Scan rule · RSC-PRV-001
Google Fonts loaded at runtime
Finds references to fonts.googleapis.com/gstatic.com that send visitors' IP addresses to Google.
Why this matters
When Google Fonts are loaded from Google servers at runtime, every page view transmits your visitors' IP addresses to Google — without consent and without visitors noticing.
In Germany this is not a theoretical risk: in 2022 the Munich Regional Court ruled that embedding Google Fonts dynamically without consent violates personality rights. A wave of warning letters followed. Many AI and no-code generators embed fonts exactly this way, because it is the default line from the documentation.
The fix is straightforward and costs nothing visually: download the fonts, serve them locally and embed them via @font-face. It is also faster, because an external connection disappears. This is a technical assessment, not legal advice.
Scan tier
How to fix it
Self-host the fonts (local `next/font`) and remove the external reference.