The Google Fonts Reference: An AG Says a Self-Inflicted GDPR Breach Earns No Damages
AG Szpunar's opinion in C-654/25 says a claimant who triggers a website's IP transfer by design to collect payouts has suffered no compensable harm.
On 5 November 2026, Advocate General Maciej Szpunar delivered his opinion in Case C-654/25, a reference from Germany's Federal Court of Justice arising from the wave of "Google Fonts" demand letters. A website used Google Fonts in its default dynamic setup, which sends each visitor's IP address to Google. A claimant used a crawler to find such sites and software to visit them, then had a lawyer demand €170 for the unlawful transfer; the operator paid and later sued to get the money back. The AG proposes that a dynamic IP address can be personal data for the website, on a relative test: the operator is caught when it knew, or should have known, that the recipient could identify the user. But a person who knowingly provokes an infringement, in an automated and repeated way, in order to be compensated suffers no non-material damage under Article 82 GDPR; there is no real loss of control when the data goes exactly where the claimant planned. In the alternative, he would treat the claim as an abuse of rights, where financial gain need only be the main motive, not the sole one. The opinion matters because it tests whether the Court's generous approach to non-material damage can be turned into a business model.
In my view, the AG gets the balance right. He does not weaken the substantive rule: operators who leak IP addresses to third parties are still in breach, and regulators can still act. What he denies is a private payout manufactured by the claimant himself, and that protects Article 82 from becoming a toll booth! I find the structure especially sound: the main answer rests on the absence of damage, a GDPR concept, rather than on national notions of good faith, which keeps the rule uniform across Member States. The gap is evidence. Courts will now have to decide when a visit is "provoked", and genuine users who happen to be privacy-conscious must not be lumped together with crawler operators. The practical lesson for companies is simple: the trolls may lose, but the breach remains a breach, so host fonts locally and audit every third-party script. An opinion is not a judgment, and the Court may still go its own way!
Source: MLex, 5 November 2026; Captain Compliance, November 2026. Image: Wikimedia Commons, FrDr, CC BY-SA 4.0.
