Sign up ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I am required to create the design of a website for my institution. I am not a designer or webmaster, and I am very badly informed in this area. I am already a bit stuck in the font selection.

The project budget does not allow the purchase of commercial font licences. A quick web search showed that a very convenient way to use free fonts would be to use the Google web font service. Another option would be self-hosting, but as far as I understand, it is 1) somewhat more challenging technically, and 2) more limited, as there are fonts which can be used for free through Google, but their licence does not cover that we redistribute them through hosting. (If this is not true, please correct me).

We are an European institution with high requirements for privacy. The web site in question has an area with sensitive data (R&D know-how not yet protected by patents) and we may extend it to also save some personal data of users in the future. So we are very wary of embedding external services.

What are the privacy risks connected to the use of the Google web font API? How much access will Google have to our data if we use their font service? Is it feasible to use their fonts if we wish to keep part of our website secured against unauthorized access? Or am I limited to self-hosting open source fonts?

share|improve this question
just a note that this service has been blocked in places such as china. have you just checked the licence types and use the css version – Liam Sorsby Apr 9 '14 at 15:32
Another factor to consider is accessibility. Most institutions I know are big on accessibility... custom fonts are generally not as good or tested as the standard fonts for impaired users. – Simon Hayter Apr 9 '14 at 17:00

2 Answers 2

Yes, there are privacy concerns with using Google Web Fonts. If you have strict privacy concerns you should probably not use the service. Users of Google Web Fonts are bound by Google's generic API terms of service, which includes this clause:

By using our APIs, you agree that Google can use submitted information in accordance with our privacy policies, such as

Google's privacy policy allows it to collect a large amount of data about users of its services, both to improve the service and to support it commercially. This includes log data (e.g. browser version) and location data (the IP address of your site's visitors). Sites that use Google Web Fonts are feeding data back to Google. It's possible that Google doesn't actively collect and use that data right now, but it is worth considering alternatives if you are privacy-conscious.

Font Squirrel is a great source of free fonts that can be used commercially. Several of the fonts hosted by Google, such as Open Sans, are available to download from Font Squirrel and host yourself at no charge, and it's not nearly as tricky as you might think. Their downloadable “webfont kits” include a “how to use webfonts” HTML file that talks you through it, but there are other guides to using web fonts available online.

FontSpring How To Install Web Fonts

share|improve this answer
Although I prefer not using any Google service, I don't see any problem with the fonts, the information they can track is the contents of the request headers, which is not much. Requesting fonts don't generate a cookie and when having a Google cookie on the browser session (due to direct login), didn't appear to be any communication between parts. Of course we can argue that any bit of information sent to a server is traceable and that adds up to a big database, but could you explain what is the concern in this case? If there is any, I'd like to add it to my list of I don't like google – PatomaS Apr 10 '14 at 0:11
FontFeed touches on the privacy implications of using Google Web Fonts. It's hard to know what Google do with the data they collect, but there is potential to identify visitors of sites that use Web Fonts via the user's browser fingerprint cross-referenced with other Google services they use such as Gmail and YouTube. That may pose no problem to many webmasters, but if you don't want to leak data about your users to third parties, it's best not to link to third-party libraries. This includes omitting "Like" and "Tweet" buttons. – Nick Apr 10 '14 at 7:11
Thanks for your answer. After reading that article, which states the same I mentioned before, I don't see any problem. They can only track/use the headers sent, not even a cookie. I don't like Google, nor Facebook, nor twiter, etc etc, but things have to be fair. There is no security risk on using their fonts. Still is a better idea to use fonts found on most devices naturally. But I think this subject may be better suited for the chat than the comments section. – PatomaS Apr 10 '14 at 8:02
Sure, we can use chat for this. The question wasn't about security risks – it was about privacy risks. I agree that Google Web Fonts present little security risk. – Nick Apr 10 '14 at 9:02
uuups sorry, I meant privacy instead of security, sorry. – PatomaS Apr 10 '14 at 9:27

Regarding the fonts as an aesthetic element as well as the main element for readability, you may consider using the Core fonts for the Web, which basically is a set of very common fonts that you can find on almost any device, and if those fonts are not present, there are many possible alternatives available on each device.

I'd recommend using those font so you avoid any other problem, but if you decide that those fonts are not what you want, you still may use them as a base for developing the site and later on you change them.

If you don't have specific requirements, or your aesthetic requirements are just for headings and small fragments of text, use that set with CSS and any special text as an Image.

If you decide to use some of the Google fonts, there is no security problem on using them regarding private sections of your website. That private part should be protected by some combination of user and password to avoid unauthorized access. There may be some concerns about cookies set by those fonts and the relation of navigation patterns that may be collected (which is not your private information), but I'm not sure if the request for the fonts generate a cookie.

Considering what you mention about your experience, the kind of organization and possible concerns of senior members on your organization plus the advantage of avoiding the download of extra resources, I would use the common set of fonts mentioned above.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.