The court explicitly noted that the IP was exfilled to the United States where adequate data protection measures do not exist and that Google in particular is w

The court explicitly noted that the IP was exfilled to the United States where adequate data protection measures do not exist and that Google in particular is well known for invasive data collection The court also noted that there was an alternative in the form of embedding the fonts directly into the website. I'm not a lawyer, but the reasoning doesn't sound like CDNs are a problem in General, but that one should be very careful before connecting to US servers (which was always one of the goals of the GDPR)