GDPR Compliance in France – Self-Hosting Google Fonts with Pro / Cornerstone

Hello Themeco team,

I am using the Pro theme with Cornerstone on my WordPress website, and I would like to host all fonts locally rather than loading them from Google’s external servers.

My primary objective is GDPR compliance under European and French data protection regulations .

When Google Fonts are loaded from Google’s servers, visitors’ IP addresses and other technical information may be transmitted to Google. I want to avoid this external data transfer by ensuring that all fonts are served directly from my own hosting server.

Performance improvements would be welcome, but they are secondary. My main concern is protecting visitors’ personal data and ensuring that my website does not make unnecessary external requests to Google when displaying its typography.

I understand that Pro / Cornerstone includes a Font Manager that supports custom fonts uploaded to the WordPress Media Library.

Before proceeding, I would appreciate clarification on the following technical points.

1. Persistence across theme and plugin updates

When custom fonts are added through the Cornerstone Font Manager:

  • Where exactly are the font definitions stored?
  • Where are the actual uploaded font files stored?
  • Are both the font definitions and uploaded files preserved when updating the Pro theme and Cornerstone?
  • Can a standard theme or plugin update overwrite, reset or otherwise affect custom font definitions?

2. Replacing existing Google Fonts

My website currently uses several Google Font families, with multiple weights and styles.

  • Can I replace the Google Fonts source of an existing Font Manager entry with locally hosted custom font files while keeping the same font name or identifier?
  • Will all existing elements and pages using that font automatically use the local files, without requiring individual page edits?
  • Is this the recommended approach for migrating an existing Pro website from Google Fonts to locally hosted fonts?

3. Ensuring GDPR-compliant local font loading

Once all Google Font entries have been replaced with custom local fonts:

  • Will Pro / Cornerstone stop generating requests to fonts.googleapis.com ?
  • Will it also eliminate requests to fonts.gstatic.com ?
  • Are there any circumstances in which Cornerstone may still load Google Fonts externally despite using custom fonts in the Font Manager?
  • Is there a recommended way to verify that no visitor browser makes external requests to Google Fonts?

4. Backups and long-term maintenance

  • Are custom font definitions included in a standard WordPress database backup?
  • Are uploaded font files included in a standard WordPress files backup?
  • Will these remain available after website restoration or migration to another hosting provider?

5. Official recommendation

Would you recommend using the native Cornerstone Font Manager to host all website fonts locally as a solution for GDPR compliance?

I am looking for a reliable, officially supported and update-safe solution that does not require additional plugins, custom PHP or CSS code, or individual edits to hundreds of pages.

Thank you for your help. I would particularly appreciate confirmation of whether this approach is fully supported and whether it can ensure that no Google Fonts requests are sent from visitors’ browsers.