

Browser fingerprinting is surprisingly accurate. Any other you site you visit which uses google analytics (which is like all of them) with the same fingerprint is then linked up, so voila the user is no longer anonymous. The categories that your site may be catering to are therefore added to the profile. Each page request on this site loads the font file again, adding to the perceived time on the site (that is, take last request time - first request time, now you have a pretty good estimate). The point is that while it’s not invasive and exact as running google’s js on your site, it does add to their user profile which Google sells to brokers and all that crap. My point being that they can gather a lot more info than one would think when only Google Fonts is used on a site.



Oh I’ve done exactly that. He (security chief) insists it’s required for SOC2 compliance, an assertion I’m leery of.