I’m not sure this is the issue precisely. However there’s been rulings that ban using Google analytics simply because doing so means the user sends a request to Google, and the user IP address is considered personal data (look up Schrems II). The same applies to Google fonts or anything hosted by Google.

The interesting thing specifically about the fonts case is that, unlike other privacy regulation that defines only fines, and not compensation/damages (fines are levied by the data protection authorities). However in the font case there was a precedent that awarded damages to the claimant in the tune of 500€. Now we see a wave of ambulance chasing lawyers exploiting this ruling to shake up companies. Sad, but potentially useful for privacy. IANAL and all that jazz.

Here's Google's 1st hit for "Google Fonts privacy", you can find more: https://www.brycewray.com/posts/2020/08/google-fonts-privacy...