Loading fonts from Google is noch GDPR compliant

[bjoerns1983]

Because of the dynamically loaded fonts the Theme is not GDPR compliant.
Please consider to include the fonts directly into the theme so it is not necessary to load them from Googles Servers.

[cristianraiber]

@bjoerns1983 - you can use a plugin like this one: https://wordpress.org/plugins/host-webfonts-local/

[bjoerns1983]

Yes thats a common workaround for people who know that the fonts in the theme could be a problem for them.
I doubt that many users know that.
I dont know what would be so problematic just embedding the fonts directly into the theme.

[puikinsh]

Still valid, and still open — thanks for your patience on this one.

Where it stands in 2.6.3: the theme still requests Open Sans and Roboto Slab from fonts.googleapis.com by default, so the concern you raised is unchanged. Two things did improve incidentally: the request is now https rather than protocol-relative, and it carries display=swap. Neither addresses the GDPR question, which is about the request happening at all.

Available today — the font loading is already behind a filter, so you can switch it off without editing the theme. In a child theme's functions.php:

add_filter( 'sparkling_allow_google_fonts', '__return_false' );

That removes the request to Google entirely. You then either accept the fallback stack or enqueue self-hosted copies of the two families yourself.

What we should do properly: bundle the fonts with the theme and serve them locally, so no third-party request happens by default. That's the right fix and it's what you asked for. Leaving this open to track it.

One caveat worth flagging for anyone self-hosting: Open Sans and Roboto Slab are SIL OFL 1.1, which permits redistribution, so bundling them is fine licence-wise.