How to Run WordPress Without Google

Anyone trying to run WordPress without Google usually starts in the wrong place, ripping out Analytics and stopping there. A typical WordPress site can talk to Google in more places than that. Many themes load fonts from Google's CDN, comment sections call out to Gravatar by default, which exposes visitor IPs regardless of who owns it, and most contact-form plugins default to reCAPTCHA. None of this is malicious, it's just the default in most setups, and defaults are where privacy problems live.

Two of these have had real legal consequences in the past few years, not hypothetical ones. Here's what's actually happening with each, and what to run instead.

Step one to running WordPress without Google: fonts

On January 20, 2022, the Regional Court of Munich ruled that a website loading Google Fonts from Google's own servers violated GDPR, because the visitor's IP address was transmitted to Google without consent. The court awarded the visitor €100 in damages and threatened penalties of up to €250,000 for continued violations. The reasoning was specific: since Google Fonts can be served without any connection to Google at all, by hosting the font files locally, there was no legitimate interest in choosing the version that phones home.

What followed was less about the ruling and more about what it enabled. Within months, German site owners started receiving demand letters from claimants who had automated the process of detecting Google Fonts usage and filing against it at scale. The pattern has since spread to the Netherlands and Belgium under the same underlying GDPR reasoning.

The fix takes about fifteen minutes: download the font files and serve them from your own server instead of fonts.googleapis.com. Most WordPress themes that use Google Fonts have a local-hosting option, or a plugin like OMGF handles it automatically. There is no reason for a WordPress site to load fonts from Google in 2026.

Gravatar: the avatar system nobody opted into

Gravatar ships with WordPress core and is on by default. Whenever your site displays a comment, WordPress hashes the commenter's email address with MD5 and sends a request to gravatar.com to fetch their avatar. Two things happen in that request: the visitor's IP address reaches Automattic's US servers, and the email hash itself becomes visible in your page's HTML source, whether or not that person has ever used Gravatar. MD5 is not a strong hash, and a leaked or scraped hash can be reversed against a list of known email addresses.

Disabling it is one settings change: Settings, Discussion, turn off Show Avatars. Switching the default avatar to "Mystery Person" doesn't fix this, that setting only changes the fallback image shown when no Gravatar match exists, and generating even that fallback still requests gravatar.com. Show Avatars is the only toggle that actually stops the request. If you want real avatars without the phone-home, a plugin like Avatar Privacy caches images locally instead.

reCAPTCHA: the compliance burden just moved to you

This is the one most WordPress guides haven't caught up on yet. As of April 2, 2026, Google switched reCAPTCHA's legal role from data controller to data processor, confirmed in Google's own announcement to reCAPTCHA customers. Before that date, Google decided how the data reCAPTCHA collects could be used. Now, the site owner is the controller, meaning you determine the purpose and means of processing, and you carry the GDPR liability for a tool whose actual technical behaviour hasn't changed at all. reCAPTCHA still analyses browser and interaction signals, including mouse movement and timing, and sends that to Google to score whether traffic looks human. The only thing that changed is who's accountable for it when a regulator asks.

hCaptcha, Cloudflare Turnstile, and Friendly Captcha all do the same job without routing visitor behaviour through Google's infrastructure. Turnstile is the easiest drop-in if you're already on Cloudflare. Friendly Captcha and CAPTCHA.eu are the two options built specifically around EU data residency, worth it if your procurement or compliance process requires it.

Google Analytics: legal today, resting on a framework under challenge

Google Analytics has the longest legal history of the four. Austria, France, and Italy's data protection authorities all ruled specific implementations of it unlawful in 2021 and 2022, on the basis that visitor data reaching US servers had no valid transfer mechanism. The EU-US Data Privacy Framework, adopted in 2023, gave Google a mechanism again, and GA4 can be used lawfully under it where consent, configuration, and the transfer mechanism are all handled correctly. That framework is not settled law: the EU General Court upheld it in September 2025, but that ruling was appealed at the end of October and now sits before the Court of Justice itself, the senior court in the system. Nothing about GA4 is broken right now, but the ground it stands on has moved before and is actively being tested again. Jurisdiction matters here too, which we cover in the Hosting Jurisdiction Index.

Matomo (self-hosted), Plausible, and Fathom are the three most common replacements. All three cut the consent and data-transfer burden substantially by skipping the cross-site tracking that triggers most of it, though whether a consent banner is required at all still depends on your configuration and which country's ePrivacy rules apply. It's a smaller, more defensible question than the one Google Analytics puts you in.

The smaller ones worth knowing about

Google Maps embeds load a script that can set cookies and track visitors before any consent is given, same problem as the others, smaller footprint. An iframe pointing to OpenStreetMap avoids Google specifically, though the tiles still load from a third-party server, so it's a smaller exposure rather than zero exposure. And every WordPress install pings wordpress.org periodically to check for updates, which is far lower stakes than the rest of this list but worth knowing about if you're auditing outbound connections.

WordPress without Google checklist

• Host fonts locally instead of loading them from Google's CDN
• Turn off Show Avatars, or switch to a plugin that caches them locally
• Replace reCAPTCHA with Turnstile, hCaptcha, or Friendly Captcha
• Replace Google Analytics with Matomo, Plausible, or Fathom
• Audit embedded maps and videos for third-party requests
• Open your browser's network panel and check what's actually calling out to Google

None of this requires leaving WordPress

Every fix above is a plugin swap or a settings change, not a platform migration. The same principle runs through our guide to what anonymous hosting actually means: defaults leak, and most fixes are smaller than people expect. What it changes is where your visitors' data actually goes, and who's liable if a regulator or a claimant asks questions about it.

The same logic applies one level up, at the hosting layer. Where your WordPress site is hosted determines which jurisdiction's law governs it and who can be compelled to hand over data about it. Packetra's WordPress hosting runs in Finland and Switzerland, with no KYC at signup and Bitcoin or Monero accepted as payment.