The services (here: web fonts) could be supplied another way, so exposing the user's IP to google is not strictly necessary, from a technical POV.
The user's IP is PII, and exposing it unnecessarily to third party is a GDPR violation.
The way this is phrased, the reasoning applies to basically every static resource loaded from a CDN or other third-party website.
What would a technical solution that respects privacy look like? The website making the call to Google in the background (minus user details) and forwarding the response onward? Why isn't it done that way, it feels like it's the more obvious solution if you're not trying to track users.
Early internet was very wary of 'hotlinking' because it costs money to serve things, people used to try to offload hosting costs to others. Now it seems people take that on willing with the expectation to make enough money to cover it.
Is it just scale, or is it the user info that makes these services viable?
Early Google used to use the argument that them making the web better was profitable, because more people using the web meant more money for them. Does that still apply? Would they still provide Google Fonts if they were legally bound to not use any user information they recieved?
In case of fonts: hosting it on your domain.
Not as relevant now, but in the past a big feature was serving the smallest font file to the user based on the browser version they had.
Nowadays, the ability to use a Unicode aware font without sending the whole thing to every user is another feature they offer.
Both feel like things that browser improvements could take care of themselves eventually though and in the meantime libraries running locally could handle.
(For similar services, licencing plays a part, as you may be paying for the font per view or something like that, but that Doesn't apply for Google Fonts)
I don't think there is a solution right now. Maybe browsers can stop sending these headers to well known CDN domains by default.
This is particularly true for anything that comes as a „module“, like GDPR cookie notices (that are very frequently included via a JS snippet loaded from a third party site).
Because an IP address needed to receive a download. This kind of decision means that any hot linking of static media assets is now in hot waters.
A sensible judge would say IP address is not PII but a prerequisite to use Internet in the first place. Like a license plate on car e.g. other broken analogue of tracking. Like a power socket. However the definition of PII in Europe is overly capturing (saying this as an European.)
Like with IPs, they wouldn't be able to identify unique individuals with 100% certainty (as both IPs and cars may be shared), but they'd get pretty close. Certainly when it can be combined with other data.
So yeah, to me it makes sense that IPs are personal data.
The problem here is that every service could be provided another way. It seems that the only actual hosting option that doesn't leak a user's IP to a thrird-party is first-party only over Tor. Do we demand that every website is built that way? It turns out that outsourcing actually has a lot of value.
So where do we draw the line? Google Fonts apparently needs to be reimplemented first-party. What about Google Cloud CDN? What about an ISP that sees the user's IP in the packets?