Does Consenta really load nothing from Google?

Correct. When you save a font in the editor, Consenta downloads the woff2 files and CSS once locally to wp-content/uploads/consenta-fonts/{slug}/. The browser Network tab on the frontend then only shows requests to your own domain — zero connections to fonts.googleapis.com or fonts.gstatic.com.

Does this also work for fonts in my theme?

Yes — the optional site-wide font localizer scans the entire site (theme, page builder, other plugins) for Google Fonts references, downloads all found fonts locally and replaces the remote URLs at runtime. A weekly re-scan detects fonts added later (new plugin, theme update).

Which fonts are available?

160 curated top fonts one-click (Inter, Roboto, Open Sans, Lato, Poppins, Montserrat, Playfair Display, JetBrains Mono, …) plus any other from the 1500+ Google Fonts catalogue via slug input. System fonts and custom woff2 uploads are also supported.

Do I need a cookie consent for locally hosted fonts?

No. Locally served fonts set no cookies and transmit no personal data to third parties. Font delivery is thus covered as a technically necessary provision of the website — no consent requirement under GDPR Art. 6.

What about the font licence?

When downloading, Consenta automatically stores the OFL, Apache-2.0 or Ubuntu Font Licence in the same directory (wp-content/uploads/consenta-fonts/{slug}/LICENSE.txt) — most open-font licences require the licence file to be distributed alongside (OFL §3, Apache §4(a)). Licence compliance is thus also covered out-of-the-box.

What about performance / Core Web Vitals?

Locally hosted fonts are usually faster than the Google CDN variant: no extra DNS lookup, no TLS handshake with fonts.gstatic.com, same HTTP/2 connection as the rest of the site. Generated CSS files set font-display:swap and primary fonts are announced via <link rel="preload"> — that eliminates FOIT (Flash of Invisible Text) and reduces layout shift (CLS).

Does this work on MAMP/XAMPP/Local without proper SSL?

Yes. On cURL error 60 (broken CA bundle on local dev hosts or behind corporate proxies with MITM decryption) Consenta retries the download once with sslverify=false. Risk stays bounded: only static font files without credentials are downloaded, and the woff2 URLs are whitelist-checked against fonts.gstatic.com beforehand.

Self-host Google Fonts — GDPR Compliant

Q: What does the LG München 2022 ruling say?

LG München (case 3 EO 1361/21) ruled on 20 January 2022: anyone loading Google Fonts dynamically from fonts.googleapis.com transmits the visitor IP to Google in the US — without legal basis and without consent. That violates the GDPR and triggers damages (€100 in the ruling). Since the ruling, mass cease-and-desist letters with demands of €100–170 per letter have been issued.

Self-host Google Fonts — GDPR-compliant.

On save, Consenta auto-downloads the woff2 files to wp-content/uploads/consenta-fonts/ and serves them exclusively from your own domain. Zero requests to fonts.googleapis.com on the frontend — fully compliant with the LG München 2022 ruling.

14-day money-back · Cancel anytime · 160 curated fonts · OFL/Apache-2.0 license stored alongside

LG München 2022: Embedding Google Fonts is actionable.

In ruling 3 EO 1361/21 on 20 January 2022, the LG München held: anyone who loads Google Fonts dynamically from fonts.googleapis.com transmits each visitor's IP address to Google in the US — without legal basis and without consent. That violates the GDPR. Since then, mass cease-and-desist letters with demands of €100–170 per letter have been issued.

Self-host Google Fonts — automatic.

1500+ fonts · Auto-download · 0 requests to Google · LG München compliant · OFL/Apache licence stored alongside

14-day money-back guarantee · Cancel anytime · Available in 34 languages

Cookie Settings

We use cookies and similar technologies (e.g. pixels, tags, scripts) to provide you with the best possible experience on our website. Some are technically necessary for the operation of the site, while others help us improve the website, personalise content and display advertising.

When you use our website, personal data (e.g. IP address, device information, usage behaviour) may be collected, transferred to third parties and processed by them — including in countries outside the EU/EEA (e.g. the USA) where an equivalent level of data protection is not guaranteed (Art. 49(1)(a) GDPR). With your consent, you also expressly agree to this data transfer.

Some processing may take place on the basis of a legitimate interest (Art. 6(1)(f) GDPR). You can withdraw your consent at any time with effect for the future, or change your settings by reopening these cookie settings.

For further information, please see our privacy policy. Use of this website requires a minimum age of 16.

You may decline at any time, and doing so has no disadvantages for using the website (Art. 7(4) GDPR). Details of the individual cookies and technologies can be found in the categories below.

Essential (2)

consenta_auth consent.js

HMAC-SHA256-signed auth cookie for cryptographically secure server-side consent verification. HttpOnly and Secure — not readable by JavaScript, no XSS leak possible. Set after a successful consent log and read by API::has_consent() for PHP-side consent checks.

usprivacy consent.js

Stores the user's CCPA privacy status according to the IAB US Privacy Framework.

Analytics (14)

_ga Google Site Kit

Distinguishes unique users by assigning a randomly generated number as a client identifier for Google Analytics.

_ga_* Google Site Kit

Saves session status and is used to calculate visitor data for GA4 reports.

_gat Google Site Kit

Limits the request rate to Google Analytics to throttle data collection on high traffic websites.

_gat_* Google Site Kit

Used by Google Analytics to throttle request rate. Contains the tracker ID in the cookie name.

_gcl_au Google Site Kit

Used by Google AdSense to optimize advertising effectiveness on websites.

_gcl_aw Google Site Kit

Stores conversion information from Google Ads clicks to measure ad success.

_gid Google Site Kit

Distinguishes users and stores information about page visits for 24 hours.

//www.googletagmanager.com Google

Google Tag Manager to manage tracking tags and scripts

Google Analytics (inline) Google

google-analytics.com Google Site Kit

Google Analytics website analytics tracking service

googleapis.com Google Site Kit

Google APIs for various services such as maps, fonts and YouTube

googlesyndication.com Google Site Kit

Google AdSense ad network for ad delivery

googletagmanager.com Google Site Kit

Google Tag Manager to manage tracking tags and scripts

https://www.googletagmanager.com/gtag/js?id=GT-MJKTX6Z7 Google

Google Tag Manager to manage tracking tags and scripts

Marketing (3)

Facebook Pixel (inline) Meta

facebook.com Meta

Facebook social media integration and ad tracking platform

https://www.facebook.com/tr?id=630539621985955&ev=PageView&noscript=1 Meta

Facebook social media integration and ad tracking platform

Self-host Google Fonts — GDPR-compliant.

LG München 2022: Embedding Google Fonts is actionable.

Three clicks to local hosting

Pick a font

Save — auto-download

Frontend serves locally

Auto-localizer in detail

1500+ Google Fonts

Auto-download on save

Subset latin + latin-ext

License stored alongside

Site-wide font localizer

Weekly re-scan

font-display: swap

Preload for performance

SSL-resilient downloads

What changes in the Network tab

Standard Google Fonts embed

Locally hosted with Consenta

Subscribe monthly or pay once.

Questions about local hosting

Self-host Google Fonts — automatic.