Why We Are Switching Away from Google Fonts

We are in the middle of removing Google Fonts from every site we run. Our own site made the move already; client sites will follow as each one comes up for regular work. Like our switch from Google Analytics to Plausible, the reasons are privacy, simpler compliance, and a growing conviction that the conveniences that once justified Google's free infrastructure no longer exist. Unlike the analytics migration, this one took almost no work at all.

The One-Word Diff

Here is the entire migration for www.lightningjar.com. Our styling runs on UnoCSS, and its web-fonts preset takes a provider option:

presetWebFonts({
	provider: "bunny",
	fonts: {
		display: "Bungee Shade",
		sans: {
			name: "Atkinson Hyperlegible",
			weights: ["400", "700"],
		},
	},
}),

The value used to say "google". Now it says "bunny". One word, plus a Content Security Policy header that now allowlists fonts.bunny.net instead of two Google domains. The fonts themselves are identical files: nearly everything on Google Fonts is published under the SIL Open Font License, and Bunny Fonts mirrors the same library behind an endpoint designed to be fully compatible with the Google Fonts CSS API. Same typefaces, same CSS, same rendering, different steward. For sites that load fonts with a plain <link> tag instead of a build tool, the migration is the same idea: change one hostname.

If the switch is that cheap, the question inverts. The burden of proof is not on leaving Google Fonts. It is on staying.

What Every Page Load Actually Sends

When a site embeds Google Fonts, every visitor's browser connects to Google's servers and, in the course of that ordinary HTTP request, hands over an IP address, a user agent, and the page being visited. That is how HTTP works; nothing sneaky is required. But multiply it across the enormous share of the web that embeds those two Google hostnames and it amounts to a quiet census of browsing activity flowing to one company, from sites whose visitors never chose it and mostly do not know it is happening.

Google states that the Fonts service does not use this data for profiling or advertising. The point is not to accuse; the point is that your visitors' data should not depend on a vendor's promises when the alternative requires changing one word. We made this argument about analytics already, and it holds with more force here, because with fonts there was never any product benefit in exchange.

The Court Case That Named the Problem

In January 2022, a German court (the Munich Regional Court) ruled that embedding Google Fonts violates the GDPR: transmitting a visitor's IP address to Google without consent is a transfer of personal data the visitor never agreed to. The damages were symbolic (100 euros) but the injunction was not, and the ruling set off a wave of cease-and-desist letters to German and Austrian site operators over exactly this embed.

You can quibble with the case, and plenty of lawyers did. What you cannot quibble with is the underlying fact pattern: an IP address is personal data under European law, and a fonts CDN sees every visitor's. For our clients who operate in or serve the EU, "the fonts on your marketing site" should never be the sentence that appears in a compliance letter. Removing the exposure costs a hostname.

The Performance Excuse Died in 2020

For years the standard defense of Google Fonts was caching: so many sites use it that your visitor probably already has the font cached, so the embed is nearly free. That was once true. It is not anymore.

In October 2020, Chrome 86 shipped HTTP cache partitioning, which keys every cached resource by the site that loaded it, to close a class of cross-site leak attacks. Safari had partitioned its cache years earlier, and Firefox followed. The consequence for font CDNs is total: a font your visitor cached on someone else's site is invisible to yours. Every site pays for its own cold download, from every visitor, every cache lifetime.

So the modern accounting looks like this. Benefit of the shared Google Fonts CDN: none; the sharing no longer exists. Cost: an extra DNS lookup and TLS connection to a third-party domain on the critical rendering path, plus everything described above. The performance argument did not weaken. It inverted, as others noted at the time.

What Bunny Actually Is

"Some free font service" would be a bad trade for Google's infrastructure, so it is worth being concrete about who is on the other end of the new hostname. Bunny Fonts is run by BunnyWay d.o.o., a content-delivery company founded in 2015 and headquartered in Ljubljana, Slovenia, best known for the bunny.net CDN. The fonts are served from that production CDN network: well over a hundred points of presence across six continents with Anycast routing, the same edge infrastructure the company's paying customers run their sites and video on. Font delivery performance is a structural property of the network, not a promise on a landing page.

The business model matters as much as the network. bunny.net makes its money selling content delivery; the fonts service is a free showcase for that product. There is no advertising business to feed and no data-monetization arm to cross-subsidize a free tool, which is precisely the ambiguity that makes "free, from an ad company" worth squinting at. The incentives point the same direction the promises do.

The Privacy Commitments, Specifically

Bunny Fonts states its policy in unusually plain language: a "zero-tracking and no-logging policy," in which "no data or logs are ever collected or passed to a third party," such that, in their words, "we cannot track or monitor your end-users in any way or form." Note the shape of that claim. Google's assurance is that collected data is not used for profiling. Bunny's is that there is nothing collected to use. One is a policy about behavior; the other is an architecture that removes the question.

The commitments extend past the fonts service to the platform underneath it. bunny.net publishes a privacy and data policy built around anonymizing anything that could directly or indirectly identify a user, signs Article 28 data processing agreements for customers who need them, and offers routing controls that can pin traffic to EU-only points of presence for data-residency requirements. And jurisdiction does quiet work here: an EU company answers to the GDPR as its home regime, enforced by its own regulators, not as a foreign inconvenience to be interpreted at arm's length. For our EU-facing clients, that difference is the whole ballgame.

Why Bunny, and Not Just Self-Hosting

The strictest answer is to serve fonts from your own domain, and the open licensing makes that legal and straightforward. It is a fine choice, and some of our projects will land there.

We chose Bunny Fonts as the default for a practical reason: it preserves the exact workflow every team already has. Same API, same font library, same one-line integration in tools like UnoCSS. Self-hosting is more private still, but it puts font subsetting, caching headers, and license bookkeeping back on every project's plate. The one-word swap gets every site out of Google's telemetry today; perfection can arrive on its own schedule.

The honest caveats, as always: Bunny is still a third party, and "zero logging" is a promise like any other. The difference is that nothing about Bunny's business depends on breaking it, and if it ever did, the next migration is also one word.

A Note on the Fonts Themselves

Delivery is only half of a font decision. Our body typeface is Atkinson Hyperlegible, developed by the Braille Institute to maximize character distinction for low-vision readers. It is a small choice that reflects the same principle as the delivery switch: the reader's interests come first, including the readers with the least margin. It is also, fittingly, an open-licensed font that no particular vendor owns.

Where This Leaves Us

Our site is done. As client projects come through for regular work, each one gets the same treatment: fonts move off Google's domains, onto Bunny or onto the project's own domain, and the CSP tightens by two hostnames. If you run a website, especially one with European visitors, this is one of the rare migrations with no trade-off to weigh: identical fonts, one less tracker-shaped dependency, one less compliance exposure, and a faster critical path, for the cost of a one-word diff.

Typefaces are typography. They were never supposed to be telemetry.