This isn't an advertisement, I had a very specific use-case, but it follows into this:
Of course, just like with Google, we are the product here. Google Fonts is an analytics data collection platform, Bunny Fonts is an advertisement for their CDN services.
I'm going to stick with a /fonts/ directory, I think, despite being one of their current users. It's really not very much bandwidth for the fonts, it's not 2010 anymore, and I prefer the control (and the local development environment being the same, I don't always have internet and I don't want a dev toggle for something as silly as fonts).
Their web-site is located in the UK[0]
Their fonts CDN is originating from AS60068 which is registered in UK too[1][2]
[0] https://bgp.he.net/dns/bunny.net#_ipinfo
Now since they are no longer in the EU they want to use this opportunity to deviate from the GDPR and relax the rules even more (not that they've been enforced to begin with). Ironically, the justification for relaxing the rules is that the GDPR didn't have the expected effects - well of course if won't have any effect if you don't enforce it.
$ whois bunny.net (...) Registrant Name: Registration Private Registrant Organization: Domains By Proxy, LLC Registrant Street: DomainsByProxy.com Registrant Street: 2155 E Warner Rd Registrant City: Tempe Registrant State/Province: Arizona Registrant Postal Code: 85284 Registrant Country: US (...)
> we're in a country with better privacy laws"
...it appears that the domain registrant is not, so you will just have to trust that the company is not in the US or not owned by a US entity (mostly relevant for the rest of the world, probably).
> with fonts there's a really simple solution: Just don't
This was worth repeating :)