This is regulated in the GDPR, article 28. You may have an external "processor" of your data (which is almost always the case, because few people have full resp

This is regulated in the GDPR, article 28. You may have an external "processor" of your data (which is almost always the case, because few people have full responsibility over their hosting setup), but this processor is bound to abide the rules of the GDPR, and you need some sort of contract with the processor. Since you have no control over what Google does with the data of visitors when you embed Google Fonts, it is not compatible with the GDPR (just like Google Analytics). https://de.wikipedia.org/wiki/Datenverarbeitung_im_Auftrag https://de.wikipedia.org/wiki/Datenverarbeitung_im_Auftrag https://www.gdpr.org/regulation/article-28.html https://www.gdpr.org/regulation/article-28.html This is a good decision by the court. Sure, web developers may not like it, but it may force them to improve on how they work.