But nothing requires you to link directly to the font on their CDN. The sources, the whole build pipeline, everything is available and you can host it all by yourself.

The font they created has nothing to do with tracking you, it just so happens that if hosted on Google Fonts they can also do that. But that's a feature of Google Fonts, not Noto.

Pure speculation, but I would guess the vast majority of people do NOT self-host. I use their CDN as it's faster and much easier to set up, just link in your CSS or whatever.

The SIL Open Font License restricts subsetting, so you do need to be careful when doing this (the license requires that you change the font name if you reduce the font's display quality). Google has gotten waivers to allow them to alter the fonts without changing their names.

The repository with the fonts and tools is here: https://github.com/google/fonts

Only fonts with “reserved name” clause have such restriction, and then you are only required to rename the modified font.

For it to be a valid point, it has to be a sensible strategy or position for Google to take. Do you actually think that under the list of goals and objectives for this project there was a bullet point that was like "* Better user tracking across the web". There are loads of reasons why it makes sense for Google to do this project ahead of user tracking. It's possible - anything is possible really - but does it make sense?

Even if this was remotely close to their goal, it still doesn't make sense. They already have Google Analytics on basically every website in existence. Investing millions of dollars in an extremely robust font to increase web tracking by 0.0000000001% seems like a terrible investment.

You're saying that Google, THE tracking company, is possibly sitting on this huge pipeline of data from IPs connecting to their CDN downloading fonts and they're just not doing anything with it? I would have a very hard time believing this.