loaded | As a matter of how HTTP requests work | Treated as a premise |
| The AP says embeds without cookies can exist | Confirmed (AP guidance) | Cited |
In conclusion, using the privacy-enhanced domain is better than not using it. But treating it as grounds for loading without consent relies on a premise that has not been verified. Combine click-to-load with measurement in DevTools.
6-4. Handling Google Maps
A Google Maps embed is an iframe whose src points at something like www.google.com/maps/embed/v1/place. The guide says no JavaScript is needed, and the URL carries an API key. Google's privacy policy lists "embedded Google Maps" among Google products integrated into third-party sites, and says information about the interaction of devices with its services includes the IP address.
Again, this article does not assert whether cookies are set. What can be said for certain is that iframe traffic begins as soon as the page opens. There are three options.
| Option | Content | Suits |
|---|---|---|
| Load after a click | Stand-in, iframe inserted on click | You want the map shown on the page |
| Use a link | A "Open in Google Maps" link | An address and directions are enough |
| Use an image | Host a map image yourself with a link | You want to keep the look |
If you use an image, check the terms of use of the map image source. Taking one without checking the conditions creates a different problem. In practice, writing the address in text with a directions link is often enough.
6-5. Social embeds and external CDNs
Embedded social posts load each provider's scripts and iframes. Behaviour differs by provider and we did not check each one here. The safe fix is to replace them with a screenshot and a link to the original post. Follow each service's terms for quotation.
For JavaScript and CSS loaded from an external CDN, hosting the files yourself removes the external traffic. Pin the version and place the library files on your server. You have to watch for updates yourself, but fewer recipients is normally the bigger gain.
7. Linking to consent management (CMP)
So far we have written "load after a click". There is a further design step: linking to a consent management platform (CMP, the part that shows the consent screen and keeps the record).
7-1. How this differs from the GA4 article
First, how the roles divide between this and the previous article.
| Item | GA4 article (measurement) | This article (non-measurement parts) |
|---|---|---|
| Main parts | Google Analytics, Google Tag Manager | Fonts, video, maps, social, external CDN |
| Main question | May we measure, what to stop before consent | Do we need to load it at all |
| How consent is passed on | Consent Mode (tells tags the state) | CMP functions or your own click handling |
| Most reliable fix | Run measurement after consent | Host it, or load after a click |
Consent Mode is a way to tell Google tags the consent state. It does not stop font CSS or a YouTube iframe. The GA4 article's "what to stop before consent" already includes third-party embeds (video, social). This article is about how to actually stop them.
7-2. Loading after consent: the basic shape
With a CMP, the flow is generally as follows.
- Until consent is given, do not put the embed iframe or external scripts into the page
- Show a stand-in so the visitor can choose to load the external content
- Receive the consent state from the CMP and run only the parts in the consented category
- If refused or unanswered, leave the stand-in
- Keep a way to withdraw consent, and stop loading after withdrawal
Many CMPs can delay execution of scripts and iframes until consent if you give them a special attribute or type. The syntax differs by product, so follow the official documentation of the CMP you use. This article does not guarantee any particular syntax.
7-3. Click versus consent
Click-to-load can be built without a CMP. Does it replace consent?
| View | Content | Caveat |
|---|---|---|
| Click = choice | Only those who want it load it | The stand-in must say that it connects to the other party |
| Click = consent | Can count as consent if the requirements are met | Needs explanation, a clear act and a record. Legal review is advisable |
| Click only | No explanation, no record | Unclear whether it counts as consent. Avoid |
Our view: click-to-load certainly delays the traffic, but whether it is enough as consent depends on the stand-in text and record design. If unsure, obtain and record consent with the CMP. As the AP says, valid consent needs a clear, active act.
7-4. What a CMP does not fix
A CMP does not stop a site's external traffic just by being installed.
| Common state | What happens | Fix |
|---|---|---|
| The theme links Google Fonts directly | Fonts load before consent | Switch to self-hosting |
| A video iframe is written directly into the HTML | The iframe loads before consent | Remove it and insert after a click |
| A plugin loads a map script automatically | It loads even if refused | Change plugin settings or use another method |
| Hard-coded tags sit outside the tag manager | Consent control does not apply | Find them and bring them under control |
8. Verify in DevTools
After the fix, what you need is confirmation that the traffic is really gone. Do not trust how the settings screen looks. Look at what the browser fetched.
8-1. Preparation and steps
Use the Network panel in Chrome DevTools. Other browsers have similar features.
