It would stop this sort of privacy attack, and it'd have the additional benefit of making the web look a lot nicer.
I know you're thinking "well I don't see any of that in my analytics so this seems unlikely". Consider then that your analytics needs to actually load before the visitor bounces for them to show up in the statistics.
thou it will be argued that it is a minority that is affected and it makes little economic sense to care.
But you get a sort of selection bias. Out of the people with money to buy the tech that can keep up with these sites and the network speeds to use these sites, out of those people, most people have modern tech and good metropolitan network access.
Google is not the only company that has no respect for privacy. Privacy protection needs to go further, and stop privacy invasion completely.
There is a reasonable balance to strike between privacy, design and usability though. That's why I said 2 or 3 fonts. Maybe 4 at a push. If a site is using more than that then either the developers aren't very good, or the designers aren't very good, or it's trying to attack the user's privacy. Whichever one it is, it should be stopped.
How do you do multiple colors in fonts?
That would be trivial to break over a few requests, I think
The fact is very few websites use more than three fonts at a time on any particular page, and most sites than do could rework their design so they don't (swapping icon fonts for an SVG font map, for example), or they could implement a canvas or WebGL alternative.
SVGs are vectors so they aren't larger at larger sizes, and they can be responsive so you don't always have to display the same image at every size.
It depends how the question is framed and presented. If the permission prompt is modal and the user believes that they will be prevented from accessing the application unless they click Yes, then they will always click Yes.
But if the website loads first and then they are asked for permission to load some additional feature, they are much less likely to reflexively click Yes rather than to press X to close the non-modal.
I read that as Management (PHB) wanted that but some how the implementing engineer got them to do it the respectful way.
Why can't we make a better web like this that respects your privacy?
Yes.
Security and privacy come at the expense of other things. It's not totally unreasonable to prioritize them though.
It would limit creativity, but not by very much.
We keep suggesting things like limiting use of fonts as a polyfill for not being able to create legislation or what not. How about not exposing the available fonts to the browser through JS? If the font is not available, it should silently regress through options listed in CSS or browser defaults. JS can request a font, and it can be used if available. If it's not available, JS shouldn't need to know about it.
Italic and Bold are also separate fonts (albeit in the same family).
Bold and italic were different fonts in the past, but variable fonts have solved loading separate fonts for different weights and italics. This change would require developers swap to use those in many cases, and to create variable versions of brand fonts if necessary. I don't see that as a problem. The benefit makes it worthwhile.
In essence, do what we do with JS code, but with fonts.
You'd lose the parallel request benefits of HTTP2 but nevermind.