I'm even more outside the loop, what happens if on my personal blog I don't have any analytics and don't do any metering so I have no idea how many visitors I get?

The way these kinds of fonts work is that you don't host the font, they do. You link the font licence you purchased through your HTML code (or CSS, depending on how the foundry recommends you to apply the font) with a specific font URL that they provide you, which will contain unique identifiers. Then they can track how often the font gets loaded.

If your site really kicks off and you max out those visits per month (that they track on their end), they either start charging you the higher tier, cut off loading your font, or send you stern emails.

There is no expectation that you share your analytics with a type foundry.

That’s not true. I’ve bought fonts on Future Fonts and I received a download link to get the files. I think it’s fundamentally an honor system.

My bad, I assumed Future Fonts did something similar to other type foundries. Thanks for letting me know!

No, "honor system" is very frequently used and understood to refer to a system where there are explicit rules but where the rules are not enforced via active surveillance.

It sounds like you want to make a judgement call: "they're too small to enforce this license agreement," so you get to pretend it's an honor system and not a license agreement.

The context was whether there is automatic enforcement, not whether you need to abide by the license.

Who's going to verify whether or not you're violating the license?

God

Not to take away from your fantastic explanation but I should note that’s not universal. There are foundries that operate on an honor basis and let you self host the font too.

Noted, I thought Future Fonts did the same system as many other type foundries out there, evidently not. Thanks for letting me know.

> You link the font licence you purchased through your HTML code

Ugh, hard pass for me. It a nice font thought

What you describe is how Google Fonts handles this if you choose to use the fonts directly from Google's servers. This is a violation of GDPR. You can also download them and host them yourself, to comply with data protection laws.

https://cookie-script.com/blog/google-fonts-and-gdpr

This is a good thing to point people at when they claim that GDPR is simple to implement. This legal interpretation is totally reasonable but it’s probably not what most developers would expect.

The law itself is very clear and concise so it is straightforward to find that this is not only a reasonable interpretation but right there in the law.

I would not describe 88 pages as concise.

Regardless, my point is just that there are implications of the GDPR that a lot of engineers are probably not aware of. It makes sense that sending your traffic to Google for fonts violates GDPR. But as an engineer, this is just a CDN. I would not have considered this a violation of GDPR without seeing someone else point it out.