Some context from https://termageddon.com/austrian-dpa-rules-that-google-analy...
Generally, GDPR prohibits the transfers of personal data from the European Union to a country that does not meet the same privacy protection standards as those provided by the European Union. Due to a lack of uniform privacy laws that provide significant privacy rights to individuals and the surveillance of United States intelligence agencies, the European Union has long held that the United States does not provide adequate privacy protections to individuals.
So it seems that if you are an individual located in the European Economic Area then the GDPR attempts to preserve your data privacy rights. A US website can't void those rights in exchange for some fonts.