When you include an outside (=on a server not controlled by you) source, that outside source now gets the IP address - which is considered personal identifiable

When you include an outside (=on a server not controlled by you) source, that outside source now gets the IP address - which is considered personal identifiable data in the EU context - a timestamp, and a referrer. This allows Google to track users over different sites that use, for example, google-hosted webfonts. Strictly speaking, you must not. That doesn't apply to a-links, because using those implies users made an active decision to load that resource, and thus consent. We've stopped using outside resources for that exact matter. In many european websites today, you see extra steps being necessary before other external ressources (which includes embedded Youtube videos) are loaded - for an example of that, see https://www.heise.de/make/meldung/Wenn-die-Band-bastelt-Murmel-Musik-Maschine-mit-2000-Kugeln-3125795.html https://www.heise.de/make/meldung/Wenn-die-Band-bastelt-Murm... We host locally on our own servers. It's one of those typical "tragedy of the commons" situation in which one bad actor kills a good thing (in this case: caching).