A Guide to Web Fonts and Licensing

Here is a sentence that surprises most business owners: the font on your website is software, and you are bound by its license the same way you're bound by the license on your accounting software. Fonts feel like decoration — you picked one that looked nice, your designer installed it, everyone moved on. But font foundries are businesses, some of them employ people whose job is finding unlicensed usage, and "my designer handled it" has never once made an invoice disappear.

The good news: font licensing isn't actually complicated once someone explains the categories in plain language. This guide covers the license types you'll encounter, the traps that generate the awkward emails, and the practical decisions — including where your fonts should be hosted, which turns out to matter for both privacy law and page speed.

Fonts are licensed by how you use them, not just that you use them

The single most important concept: buying a font once doesn't buy it for everything. Foundries sell separate licenses per use case, and the one your designer bought is very often not the one your website needs.

The classic failure mode goes like this: a designer builds your brand with a font from their own desktop license (legitimately — their license covers creating artwork for clients). Then someone takes the font file off the design handoff folder and uploads it to the website. That's now web embedding under a desktop license, which is the font-world equivalent of buying one cinema ticket and holding the door open for the office.

The questions to ask, in writing

When commissioning a site or a rebrand, ask your designer or agency three things and keep the answers in the project folder:

1. Which fonts does this design use, exactly (family names and weights)?
2. What license covers web use, and who holds it — us or you?
3. If it's licensed by pageviews, what's the cap and what happens if we exceed it?

If the answer to question two is a shrug, that's your cue to sort it out now, while it costs a license fee instead of a settlement.

The free options are genuinely good now

Twenty years ago, free fonts looked free. Today, open-licensed typefaces are legitimately excellent, and for most small businesses they're the right default. The main license you'll meet is the SIL Open Font License (OFL), which in practical terms means: use it commercially, on the web, in print, in your logo, forever, at no cost. You can't sell the font itself, which you weren't going to do anyway.

Google Fonts is the best-known catalog of OFL and similarly licensed typefaces — well over a thousand families, all free for commercial use. Quality varies, but the top of the catalog (the fonts you've seen everywhere, and a deep bench of less common but well-made families) is professionally competitive.

The honest trade-offs of free fonts:

• Ubiquity. The most popular open fonts are on millions of sites. If distinctive typography is part of your brand strategy — a design studio, a premium product — a commercial typeface may be worth its fee purely for differentiation.
• Range within a family. Commercial families often ship more weights, optical sizes, and true italics. Open families have improved a lot here, but check that the weights your design needs actually exist before committing.

A sensible rule of thumb: if typography is load-bearing for your brand, budget for a commercial web license like you'd budget for photography. If it's not, pick a well-made open font and spend the money elsewhere.

Where your fonts are hosted matters — legally

Here's the part that catches even careful site owners: it's not just which font you use, but where the files are served from.

Many sites load Google Fonts "the easy way" — a link tag that pulls the font files from Google's servers. That transmits each visitor's IP address to Google, which raises GDPR questions for European audiences. The technical fix is simple: self-host the fonts — download the files, serve them from your own domain, and no visitor data goes anywhere.

If your business serves EU visitors (which, on the internet, means effectively everyone), self-hosting open fonts is the safe default. It's a one-time change: download the font files (Google Fonts allows this directly, and helper tools package them for web use), upload them to your site, and swap the external link for a local @font-face rule. Any competent developer does this in under an hour; many WordPress themes and plugins now do it with a checkbox.

Self-hosting is also usually faster

The old argument for loading fonts from a shared CDN was cache reuse — the theory that visitors already had the font cached from other sites. Modern browsers ended that: for privacy reasons, caches are now partitioned per site, so there is no cross-site cache benefit. What remains is the cost: an extra DNS lookup and connection to a third-party server before your text can render properly.

Serving fonts from your own domain removes that round trip. Combined with two small technical settings, it makes fonts a non-issue for performance:

• Use WOFF2 files only. It's the modern compressed format, supported by every browser you care about. You don't need the four-format soup of old tutorials.
• Set font-display: swap (or ask your developer to). This tells browsers to show text immediately in a fallback font and swap in your web font when it loads, instead of showing invisible text. Readable-instantly beats pretty-in-two-seconds.
• Load only the weights you use. Every weight is a separate file. A typical site needs three or four (regular, bold, maybe a medium and an italic). If your site loads eight font files, roughly half are decoration for the network tab.

Logos, PDFs, and the other places fonts hide

Websites are the most visible font usage, but license exposure hides in quieter places:

• Your logo. Good news: a logo is typically artwork, not embedded font software. If your designer had a valid desktop license when they created it, the resulting logo files are yours to use anywhere. You don't need an ongoing font license just to display your own logo.
• Downloadable PDFs. Brochures and guides with embedded fonts may fall under ePub or document-embedding terms. For occasional documents this is rarely enforced territory, but if downloadable documents are a core product (templates, reports you sell), check the license.
• Email templates. Mostly a non-issue — email clients largely ignore web fonts and fall back to system fonts anyway. Design your emails to look right in the fallback.
• Canva-style tools and social templates. Fonts inside these platforms are licensed by the platform for use in the platform. That's fine — just don't extract them for use elsewhere.

A 30-minute font audit for your site

You can establish where you stand in half an hour, no technical skill required:

1. Identify what's loading. Open your site, right-click, "Inspect," then the Network tab, filter by "Font," and reload. You'll see every font file and — crucially — the domain it loads from.
2. Name the fonts. Match the files to family names (they're usually in the filename), or use a font-identification browser extension.
3. Sort into three buckets. Open-licensed (Google Fonts catalog and similar) — fine, consider self-hosting. Commercial with a license you can produce — fine, note the pageview cap. Commercial with no license on file — fix this week.
4. Check the serving domain. If fonts load from fonts.gstatic.com or another third party and you have EU visitors, put self-hosting on the to-do list.
5. Count the files. More than five font files is a hint that someone loaded whole families "just in case." Trimming them is the cheapest speed win available.

What to do when you find a problem

If your audit turns up an unlicensed commercial font, the play is straightforward and undramatic: either buy the appropriate web license (foundry sites sell them directly; prices for small-traffic tiers are usually modest) or swap to an open alternative. Nearly every popular commercial typeface has a well-regarded open substitute close enough that only your designer will notice. Swap, adjust spacing slightly, done.

What you shouldn't do is nothing. Foundries increasingly use automated crawlers that fingerprint font files across the web, so "nobody will check" is a weaker bet every year. And if a demand letter does arrive, having a documented audit and a prompt fix is the difference between a purchase and a negotiation.

The short version

Fonts are licensed software; the license that covers designing your brand doesn't automatically cover your website. Free, open-licensed fonts are genuinely good and legally safe — use them unless typography is central to your brand, in which case buy a proper web license and file the receipt. Serve font files from your own domain: it sidesteps GDPR trouble and loads faster anyway. Trim the weights, set text to swap in, and check the whole thing once a year, right after you renew the domain.

None of this is glamorous. But typography is one of the few places where a legal problem, a privacy problem, and a performance problem all share a single fix that takes an afternoon. Take the afternoon.

Photo: Bibek ghosh on Pexels