- For checking, create a clean state with no stored cookies or consent, for example in a private window
- Open the page and open DevTools (F12 on Windows, Option+Command+I on Mac)
- Select the Network panel and reload. Have the panel open before loading so you do not miss the first requests
- If a consent screen appears, refuse, or choose nothing
- Type the domains you want to check into the filter:
fonts.googleapis,fonts.gstatic,youtube,google.com/maps - If any rows appear, that traffic happened before consent
- Interact with the page (scroll, click) and check for later requests too
8-2. Where to look and how to read it
| Where | What it tells you |
|---|---|
| "Domain" column in the Network panel | Which party is contacted |
| "Initiator" for each row | Which file triggered the request |
| The filter box | Narrows to a given domain |
| "Type" column | font, document (iframe), script and so on |
| Cookies in the Application panel | Whether any cookies were written |
The "Initiator" column helps with finding the culprit. If you can see which CSS triggers the font request, you can tell whether it is the theme, a plugin or additional CSS.
8-3. Expected results by state
Check in several states. One state is not enough.
| State | Fonts | Video and map iframes | Expected result |
|---|---|---|---|
| First visit, unanswered | Own only | Stand-in | No traffic to external domains |
| Refused | Own only | Stand-in | No traffic to external domains |
| Clicked or consented | Own only | iframe inserted | External traffic appears only after the click |
| Consent withdrawn | Own only | Back to stand-in | No new external traffic afterwards |
| Another page (post, static page) | Own only | Check per page | No extra parts on that page |
The "another page" row is easy to overlook. The home page may be fixed while only the blog post template carries a video or map. Open each page type and check it one by one.
9. How checking and fixing differ on WordPress and custom sites
Here is the above regrouped by how the site is built.
9-1. Comparison
| Item | WordPress | Custom or static site |
|---|---|---|
| Where external loading comes from | Theme, builder, plugins, additional CSS | Your own HTML and CSS, libraries you included |
| How easy to find | Spread over three or more places | Found by searching the source |
| Fixing fonts | Theme or builder settings, a dedicated plugin, or a child theme | Write @font-face yourself |
| Fixing video and maps | Block or plugin settings, or replacing shortcodes | Write a stand-in and a small script |
| Risk of recurrence | Updates or new plugins can bring external loading back | Only when you add a new part |
| How often to check | After every update | When you add a part |
WordPress is characterised by the fact that its state can change with each update. After fixing, build the habit of looking at the Network panel again after updating themes or plugins.
9-2. Order of work on WordPress
- Use the Network panel to list traffic to external domains
- Use "Initiator" to find whether the theme, builder or a plugin causes it
- Fix fonts through local-saving settings or by replacing the CSS
- For video and maps, check block or plugin settings and use any delayed-loading feature. If there is none, replace with links
- Clear caches and recheck in a private window
- Put rechecking after updates into your operating procedure
9-3. Order of work on a custom site
- Search your HTML and CSS for external domains
- Self-host fonts with the steps in chapter 5
- Replace video and maps with a stand-in and a small script that inserts the
iframeon click - Pin versions of external CDN files and host them yourself
- Before release, check each page type in the Network panel
- When adding a new part, make "does external traffic increase?" a review item
9-4. Facts confirmed about DevNJ's own site
Explanations alone are hard to picture, so here is what we could confirm from the source of DevNJ's site (dev-nj.com) on 1 November 2026.
| Item | What was confirmed | Where |
|---|---|---|
| Fonts | CSS @font-face points to our own files | The site's stylesheet |
| External font loading | No references to fonts.googleapis.com or fonts.gstatic.com in the repository | Search of the site's templates and stylesheets |
| Video embeds | No YouTube iframe in the site's templates | Same |
| Contact form | The reCAPTCHA v3 script is loaded on the contact page | The form template |
As the last row shows, there are parts we do not host ourselves: reCAPTCHA, used to protect the contact form against spam. It is loaded only on the page that needs it and is listed in the cookie policy. The point is not to pretend to be perfect, but to know which parts are outside and be able to explain them.
10. Where people tend to trip
These are failures that are common in real work.
| Trip | What happens | How to avoid it |
|---|---|---|
| Self-hosted fonts but forgot to delete the link | Both load, and external traffic remains | After self-hosting, always check the Network panel |
| Fixed only the theme setting | A plugin keeps loading external CSS | Find the source via Initiator |
| Removed the iframe but cache keeps it | Old HTML is still served | Clear caches before checking |
| Only hid the video | Hiding with CSS still loads the iframe | Remove the iframe from the HTML itself |
| A map script is also included elsewhere | External traffic appears page by page | Check per page type |
| Felt safe after a "consent given" display | Traffic had finished before it showed | Look at the Network panel while refusing |
| Weak explanation for click-to-load | Unclear if it counts as consent | Name the recipient and what reaches it |
The mistake of only hiding with CSS is especially common. An element with display: none becomes invisible, but it still loads.
