[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmoLZIQ6UB30ZIFiQIjUlQvQ2ie5w5mTaxtqUPEQv1js":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"70c19285-ad4d-4687-baa2-9ab31aa8e711","CJEU - C-654\u002F25 - Undelam","cjeu-c-654-25-undelam-18b9e5","Created page with \"{{CJEUdecisionBOX |Case_Number_Name=C-654\u002F25 Undelam |ECLI=ECLI:EU:C:2026:948 |Opinion_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fjurisprudence?lang=en&sort=DOC_DATE-DESC&searchTerm=2016%252F679 |Judgement_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fjurisprudence?lang=en&sort=DOC_DATE-DESC&searchTerm=2016%252F679 |Date_Decided= |Year= |GDPR_Article_1=Article 4(1) GDPR |GDPR_Article_Link_1=Article 4 GDPR#1 |GDPR_Article_2=Article 82 GDPR |GDPR_Article_Link_2=Arti...\" New page {{CJEUdecisionBOX |Case_Number_Name=C-654\u002F25 Undelam |ECLI=ECLI:EU:C:2026:948 |Opinion_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fjurisprudence?lang=en&sort=DOC_DATE-DESC&searchTerm=2016%252F679 |Judgement_Link=https:\u002F\u002Finfocuria.curia.europa.eu\u002Ftabs\u002Fjurisprudence?lang=en&sort=DOC_DATE-DESC&searchTerm=2016%252F679 |Date_Decided= |Year= |GDPR_Article_1=Article 4(1) GDPR |GDPR_Article_Link_1=Article 4 GDPR#1 |GDPR_Article_2=Article 82 GDPR |GDPR_Article_Link_2=Article 82 GDPR |GDPR_Article_3= |GDPR_Article_Link_3= |GDPR_Article_4= |GDPR_Article_Link_4= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1= |Party_Link_1= |Party_Name_2= |Party_Link_2= |Reference_Body=BGH |Reference_Case_Number_Name= |Initial_Contributor=lh | }} The Advocate General opined that a dynamic IP address that was automatically sent to Google is personal data for the sender when Google is likely to identify the data subject by combining the data with other data that Google has access to. Since the data subject provoked the circumstances that led to the data transfer, they did not suffer immaterial damages and abused their rights. ==English Summary== === Facts === A provider of a website (controller) used Google Fonts on its website. Google Fonts enables the use of different fonts on the website free of charge. By default, the fonts are loaded from a Google server, which results in the automated transfer of IP addresses of the user of the website to the US. The controller did not make use of a setting that disallows the data transfer. Through an automated system that detected the implementation of Google Fonts on a website and automatically accesses the website in order to trigger the transfer of the IP address to the US, a data subject’s IP address was transferred to the US after a visit on the controller’s website. The data subject then requested the controller to pay a monetary compensation for the data transfer as a settlement, which the controller paid. When the controller found out that the data subject has used this method on thousands of website providers, they reclaimed the money. The Regional Court Hannover (Amtsgericht Hannover) ruled that the data subject shall partly repay the controller. Upon appeal, the Higher Regional Court (Landgericht Hannover) ruled that the data subject shall repay the full amount, on the basis of making the claim with abusive intentions. The data subject appealed that decision to the Federal Court of Justice (Bundesgerichtshof). According to the Federal Court of Justice, the controller’s claim depended on the question whether the data subject has suffered immaterial damages pursuant to [[Article 82 GDPR|Article 82 GDPR]]. Therefore, the Federal Court of Justice referred the question to the CJEU whether an IP address can be considered personal data, regarding the question of identifiability in particular. With the second question, the referring court asks for the interpretation of “immaterial damages” in case the data subject intentionally provoked the infringement. Lastly, the referring court asks for the prerequisites of an abuse of rights under Union Law when the circumstances of the claim are provoked by the claimant for the purpose of a financial advantage. === Advocate General Opinion === 1. Question: identifiability of the data subject According to Advocate General Szpunar (AG), data is personal data pursuant to [[Article 4 GDPR|Article 4(1) GDPR]] when the entity that processes the data can identify the data subject by combining the personal data in question with other data, using the means accessible to the processing entity or third persons. The question of identifiability is to be assessed not from an abstract perspective, but from the perspective of the entity that has access to the data (subjective approach). The abstract possibility that someone is capable of identifying the data subject is not sufficient. Data is personal data for an entity when the entity, or third parties that the entity allowed access to the data, have the means to identify the data subject, and when it is likely that the additional means enable identification. In this case, the data is personal data for the third party who possesses all the information to identify the data subject, as well as indirectly, for the controller. For the case at hand, this means that when the recipient of the automatically collected dynamic IP address has the means that likely enable the identification of the data subject, the dynamic IP address is personal data for the recipient as well as for the sender. The question whether the entity that submits the IP address can identify the data subject, and therefore the question whether the data is personal data for that entity, is irrelevant. It is relevant whether the recipient of the IP addresses has the means to likely identify the data subject. In case of the affirmative, the data is also personal data for the sender. As far as the means are concerned that are likely used to identify the data subject, all objective factors such as cost and required amount of time for identification as well as the available technology at that time are to be considered. Therefore, according to the AG, the determining factor to assess whether there are means that can likely identify the data subject, is whether there is a risk of identification. In line with the CJEU’s interpretation of a wide scope of personal data, the threshold for assuming a risk of identification must be low. It is not necessary to that the possibility of identification can be proven, but that there is a considerable risk of identification. Since the dynamic IP address is transferred to Google, and Google possesses an extensive amount of personal data that enables, when combined, to draw conclusions about the private life of the data subject. This is because the purpose of the data transfer is to personalise the service according to the user’s habits and preferences. It is for the referring court to decide whether the combination of the IP address and other data that Google has access to, enables to draw conclusions on the user’s private life. In this case, there is a considerable risk of identification. Consequently, the dynamic IP address is to be considered personal data for the sender as well. In order to avoid the situation that the sender is to be considered controller and thus has to oblige the GDPR because of a circumstance that is outside their sphere of influence (the likely identification by the recipient), the Ag added another criterium on the subjective side: the sender must know or should have known that the recipient possesses the means to likely identify the data subject. 