How they "don't face consequences" if it is wrong?! Google (along with Facebook) are very much going to be the first in the line for auditing - and I believe the first complaints against them have been filled on the first day GDPR was in force already. The entire raison d'etre of GDPR is very much Google and Facebook, who were thumbing their noses at EU's privacy regulations so far.
If someone is going to have top-notch legal team on this it is going to be Google. So if Google's legal says that it is alright because they are the data processor/controller as defined by GDPR you can pretty much take them for the word there.
I wonder whether people spreading this sort of panicked disinformation about the fonts and what not have actually read the GDPR text. It is pretty clear about who is considered to be a "data processor" or "controller" - someone who merely uses a resource like fonts is certainly not one if you aren't collecting any information yourself or having someone else do it on your behalf. That Google may be doing it is irrelevant as long as they aren't providing the data to you (which would make you a "data controller").
And if you are neither a data controller nor data processor you aren't concerned by GDPR at all.
It is well explained here:
https://www.gdpreu.org/the-regulation/key-concepts/data-cont...
