[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIvEY5uX2zeHi60JfUD6BMZgEhXS_RaljVy1F5ibCCH4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"e6ec88f3-06a0-45fa-9f73-4eda71475950","google-fonts-ip-leakage-third-party-scripts-as-a-gdpr-data-transfer-risk","70c19285-ad4d-4687-baa2-9ab31aa8e711","Google Fonts IP Leakage: Third-Party Scripts as a GDPR Data Transfer Risk","Embedding third-party resources such as Google Fonts directly from an external CDN causes end-users' dynamic IP addresses to be automatically transmitted to the third-party provider — in this case, a US-based entity — without the user's knowledge or consent. The CJEU case confirms that even a dynamic IP address can constitute personal data under GDPR when the recipient can combine it with other information to identify an individual. This matters because countless websites unknowingly trigger transatlantic personal data transfers simply by including an external script or font tag, exposing operators to regulatory liability and potential damages claims. Website owners must treat every third-party resource embed as a data transfer decision requiring a legal basis and appropriate safeguards.","**Immediate actions:**\n- Audit all web pages for externally hosted third-party resources (fonts, scripts, analytics, CDNs) that cause automatic IP address transmission to external servers.\n- Self-host any third-party assets (e.g., Google Fonts, icon libraries) on your own infrastructure to eliminate unsolicited outbound data transfers.\n\n**Long-term improvements:**\n- Establish a formal third-party vendor review process that evaluates the data-transfer implications of every external dependency before it is approved for use.\n- Implement a Content Security Policy (CSP) header to restrict which external origins your pages are permitted to contact, reducing the attack surface for accidental data leakage.\n- Maintain an up-to-date inventory of all third-party integrations and their associated Data Processing Agreements (DPAs) or Standard Contractual Clauses (SCCs).\n\n**Detection & compliance measures:**\n- Deploy automated scanning tools (e.g., OWASP ZAP, browser privacy scanners) to continuously detect new external resource calls introduced during development or CMS updates.\n- Conduct periodic GDPR transfer impact assessments (TIAs) for all identified third-country data flows and document the legal basis for each.",[12,13,14,15,16,17,18],"GDPR Article 32","GDPR Article 46","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components",{"GDPR Article 32":20,"GDPR Article 46":21,"NIS2 Article 21(2)(b)":22,"NIST SP 800-53 SI-2: Flaw Remediation":23,"CIS Control 17: Incident Response Management":24,"OWASP A06:2021 Vulnerable and Outdated Components":25,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":26},"Article 32 requires controllers to implement appropriate technical measures to ensure data security; self-hosting fonts rather than triggering automatic IP transfers to a third country is precisely the kind of technical safeguard required.","Transfers of personal data (including IP addresses) to third countries like the US require appropriate safeguards such as Standard Contractual Clauses, which were absent in the Google Fonts embedding scenario.","NIS2 mandates incident handling and supply-chain security measures; vetting third-party resource providers and their data-handling practices is a direct supply-chain security obligation triggered by this case.","While traditionally applied to software flaws, the principle extends to configuration flaws such as external resource loading that inadvertently exposes personal data — remediation should be prompt and tracked.","Having a defined process to respond to discovered privacy incidents, including notifying affected users and remediating data-leaking configurations, limits regulatory and legal exposure when transfers are found.","Unreviewed third-party components embedded in web applications, including external font services, introduce both security and privacy risks that organisations must inventory and assess regularly.","A systematic review of third-party dependencies — analogous to vulnerability management — would have identified the unintended data transfer risk introduced by externally loading Google Fonts.","published","2026-11-06T19:21:43.530597+00:00","2026-11-06T19:21:43.511+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-654\u002F25_-_Undelam&diff=53640&oldid=0","cjeu-c-654-25-undelam-18b9e5","CJEU - C-654\u002F25 - Undelam",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":48,"name":49,"slug":50,"description":51,"color":52},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[]]