11. For Japanese businesses: when does this apply?
A site run by a Japanese company can fall under the GDPR if it shows an intention to offer goods or services to people in the EU (GDPR Article 3(2)). Language, currency, delivery destinations and EU-targeted promotion are clues. As set out in the GA4 article, whether you are covered is a case-by-case judgement.
| Situation | General view |
|---|---|
| Japanese only, run for Japan | An EU intention is hard to read. Check individually |
| An English version that takes EU shipping or bookings | Can be covered. Needs checking |
| Services presented to customers in the Netherlands or EU | Can be covered |
| An establishment in Europe | Processing related to its activities can be covered |
This table is only a general view, not a legal judgement. If unsure, check with a professional.
12. Thinking about effort
Costs vary a lot by site, so I do not give amounts here. This is where the effort goes.
| Work | What increases the effort |
|---|---|
| Inventory of the current state | Many page types, many WordPress plugins |
| Self-hosting fonts | Many families and weights, large Japanese font files |
| Replacing video and maps | Embeds scattered across many pages |
| Linking to consent management | CMP settings, stand-in wording, record design |
| Checking and testing | Combinations of page type, language and state (unanswered, refused, consented) |
| Updating policies | Reflecting reality in the privacy and cookie policies |
The most effort actually goes into the first inventory. Once you know what is where, the fixing goes faster than expected.
13. How to fix, by how the site is built
Here is the above organised as conditions and steps. See which shape your site is closest to, and go to that part.
13-1. Three typical set-ups
Set-up A: a WordPress theme that loads Google Fonts. In the Network panel the font requests appear first. Check whether the theme settings have a local-saving option and enable it if so. If not, remove the external CSS registration in a child theme and add @font-face. If a video or map is present, replace it with a link or a written address. After changing settings, clear caches before checking.
Set-up B: a static site with iframes written directly into the HTML. The HTML holds a font link and a YouTube or similar iframe. Host the font files yourself and switch to @font-face, and replace the iframe with a stand-in plus a small script that inserts it after a click. If the site targets the EU and consent must be recorded, obtain and record it with a CMP.
Set-up C: a site with many social embeds. Where many posts are embedded, the safe fix is to replace the embeds with screenshots and links to the original posts. Check the initiators on every page to be sure no script source remains.
| Set-up | Parts to fix | Method | Where to look when checking |
|---|---|---|---|
| A WordPress theme | Fonts, video, map | Local-saving setting, links | After the theme setting, clear cache and check |
| B Static site, hard-coded iframes | Fonts, YouTube | Self-hosting, click-to-load, CMP | Per page type and per state |
| C Many social embeds | Social embeds | Images and links | Initiators on every page |
What the three share is the order: take inventory before fixing, and measure after fixing.
14. What not to do
| Do not | Why |
|---|---|
| Decide "we're fine because we use no cookies" | An IP reaching a third party is a separate issue from cookies |
| Switch to youtube-nocookie.com and load without consent | We could not confirm an official basis for calling it cookieless |
| Call it fixed because CSS hides the element | Hidden elements still load |
| Finish checking from how the settings screen looks | Real traffic is visible only in the Network panel |
| Take the ruling's EUR 100 as a reason to underrate the risk | An injunction and a risk of repetition were also found |
| Copy another site's settings | Parts and traffic differ site by site |
| Add a CMP without taking inventory | Traffic that appears before consent stays as it is |
15. Checklist
- In the Network panel, while unanswered or refused, no traffic goes to external domains
- There is no traffic to fonts.googleapis.com or fonts.gstatic.com
- Video and maps do not load until a click (or are replaced with links or images)
- Autoplay is not used
- External CDN files are hosted on our own server
- Each page type (home, post, static page, form) has been checked
- Rechecking after theme and plugin updates is in the operating procedure
- Stand-ins name the recipient and what reaches it
- The privacy policy and cookie policy reflect reality
- Parts that remain external (such as reCAPTCHA) are listed and can be explained
16. Summary
- Parts loaded from an external server send the visitor's IP address to a third party at the moment of loading. It is a separate problem from the cookie banner
- On 20 January 2022 the Munich Regional Court ordered an injunction and EUR 100 in damages over loading Google Fonts. It is a German first-instance ruling, and outcomes vary with the facts
- The EDPB says IP-only tracking can fall under the device rule, but also says consent is not always required. Do not assert; assess case by case
- The AP says embeds that place no cookies can exist. Confirm which setting does so on your own site
- In order of reliability: host it yourself, do not load until a click, run it after consent
- Whether youtube-nocookie.com can be called "cookieless" could not be confirmed. Decide by measurement
- After fixing, refuse consent, watch the Network panel and confirm the external traffic is gone
Talk to us
External parts increase without anyone noticing. Each theme update, new plugin or change of staff can change who your site talks to. DevNJ, based in The Hague, supports the building and running of websites for Europe.
