Nothing says you can't link to those resources, but if the page automatically loads them (hotlinked images, scripts, remote fonts, etc.) then there's an issue.
Is it really that unreasonable that loading a page to x.com should only load resources from x.com and 3rd-party resources compatible with X's privacy policy?
> Nothing says you can't link to those resources, but if the page automatically loads them (hotlinked images, scripts, remote fonts, etc.) then there's an issue.
Seems like a contradiction, and exactly my point. Trying to collect privacy policies and compliance statements from any place you might load an <img> or <script> from is extraordinarily burdensome and pointless besides. Totally absurd over-reach IMO.
And what about the 25 hops in between you and them which also collect your IP and the domain being contacted?
But what’s special about fonts? If I can’t reference an asset outside my own domain because the network request could allow the 3rd party to log an IP address, How is that not antithetical to the foundation of the WWW?
Besides the fact that this goes against the last decade of advice on how to speed up your site...