A typical website loads resources from external servers on every page load: fonts from Google Fonts, icons from a CDN, analytics scripts from a US service. Each request transmits the user’s IP address to a third party – often to the US. Since the Schrems II ruling, this is a concrete compliance problem.

The GDPR Problem with External Requests

A January 2022 German court ruling (LG Munich, Az. 3 O 17493/20) established that loading Google Fonts via Google servers without consent violates the GDPR. The reason: every page load transmits the user’s IP address to Google in the US – personal data under Art. 4 No. 1 GDPR without legal basis.

This applies to all external requests – CDN-hosted libraries, icon services, analytics pixels – each transmits the IP address to a third party.

What Self-Hosting Means

Self-hosting means all resources a website needs for rendering are served from your own server. No external DNS lookups, no data transfer to third parties, no dependency on external service availability.

This includes: Fonts (self-hosted WOFF2 files instead of Google Fonts CDN), Icons (local SVGs instead of Font Awesome CDN), CSS frameworks (local build instead of CDN-hosted Tailwind), JavaScript libraries (npm install + bundle instead of unpkg/cdnjs), Analytics (Plausible Cloud EU or Matomo instead of Google Analytics).

Performance Advantage

Contrary to common belief, self-hosting is often faster than CDN-based solutions. Since HTTP/2, all resources from the same server are delivered over a single TCP connection. The overhead for DNS lookup, TCP handshake, and TLS negotiation for each external host is eliminated.

Asset Type
External (typical)
Self-Hosted Alternative
Effort
Fonts
Google Fonts CDN
WOFF2 in /fonts folder
Low
Icons
Font Awesome CDN
Local SVGs + Sprite
Low
CSS Framework
CDN (Tailwind)
npm install + Build
Low
Analytics
Google Analytics
Plausible Cloud / Matomo
Medium
Maps
Google Maps
MapLibre + own tiles
High

Key Takeaways

  • Every external request transmits the user’s IP address to a third party – a concrete GDPR problem.
  • Self-hosting eliminates external dependencies and is often faster than CDN-based solutions via HTTP/2.
  • Fonts, icons, CSS frameworks, and JS libraries can be self-hosted with minimal effort.
  • Combining self-hosting with font subsetting minimizes both file size and dependency.
  • Plausible Cloud (EU-hosted) and Matomo are GDPR-compliant analytics alternatives.
  • Consistent self-hosting is a cornerstone of frontend digital sovereignty.