The GDPR also has the concept of data minimization, which I believe would apply in the case where you're unnecessarily sharing IP addresses with a third-party (

The GDPR also has the concept of data minimization, which I believe would apply in the case where you're unnecessarily sharing IP addresses with a third-party (regardless of whether they ultimately log them) for something that can trivially be done in-house. There's zero benefit to using a CDN for fonts - browsers have long ago started partitioning caches per origin anyway, so you don't even get a performance benefit. Just put the fonts where you put the rest of your static files and you're good to go.