2. Immaterial damages According to the AG, the notion of “material or immaterial damage” pursuant to [[Article 82 GDPR|Article 82 GDPR]] is a notion of Union law, not national law, and therefore to be interpreted uniformly within the Union. The mere fact that the controller violated a provision of the GDPR does not allow the conclusion that the data subject suffered a damage. In reference to CJEU case law, it is not necessary that the data has been used improperly. If suffices when the data subject has suffered a loss of control over their personal data, or that the data subject reasonably fears a loss of control. The AG opined that in the case at hand, the data subject has not lost control of their personal data because the data has been processed exactly in the way intended by the data subject. This is because the data subject provoked the data transfer to Google. The data subject did not fear an improper use of their data, they accepted the risk thereof by using the software that automatically accesses website that use Google Fonts. 3. Abuse of rights under Union law An abuse of rights presupposes subjective and objective circumstances. On the objective side, the goal of the respective provision must be missed despite the fact that all conditions of the provision are fulfilled. On the subjective side, the person must have the intention of receiving a legal benefit by intentionally creating the circumstances that lead to the fulfilment of the provision. Because the data subject automatically accessed thousands of websites and therefore provoked the damage, and accepted a financial advantage in return of not further pursuing their rights, the AG concludes that the data subject acted with the intention of arbitrary creating the applicability of the GDPR. The data subject’s claim that they intended to make the website providers aware of the data privacy problem did not change that opinion. According to the AG, the main goal of the data subject was to pursue a financial advantage. 4. Conclusion According to the AG, data is personal data for the sender when the recipient has the means to likely identify the data subject. In case the recipient can combine the data in question with other data, and is capable of drawing conclusions about the private life of the data subject, and the sender knows or should have known about these circumstances, the data is personal data for the sender. The data subject did not suffer an immaterial damage because he did not suffer a loss of control over their data. This is because they provoked the improper use of their data. The data subject intentionally created the circumstances that led to the violation of the GDPR in order to benefit financially. This is an abuse of rights, according to the AG. === Holding === tbd == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!''","The CJEU Advocate General has opined that a dynamic IP address automatically sent to Google constitutes personal data for the sender if Google can identify the individual by combining it with other data. This case involves a website provider using Google Fonts, leading to IP address transfers to the US. The data subject's claim for damages was questioned due to potentially abusive intentions, prompting the referral to the CJEU.","CJEU Advocate General opines dynamic IP addresses sent to Google are personal data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-654\u002F25_-_Undelam&diff=53640&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F8\u002F87\u002FCjeulogo.png","2026-11-06T18:24:22+00:00","2026-11-06T19:00:36.217422+00:00",7,[17,20],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Google Fonts","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":63},"google-fonts-ip-leakage-third-party-scripts-as-a-gdpr-data-transfer-risk","Google Fonts IP Leakage: Third-Party Scripts as a GDPR Data Transfer Risk","Embedding third-party resources such as Google Fonts directly from an external CDN causes end-users' dynamic IP addresses to be automatically transmitted to the third-party provider — in this case, a US-based entity — without the user's knowledge or consent. The CJEU case confirms that even a dynamic IP address can constitute personal data under GDPR when the recipient can combine it with other information to identify an individual. This matters because countless websites unknowingly trigger transatlantic personal data transfers simply by including an external script or font tag, exposing operators to regulatory liability and potential damages claims. Website owners must treat every third-party resource embed as a data transfer decision requiring a legal basis and appropriate safeguards.",[56,57,58,59,60,61,62],"GDPR Article 32","GDPR Article 46","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components",{"GDPR Article 32":64,"GDPR Article 46":65,"NIS2 Article 21(2)(b)":66,"NIST SP 800-53 SI-2: Flaw Remediation":67,"CIS Control 17: Incident Response Management":68,"OWASP A06:2021 Vulnerable and Outdated Components":69,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":70},"Article 32 requires controllers to implement appropriate technical measures to ensure data security; self-hosting fonts rather than triggering automatic IP transfers to a third country is precisely the kind of technical safeguard required.","Transfers of personal data (including IP addresses) to third countries like the US require appropriate safeguards such as Standard Contractual Clauses, which were absent in the Google Fonts embedding scenario.","NIS2 mandates incident handling and supply-chain security measures; vetting third-party resource providers and their data-handling practices is a direct supply-chain security obligation triggered by this case.","While traditionally applied to software flaws, the principle extends to configuration flaws such as external resource loading that inadvertently exposes personal data — remediation should be prompt and tracked.","Having a defined process to respond to discovered privacy incidents, including notifying affected users and remediating data-leaking configurations, limits regulatory and legal exposure when transfers are found.","Unreviewed third-party components embedded in web applications, including external font services, introduce both security and privacy risks that organisations must inventory and assess regularly.","A systematic review of third-party dependencies — analogous to vulnerability management — would have identified the unintended data transfer risk introduced by externally loading Google Fonts."]