Austrian Economic Development Agency — 20 requests, 2 domains. fast.fonts.net (Monotype, USA) loads fonts on every visit — IP address sent to the USA without declaration. Matomo is declared with a cookie banner — it did not appear in the HAR.
Timeline of the leak
Declared versus actual
Transfer timings
Monotype/Fonts.com CDN. Cloudflare-backed. Data goes to the USA, absent from the policy.
3 WOFF2 files. Each request is a separate transfer of the IP address to the USA.
Indicators of GDPR non-compliance
- GDPR Art. 13, Art. 44 ff.fast.fonts.net (Monotype/Fonts.com) loads a CSS configuration and 3 WOFF2 font files from servers in the USA on every visit. The IP address is transmitted to Monotype Imaging Inc. (Woburn, MA, USA) without declaration in the privacy policy.
Context
Austria Wirtschaftsservice GmbH (aws) is the state economic development agency, distributing subsidies and guarantees to Austrian businesses on behalf of the federal government. HAR: 20 requests, 2 domains.
fast.fonts.net — fonts from the USA without declaration
fast.fonts.net — a CDN operated by Monotype Imaging Inc. (Woburn, Massachusetts, USA), a commercial web-font provider. Every page load triggers 5 requests to it: a CSS font-project configuration and three WOFF2 files. Each request transmits the visitor’s IP address to the USA. This service is not mentioned in aws’s privacy policy — not as Monotype, not as Fonts.com, and not as an “external font CDN.”
Matomo held behind the banner
The policy describes Matomo with an opt-in consent gate and a cookie banner. Matomo did not appear in the HAR — the consent system works. This is the correct architecture for the analytics tool aws describes, and it wouldn’t have worked without a consent gate.
Conclusion
aws correctly documented Matomo and implemented a consent gate. But the use of an external font CDN transmitting data to the USA without declaring it in the policy is a narrow but real gap for an agency that itself awards digitalization subsidies to Austrian businesses.
ea8f727f58566d38c112587223d3cf3989098d35f743b403a52bffe4aa5f48ccWhere to file: Datenschutzbehörde (DSB) — file a complaint online →
To: Datenschutzbehörde (DSB) From: [Your name], [contact email] 1. Subject of the complaint I am filing a complaint regarding the processing of my personal data by the website aws.at. 2. Circumstances I visited the website aws.at and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 26 May 2026 (open methodology, reproducible measurements) documents the following indications: 1) fast.fonts.net (Monotype/Fonts.com) loads a CSS configuration and 3 WOFF2 font files from servers in the USA on every visit. The IP address is transmitted to Monotype Imaging Inc. (Woburn, MA, USA) without declaration in the privacy policy. Full technical documentation is published at: https://gdpru.eu/en/audits/at-aws-at/ 3. Provisions violated GDPR Art. 13, Art. 44 ff. 4. Request I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR. 5. Attachments The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above. [Date] [Signature / name]