Maps, fonts and analytics: the three privacy leaks
The leaks are almost always the same three. An embedded map, a font loaded from another domain and an analytics identifier each contact a third party or store information on the device, and consent is required unless the storage or access is strictly necessary for a service the user expressly requested. Removing them removes the problem.
Why these three and not others
An embedded map contacts another party before the visitor has asked for a map. A font loaded from another domain does the same for a design decision the visitor did not make. An analytics identifier stores something on the device for your benefit rather than theirs.
The rule covers all three because it is written about the device, not about cookies: storing information on the end user's terminal equipment and accessing information already stored there require consent based on clear and comprehensive information.
There are exactly 2 exemptions: the sole purpose of carrying out the transmission of a message, and strict necessity for a digital service the user expressly requested. A map nobody clicked, a font nobody asked for and a counter that serves you fail both.
Which is why the cheapest fix is not a better banner. It is removing the requests, after which there is nothing left to ask about.
The three fixes, counted
Fonts: download the files and serve them from your own domain. That is typically 2 to 4 files and one line in the stylesheet, and it removes 1 external connection from every page load.
Map: replace the embed with a static image and a link. The visitor who wants directions clicks and goes to the map provider knowingly, which is the expressly requested case, and the page load makes 0 third party requests.
Analytics: decide whether you need it. If you count enquiries by channel on a sheet, as most local businesses should, an analytics identifier adds little that you can act on, and a page with 0 non exempt technologies needs 0 consent dialogues.
| Addition | Why it is a problem | Fix |
|---|---|---|
| External font | Contacts another domain on load | Self host the files |
| Embedded map | Contacts a third party before any request | Static image plus a link |
| Analytics identifier | Stores on the device for your benefit | Remove, or obtain consent |
| Video embed | Sets identifiers before playback | Thumbnail plus a link |
What to check after the change
Load your own page and list every request to a domain that is not yours. The count should be 0 for a brochure site. Anything left is a decision you are making deliberately rather than one that arrived with a template.
Then keep the discipline at the next redesign. Themes and page builders reintroduce external fonts by default, and the reintroduction is silent.
Questions and answers
Do I need consent for fonts?
What replaces an embedded map?
Is analytics strictly necessary?
How do I check what my page loads?
Sources
- Section 25, Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz The consent requirement and both exemptions
- web.dev, Web Vitals Why removing external requests also helps the loading thresholds
