For both bunny.net and Google Fonts, using a CDN is useless with the advent of timing attacks related to the browser cache https://news.ycombinator.com/item?id=24894135. Storing fonts on the same domain avoids a DNS lookup and extra TCP connection.

I see this completely the opposite. There’s much more risk to Google to be lying about the privacy agreement applicable to Google Fonts (https://developers.google.com/fonts/faq#what_does_using_the_...) than there is to some unknown company that won’t be a target for regulators and won’t make any news for casually violating your privacy through shoddy engineering work or incompetence let alone maliciousness.

I perceive exactly zero risk to Google in lying about literally anything at all. Have you ever heard about them being even slightly inconvenienced in response to any abuse?

Uh, yes, many times.

https://www.reuters.com/article/us-alphabet-google-privacy-l...

Do you feel like providing any examples?

See https://news.ycombinator.com/item?id=31810185.

Status of that, two years on, appears to be complaints that Google is violating its discovery obligations.

Lack of examples,you mean?

I read that pretty carefully, and didn't see anything about not saving and correlating the visit with other logs they have.

The GDPR went into effect in 2018 and gave companies 4 years to prepare for it. The GDPR has strict guidelines as to how data processing consent flows should be presented, including the fact that it should be as easy to decline as it is to accept.

Yet, Google initially implemented a malicious consent form where accepting is easy and declining is impossible. They only very recently implemented a compliant consent flow which gives you an easy option to decline.

Google has already proven their bad faith and successfully got away with it, along with plenty of other companies.