The European Court of Justice's advocate general has given the clearest signal yet that Germany's automated Google Fonts cease-and-desist industry is on borrowed time. In an opinion delivered on Thursday in case C-654/25, Advocate General Maciej Szpunar argued that a person who deliberately, automatically and repeatedly engineers a data-protection breach in order to extract money suffers no compensable harm — and that pursuing damages in that setup amounts to an abuse of rights.
The mechanism behind the cases is technical before it is legal. When a website loads Google Fonts from Google's servers rather than hosting the files itself, every visitor's IP address is transmitted to a server in the United States. Under the GDPR that is a transfer of personal data to a third country, and it has been treated as unlawful absent a valid transfer mechanism. Crawlers can detect the pattern at scale. According to the case record reported by heise online, one plaintiff used web crawlers to find thousands of sites loading fonts externally; a commissioned lawyer then sent standardized letters demanding payment. One site operator paid €170 before fighting the claim, a path that led the Bundesgerichtshof to refer open questions to the CJEU in August 2025.
Szpunar's opinion separates two questions that the letter industry prefers to blur. The first is whether a dynamic IP address is personal data at all. His answer is conditional: it is, when the receiving party has means reasonably likely to be used to identify the person — and when the sender knows, or ought to know, that this is the case. That keeps the classification tied to technical reality rather than treating every IP packet as an identifier by definition.
The second question is the one that matters commercially. Under Article 82 of the GDPR, a data subject can claim non-material damages for loss of control or justified fear of misuse. Szpunar's view is that someone who systematically scans the internet to manufacture data transmissions and then sends demands experiences neither: there is no genuine loss of control when the data was used exactly as the person arranged for it to be used. The claim, in his framing, is not compensation but a business model.
He then goes further and invokes the EU-law principle prohibiting abuse of rights. Where the primary motive is financial income and the conditions for the claim were created artificially and deliberately, data-protection enforcement loses its protective purpose. He draws an explicit parallel to copyright trolling, where litigation is conducted purely as a commercial operation.
The caveats matter. An advocate general's opinion is not binding on the Court; the judges usually follow it, but not always, and a final judgment is still months away. Nothing in the opinion says embedding third-party fonts is lawful, that IP addresses are never personal data, or that data subjects lose their rights. The narrow point is who may profit from a breach they arranged themselves — a distinction that leaves the underlying transfer problem intact.
That is why the technical fix survives the legal one. Self-hosting fonts removes the transmission entirely; it is cheaper than a lawyer and does not depend on a court's view of motive. Plenty of German site operators learned that the hard way after the first wave of letters, and the practice became standard advice well before this case reached Luxembourg.
The broader significance is institutional. Germany has spent years arguing over whether privacy law should be enforceable by mass automated demand letters, with the Bundesrat going as far as pushing to ban GDPR cease-and-desist letters outright. A ruling along Szpunar's lines would not settle that political fight, but it would remove one of its most lucrative engines. For web developers, the practical lesson is unchanged and slightly ironic: the safest defense against a font-letter business model remains a build step that copies the font files into your own project.
