If you use their cdn instead of putting them on your own server sure. There is an Austrian ruling that this is a violation of the GDPR, so you might not wanna d

If you use their cdn instead of putting them on your own server sure. There is an Austrian ruling that this is a violation of the GDPR, so you might not wanna do it anyways. For the ultra paranoid font files are to be avoided because fonts raise the complexity and thus the attack surface — I can't imagine an attacker couldn't use a malicous font or a zero-day in the font rendering engine to exploit a client.