Now You Can Block Web Fonts You Probably Didn’t Know Are Tracking You

It seems that the very structure of the modern internet is a privacy-violating black hole, but you can do something about it. 

Take a look at a website. Chances are, it uses third-party web fonts to show its text. These fonts are loaded in from somewhere like Google and offer the website designer many more options to make their pages look fancy. But they can also be used to track you across the internet. Fortunately, serial privacy champion and software developer Jeff Johnson has made StopTheFonts, a browser extension that protects you if you're using Safari. 

"There are only two main ways to show a visitor text on a website. The text is either displayed using a font already installed on the visitor's device, or so-called custom web fonts, which are not installed on the visitor's device, are used," Marat Minulin, a senior software engineer at ABBYY, told Lifewire via email. "The second option significantly simplifies any tasks related to displaying text on website pages for web designers. However, custom web fonts have a significant drawback—confidentiality, or rather, the security of the user's personal data."

Web Fonts: The Problem Is in the Delivery

A web font might seem innocuous, and the font itself is totally benign. The problem is the delivery, which can be tracked. 

"Font snooping is similar to tracking pixels, which have been used for decades in emails to track users," Sean O'Brien, a lecturer at Yale Law School Privacy Lab, told Lifewire via email. "The fonts hosted by Google, which are the most popular third-party web fonts on the Internet, are particularly problematic because Google is a major advertising surveillance company."

If your browser calls out to load a font from Google, then Google instantly knows all kinds of information about your computer. We asked StopTheFonts developer Jeff Johnson just how bad the risk is. 

"The primary reason web fonts are so bad for privacy is that websites are loading third-party fonts, for example, from Google. This allows Google to profile and track you across the internet without even visiting a Google site," Johnson told Lifewire via direct message. "When a website loads a Google font, Google gets your IP address, as well as the HTTP Referrer header that tells Google which website the font is loaded from. In other words, Google now knows your web browsing history!" 

Fight Back Against Web Fonts

It might seem like a losing battle, but thanks to tools like StopTheFont, and many other browser extensions, users can take back some control. 

"I think that people do care about privacy violations, but it's very difficult for individuals to fight back. (1) Privacy violations are technically complex, and thus you need to be technically sophisticated to understand them. (2) You need technical tools to fight back, tools that may not exist or may be unknown to most people. (3) Websites that violate your privacy sometimes break, either accidentally or deliberately, if you try to fight back since their business depends on it," says Johnson.

The downside is that your computer will fall back on its installed fonts to display web pages, which means that some websites will look odd, and most will look different. On the other hand, sites may load faster on slow mobile connections and use less data.

StopTheFonts lets you add individual websites to an allow-list or only block third-party web fonts, which avoids cross-site tracking problems while still allowing fancy typefaces to load. 

But in the end, it's like everything privacy-related on the internet: The default is to strip-mine users for as much private data as possible, and if you decide you don't like it, you'll end up sacrificing some conveniences and features. The good news is that tools like StopTheFonts, or Johnson's other browser extensions like the amazing StopTheMadness mean that we don't have to fight alone. 

"Research has consistently shown that people desperately want privacy but just don't think they have any power to hold onto it. It's easy to throw up your hands and give up your privacy when you feel powerless. Thankfully, tools that allow people to reclaim their privacy are becoming easier to install and use. And, as more developers bake privacy into software, privacy is becoming the default," says O'Brien.