Shaky business model: More mass warnings because of Google fonts

Within a short period of time, tens of thousands of website operators received letters demanding payment from two lawyers. The subject is the integration of Google Fonts on websites. For some time now, new waves of warnings about Google Fonts have been rolling out. c’t analyzes what is behind the court judgment handed down in January 2022 in Munich. It is considered the nucleus of the warning wave and raises questions in its supposed clarity.

We also shed light on the dunning letters currently being sent out and their authors. One had transferred donations to a civil rights organization with a request for a donation receipt. But she refused and sent the money back. Those affected should also behave negatively: We give tips on how you can defend yourself against the warning letters.

More from c't magazine

More from c't magazine

More from c't magazine

More from c't magazine

The lawyer comes up with serious allegations in his letter: The recipient of the letter violated his client’s general personality rights and the latter suffered a “actual and economic disadvantage”. The reason for the client’s “loss of control”: the website he visited uses Google fonts.

At the beginning of the year, the district court in Munich had to evaluate this process (Az.: 3 O 17493/20). That judgment made represents something like the nucleus from which the entire current warning wave has developed. In its extremely succinctly worded reasons for the judgment, the court stated that the use of Google fonts on websites “undisputedly” the dynamic IP addresses of users are transmitted to Google’s servers in the USA.

According to the “Schrems II” judgment of the ECJ (Ref.: C-311/18), no adequate level of data protection is guaranteed there. Because the process infringes the plaintiff’s right to informational self-determination, there is a right to injunctive relief and information about the processing of the data.

Google Fonts offers attractive fonts, but also carries a certain risk if you don’t host the fonts yourself.

With the Google Fonts service, the search engine giant provides over 1000 fonts for free use. If you want to use these fonts on your own website, you can even do so without having the fonts ready on your own server. But that’s not a good idea: As soon as a visitor calls up the website, the browser loads the fonts directly from the Google servers and transmits user data to Google.

What is special about the Munich decision is the fact that the judges also granted the plaintiff a claim for damages under Art. 82 (1) GDPR: The court saw the plaintiff’s loss of control over his personal data as an immaterial violation. Google is a company that “is known to collect data about its users,” the argument goes. The data transfer to Google results in an “individual malaise” that is so significant that it justifies a claim for damages.

The verdict from Munich is highly controversial in the professional world. The judicial assessment alone that the transmission to the USA was “undisputed” shows that the persons involved in the judgment had not dealt with the functioning of Google Fonts in depth, either technically or legally. The other, very brief reasons for the decision also lack an in-depth examination of the question of the granting of damages. The decision gives the impression that the court did not even begin to realize the explosive force of its own verdict.

A whole range of people are now taking advantage of the uncertain legal situation – apparently they all suffer from a “particular discomfort” after visiting websites with Google fonts. In the first wave, it was mostly individuals who sent emails demanding money. They asked website operators to transfer you an amount of 100 euros as compensation.

From late summer, the two lawyers Kilian Lenard and Nikolaos Kairis expanded the business model. They act on behalf of their respective clients Martin Ismail and Wang Yu. How many warnings they sent is unclear. The file numbers used by the lawyers suggest that there are several hundred thousand letters.

Not only is the content of the standard letters sent by the two lawyers very similar, but also their limited legal quality. The letters point out that those who have been warned integrate Google fonts on their website. According to this there would be a right to injunctive relief, information and payment of damages. This is followed by the offer to refrain from further legal measures if the recipient transfers money in a timely manner. Lawyer Lenard has a sum of 170 euros in mind. Attorney Kairis is only asking for 140 euros, but plus attorney’s fees he comes up with a claim of 239.60 euros.

Remarkably, in the case of the Lenard/Ismail duo, the lawyer does not even claim that his client was personally on the website of the person who was warned. Rather, a “privacy interest group” (IGD) noticed that the site uses Google fonts. However, this IGD is not represented by the lawyer at all – his client is only Martin Ismail. The IGD website does not explain who is behind the interest group. Only Ismail can be found in the imprint, at an address in Hanover that is also mentioned in the warnings. c’t sent the duo a list of questions about their activities, but have yet to receive a response.

There is a noteworthy statement on the IGD website, which first points out that the parties involved are actual persons. The “messages with the payment request” sent and the request to remove Google Fonts were not “fake”, it is said. Rather, the responsible website operators had “demonstrably violated the GDPR” and were liable for damages. This is also “clearly made clear by the currently prevailing case law”.

The statement also contains a threat: failure to remove and non-payment would lead to “further legal consequences”. The lawyers do not say what these look like. There are also no known proceedings in which the warning duo has enforced its claims in court. Possible reason: Such procedures would be dangerous for the warning persons, since just a few negative decisions would end their business model.

The IGD also tries to give itself a non-profit image on its website: the interest group supports associations with donations, it says there. However, the recipients of the donations are not named “for data protection reasons”.

Not all recipients welcome the support of the IGD. So the civil rights association “German Association for Data Protection” (DVD) sent a referral from the IGD in the amount of 3060 euros back immediately. A Mr. Ismail – interestingly not the IGD – transferred this sum to the account of the civil rights organization, together with the request for a donation receipt. In a statement, DVD rejects the IGD’s approach, which, from DVD’s point of view, discredits the concern for data protection.

The warning letters from the lawyer Nikolaos Kairis from Meerbusch provided amusement. He initially represented an unspecified Mr. Wang Yu, then suddenly a Ms. Wang Yu from mid-October 2022. According to the letter, this resides in a building on Pariser Platz in Berlin that contains offices and letterbox companies, and is a member of a “privacy interest group”. We could not find the association, which is also called “VIVA data protection”, on the Internet. Lawyer Kairis has also not yet responded to our request.

In this warning letter, the recipient is accused of, among other things, "violation of general personal rights".  An invoice for 239.60 euros is attached to the two-page letter.

In this warning letter, the recipient is informed, among other things, of

In this warning letter, the recipient is accused of, among other things, “violation of general personal rights”. An invoice for 239.60 euros is attached to the two-page letter.

Kairis also offers to waive further claims if the recipient of the warning letter ceases the violation and pays the amount claimed. However, his client had already “mandated him with the lawsuit in other cases that had been brought into line”. In addition to various typographical errors in the warnings, the invoices sent are particularly striking.

While there were initially several errors in the calculation, in later letters only the assertion of the attorney’s flat-rate fee is incorrect – in favor of the attorney. If hundreds of thousands of warnings were actually sent, the incorrect calculations alone would quickly add up to unjustly raised claims in the seven-digit range.

Lawyers do not agree on how recipients of such a warning should deal with it. The only thing that is clear is that you should not pay the demands. Otherwise, the advice ranges from ignoring to rejection to a formal letter of reply from a lawyer.

In any case, website operators should replace the on-demand version of Google Fonts with the locally hosted offer of this service as soon as possible.

The authors represent recipients of the aforementioned warnings within the framework of their law firm. The firm has also filed criminal charges against both attorneys and their clients.

c’t 24/2022


In c’t 25/2022 we looked at smartphones from 50 euros to 2000 euros and explain what buyers of entry-level, mid-range and high-end devices can expect. It doesn’t always have to be new either: with our tips you can extend the life of your current smartphone. AI image generators are currently on everyone’s lips. c’t shows what artificial artists achieve and how magnificent images can be elicited from them. To this end, we devote ourselves to the legal and moral issues. We also install Linux on Macs with Apple chips, play retro games on the Steam Deck and the c’t laboratory has a new record to report. You can read all this and more in c’t 25/2022.


To home page

Leave a Comment