The thing is that if you have resources on google.com, they may be allowed to set a cookie. And large companies like Google can far more effectively aggregate the data because of their reach.

But true, I doubt Google is more nefarious than other resource provider. I am 99.9% sure that Google is not abusing cookies to extract end user data through their fonts service.

I believe you might be legally obliged to inform the user about them setting a cookie though. Alternatively, and this might be the better solution is to simply "vendor" the fonts (supplying them from your own server).