To get a picture first, see our services. If you want to know which parts of your own site talk to outside servers, send the URL, your theme and plugins, and the consent tool you use through the contact page. This article is not legal advice; ask a professional about your specific case.
Sources
Court ruling
- LG München I, judgment of 20.01.2022 – 3 O 17493/20 (Google Fonts) — Bayern.Recht: injunction, EUR 100 damages, IP address as personal data, rejection of legitimate interest
EU law and guidelines
- Regulation (EU) 2016/679 (GDPR) — EUR-Lex: Articles 3, 4 (online identifier), 6 and 82
- Directive 2002/58/EC (ePrivacy) — EUR-Lex: Article 5(3)
- Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive — EDPB: final version (16 October 2024). URL and pixel tracking, IP-only tracking
- Guidelines 2/2023 full text (PDF) — EDPB: sections 3.1 and 3.3 (paragraphs 55 and 56)
Dutch authority
- Cookies — Autoriteit Persoonsgegevens: the three types of cookie, Telecommunications Act
- Tracking cookies — Autoriteit Persoonsgegevens: consent for tracking cookies, conditions for valid consent, video embeds
- Websites moeten toegankelijk blijven bij weigeren tracking cookies — Autoriteit Persoonsgegevens: the position against cookie walls
- Cookieverklaring — Autoriteit Persoonsgegevens: the AP's own site cookie statement
- Clear cookie banners — Autoriteit Persoonsgegevens: the nine principles for banners
Google and YouTube specifications
- Privacy and Data Collection — Google Fonts: no cookies set, IP/URL/headers arrive, the self-hosted case
- Getting started — Google Fonts API: loading through a stylesheet link
- YouTube Player Parameters — Google for Developers: the embed URL, autoplay and data collection
- Embedded players and privacy-enhanced mode — YouTube Help: description of privacy-enhanced mode
- Maps Embed API: Get started — Google for Developers: loading in an iframe, no JavaScript needed
- Google Privacy Policy: embedded Google Maps, IP addresses
DevNJ public information
- Is GA4 GDPR-compliant? Cookie consent and Consent Mode v2 (2026) — DevNJ: consent for measurement, DPF status, Consent Mode
All were checked on 1 November 2026. The reach of the ruling, regulators' views and each provider's specifications may change. Check the official pages for current information before deciding on settings. This article is not legal advice.
For help taking inventory of your site's external connections, or building and running a site for Europe, see our services or the contact page.
FAQ
- Is loading Google Fonts from the Google CDN a GDPR problem?
- It can be. Every load sends the visitor's IP address and other request data to Google. On 20 January 2022 the Munich Regional Court ordered a site operator to stop this and pay EUR 100 in damages. It is a German first-instance ruling, not Dutch law, but self-hosting is easy, so it is the safer route.
- Does switching to youtube-nocookie.com remove the GDPR problem?
- It cannot be said with certainty. YouTube's help page explains that privacy-enhanced mode affects how views are used for the viewer's YouTube experience, but as far as we could confirm in YouTube's documentation, it does not say what is stored on the device. The Dutch AP notes that embedding without cookies is often possible. Check the actual requests on your own site in DevTools.
- Do I need cookie consent just for placing a Google Maps embed?
- Not as a blanket rule. Google's privacy policy lists embedded Google Maps among its products integrated into third-party sites, and the visitor's IP address reaches Google when the page loads. The reliable options are to get consent first or to load the map only after a click.
- How do I self-host Google Fonts?
- List the families and weights you use, download woff2 files, put them on your own server and point your CSS @font-face rules at them. Then remove the links and preconnect hints for fonts.googleapis.com and fonts.gstatic.com. On WordPress, check whether the theme, page builder or a plugin still loads them, using DevTools.
- If I have a consent management platform, are my embeds safe?
- A consent platform shows the consent screen and keeps the record. Installing it does not stop a YouTube or map iframe that is hard-coded into the page from loading before consent. Rebuild the embed so it loads after consent, then confirm in the Network panel that nothing external is requested while consent is refused.
- Does a Japanese company need this for an EU-facing site?
- If a site shows an intention to offer goods or services to people in the EU, a Japanese company can fall under the GDPR. Whether you are covered is a case-by-case judgement, so check with a professional if unsure. This article is not legal advice.
Planning a site that has to work in both markets?
Get in touch
