Your typeface is a legal document, a network request, and a privacy exposure
Sponsored content. This article was supplied by a third party and Business Money has been paid to publish it.
Every other design decision on a website is just a decision. You pick a color, and that’s the end of it. Nobody sends you an invoice for the blue.
Type is different. A typeface arrives with a contract attached, gets delivered over a network, and in at least one jurisdiction has produced a small industry of legal claims. It is the only element on the page that is simultaneously an aesthetic choice, a licensing obligation, and a performance cost.
Most teams treat it as the first thing and discover the other two later.
The license you probably don’t have
The single most common violation in this area is so ordinary that people do it without any sense of wrongdoing. A designer buys a desktop license because they need the font installed to work in Figma. The design gets approved. The developer implements it on the site. Nobody upgrades anything.
Desktop and web are separate licenses at essentially every commercial foundry. The files may look identical. The permission is not.
Then there’s the metering. Most web font licenses are sold in pageview tiers — up to 10,000 a month, up to 100,000, up to a million. Cross the boundary and you’re expected to upgrade. Monotype’s webfont terms work on prepaid pageviews valid for a year, meaning that when your pages have been viewed the licensed number of times, you buy the package again. This catches successful sites specifically. Your traffic grows, which is the entire point of the project, and your license quietly stops covering you at some moment nobody logs.
The third trap is the handoff. An agency builds a site under its own license, delivers it, and the client now operates a website whose typography is licensed to a company they no longer employ. The license has to cover the client’s use, not the designer’s. This one surfaces years later, usually during due diligence for something else entirely, which is a bad afternoon for everybody.
Also worth knowing before you commit: logo and trademark use is frequently a separate and more expensive license, modification rights usually are too, and foundries do crawl sites and compare @font-face declarations against their records.
The €100 that turned into a hundred thousand letters
On January 20, 2022, the Regional Court of Munich ruled in case 3 O 17493/20 that a website which loaded Google Fonts remotely had violated the GDPR. Loading the font from Google’s servers transmitted the visitor’s IP address without consent. The court awarded the plaintiff €100 in damages, issued an injunction, and attached penalties of up to €250,000 or six months for continued violation.
A hundred euros. For a font.
What happened next is the part worth studying. The ruling gave opportunists a court-validated theory, and it was trivially automatable: crawl the web, detect remotely loaded Google Fonts, send a templated demand for a few hundred euros — priced deliberately below the cost of consulting a lawyer. Tens of thousands of German site operators received these letters.
The courts did eventually push back. In a judgment of March 30, 2023, the Munich Regional Court dealt with a defendant who had sent over 100,000 such warning letters and concluded, sensibly, that someone who visits websites specifically in order to provoke a violation has not suffered anything. The court did not accept that this person had personally visited every site he had billed.
But note what that pushback actually addressed. It shut down the abusive monetization. It did not overturn the underlying finding that remotely loading fonts transmits personal data without consent.
The fix is embarrassingly simple and has been all along: download the font files and serve them from your own server. No request leaves for a third party, nothing is transmitted, the problem doesn’t exist. Every font in the Google Fonts library is licensed under the SIL Open Font License or Apache 2.0, both of which permit exactly this. The convenient default was never the required one.
Typography is where craft and engineering turn out to be the same thing
Here’s what makes type interesting rather than merely annoying. Every one of these problems has the same solution as the performance problem.
Font files are among the more common causes of slow rendering, because a font request can block text from painting at all, and loading is where most sites fail their Core Web Vitals assessment. Self-host the files, and you eliminate a DNS lookup and a connection to another origin. Cut from six weights to three, and you’ve removed hundreds of kilobytes from the critical path. Subset to the characters you actually use. Set font-display so text appears in a fallback rather than sitting invisible while the browser waits.
Every one of those moves also happens to fix the licensing exposure and the privacy exposure. Fewer weights means a smaller license. Self-hosting means no third-party request. It’s rare for the fast answer, the legal answer and the ethical answer to be the same answer, and here they are.
This is also where you can tell how a team actually works. Look at anything held up as award winning web design and check the type first, because typography is unforgiving in a way that layout isn’t. A slightly wrong grid reads as a choice. Wrong optical sizing, sloppy line length, a heading that shifts and reflows a beat after the page paints — those read as carelessness, and they read that way to people who can’t explain why. Teams working at that level tend to know the weight of every font file they ship, because a designer who has argued for six weights and been asked what each one costs starts making different arguments.
Ask a prospective partner which font files will be on the site, under whose license, and served from where. The answer tells you a lot, quickly.
What to check this week
Open your site’s network tab and see whether font files are coming from your own domain or someone else’s. That takes about fifteen seconds and settles the privacy question for anyone with European visitors.
Count your weights and compare that to what your pages actually use. Almost everyone ships weights that appear nowhere, usually because a style was tried during design and abandoned without anyone removing the file.
Find the license and read the pageview clause. If your traffic has grown since the site launched — and if it hasn’t, you have a different problem — check whether you’re still inside your tier.
If an agency built the site, confirm whose name is on the license and get it transferred. Do this while the relationship is good, because doing it after the relationship ends is a different and worse conversation.
And when the font really matters to the brand, consider that a commissioned typeface removes the entire category of problem. No seats, no tiers, no upgrade path, no license that ends when a contract does. That’s expensive, and for a company whose type is doing real identity work, it can be cheaper than the alternative measured across a decade.
The strange thing about all this is the asymmetry. Type is the design decision with the most legal and technical baggage attached, and it’s usually made in about four minutes by someone scrolling a specimen page.
When was the last time anyone at your company read a font license? And do you know who has a copy?