To my knowledge IP addresses are considered personal data under the GDPR and thus may only be processed under one of several conditions (one being user consent). There has also been a verdict in a German court according to which embedding Google Fonts (loaded from Google servers) requires such consent, because the IP address is shared with Google. So website operators can either ask for consent or serve the fonts from their own server instead.
But, what if my entire site is hosted at Google? Obviously Google receives the visitors' IP addresses starting with the very first HTTP request and I get no chance to ask them for permission BEFORE that happens. There are plenty of hosting options inside the EU. Let us assume that my site is static and could be hosted on any one of them, so I can make no argument for choosing Google specifically.
- Am I even allowed to use Google for hosting my site?
- Does it make a difference whether I inform the visitor (after the processing of their IP has already happened)?
- IF it is OK, can I then use Google Fonts without consent, because Google has already seen the visitor's IP anyway?
Side note: These seem like really weird questions to ask, but after following some GDPR debates about Google Fonts and even basic things like HTTPd access logs, nothing seems quite certain anymore.