It is one of the greatest ironies in law firm marketing: attorneys advise clients on data protection law – while operating a website that violates the GDPR themselves. Not out of malicious intent, but because the technical details often remain hidden: a Google Font that silently transmits data to US-
The consequences range from cease-and-desist letters from competitors to GDPR fine proceedings. For law firms, there is an additional reputational damage that extends far beyond the legal harm: those who ignore data protection themselves lose the trust of clients who want to be advised precisely in this area.
This article identifies the ten most common GDPR mistakes on law firm websites – with concrete solutions for WordPress. For everything that goes beyond technical implementation, our Data Protection and Compliance for Lawyers section is available as a resource.
Mistake 1: Google Fonts Externally Embedded
Google Fonts is one of the most widespread GDPR traps for law firm websites. When fonts are loaded via fonts.googleapis.com, the visitor's browser transmits their IP address to Google servers in the USA – without consent. The Munich Regional Court classified this as a GDPR violation in 2022.
Solution for WordPress: Host Google Fonts locally. Download the required font files (google-webfonts-helper.herokuapp.com is a helpful tool), store them on your own server, and embed them via CSS. Alternatively, use a plugin like OMGF (Optimize My Google Fonts) that automates this process.
Mistake 2: Google Analytics Without Consent
Google Analytics may only be activated after active consent from the visitor. An analytics script that already transmits data on the first page load violates GDPR Art. 6. This also applies to Google Tag Manager when Analytics is loaded through it.
Solution: Integrate Analytics through a consent management plugin that ensures the script is only loaded after consent. Recommended tools for WordPress: Borlabs Cookie, Complianz, or Cookiebot. Alternative: Matomo with server-side operation, which is GDPR-compliant without consent.
Mistake 3: Cookie Banner Without Real Choice
A cookie notice that only displays an OK button without offering a Decline option is not valid consent. This also applies to pre-selected checkboxes and banners that interpret continued scrolling as consent. The European Court of Justice has repeatedly clarified the requirements for valid consent.
Solution: Your cookie banner must offer at least two equivalent options: Accept All and Only Necessary Cookies. The rejection button must not be visually smaller or less visible. Technically necessary cookies (session, login) do not require consent.
Mistake 4: Contact Form Without Minimum Requirements
- Both contact methods as mandatory fields: Email and phone must not both be mandatory fields. Only one contact method is required to process the inquiry.
- No SSL encryption: The form must run over HTTPS. No form on an HTTP page.
- Hidden newsletter opt-in: A pre-selected checkbox for newsletter subscription in the contact form is invalid and subject to cease-and-desist action.
- Missing DPA with the provider: If a third-party provider (e.g. WP Forms, Gravity Forms) processes form data, you need a data processing agreement.
Mistake 5: Loading external services without consent
Google Maps, YouTube embeds and reCAPTCHA load scripts on page load and transfer data to Google – without the visitor having consented. This also applies to social media buttons that load tracking code.
Solution: Load external services only after consent. For Google Maps: 2-click solution (first show placeholder, load after click). For YouTube: use privacy-enhanced mode (youtube-nocookie.com) or 2-click embed. Your consent management plugin should automatically block these services and only activate them after consent.
The complete GDPR checklist for law firm websites
The following checklist covers all essential checkpoints. Not a substitute for individual legal review, but a solid starting point:
GDPR check for your law firm website
OMmatic reviews your law firm website for the most common GDPR mistakes and implements the technical corrections in WordPress.
Recommended tools for WordPress law firms
Consent management
Borlabs Cookie (paid, approx. 39 EUR/year) or Complianz (freemium) are the most reliable options. Both support the TCF 2.0 framework and can be combined with Google Tag Manager. Important: The plugin must be updated regularly as GDPR requirements change.
Google Fonts locally
OMGF (Optimize My Google Fonts) automates the local integration of Google Fonts in WordPress. It loads fonts locally, removes external Google calls and updates as needed. Free in the basic version, paid extensions for more complex setups.
Analytics without consent
Matomo (formerly Piwik) can be configured server-side so that no personal data is transmitted and no consent is required. Requirements: IP anonymization enabled, no cross-site tracking, data remains on your own server. There is an official Matomo plugin for WordPress.
Conclusion
A GDPR-compliant law firm website is not a one-time project, but an ongoing process: New tools are added, requirements change, court rulings clarify the legal situation. The best approach is a solid technical foundation that can be managed with the right plugins, combined with regular review. All other topics related to data protection and legally compliant law firm marketing can be found under Data Protection and Compliance for Lawyers.
Making your law firm website technically and legally secure
OMmatic implements GDPR-compliant consent management, optimizes Google Fonts, and ensures that your WordPress website meets current requirements.
