Your website fonts could cost you $10,000

Full guide

Most business owners think of the font on their website as a styling choice, somewhere between a colour and a vibe. Legally, it is closer to a piece of software you have rented. Every commercial typeface is created by a foundry or designer who owns it and licenses it under specific terms, and those terms decide exactly where and how you are allowed to use it. Use a font outside its licence, such as embedding a desktop-only typeface on a live website, and you have technically infringed copyright. The bill for that mistake does not arrive as a friendly reminder. It usually arrives as a demand for back-licensing fees plus damages.

This is not a scare story about a rare edge case. Font licensing is one of the most overlooked compliance gaps on the modern web, precisely because fonts feel invisible and free. The good news is that getting it right is straightforward once you understand the rules. Below is what every Australian business needs to know to keep its typography legal and its budget intact.

Why is a font a legal liability at all?

A font is protected on two fronts. The visual design of the letters is a creative work, and the font file itself is software, complete with its own end-user licence agreement. When you buy or download a font, you are not buying the font, you are buying permission to use it in defined ways. Those ways are usually split into separate licences: desktop for design work on your computer, web for embedding on a website, app for software, and broadcast or logo licences for other uses. A licence that covers one does not automatically cover the others.

The trap is that a font installed on a designer's machine looks identical to one licensed for the web. Nothing stops you from dropping a desktop font into a website, and the site will render perfectly. The infringement is silent right up until a foundry, or one of the agencies that scan the web for unlicensed font use, notices it. By then you are negotiating from the back foot.

Does free for commercial use mean I am safe?

This is where most well-meaning businesses come unstuck. Font marketplaces are full of typefaces labelled free, or free for commercial use, and people reasonably assume that covers their website. Often it does not. Free for personal use excludes business entirely. Free for commercial use may permit a printed flyer but still exclude web embedding, mobile apps or use inside a logo. The word free describes the price, not the scope, and the scope is what gets you in trouble.

The only reliable move is to read the licence that ships with the font and look for explicit permission to embed it as a webfont. If the terms are vague, contradictory or missing, treat the font as off-limits until you can confirm otherwise. A few minutes of reading is far cheaper than a settlement.

What is the safest licence to rely on?

For most businesses, the simplest path to compliant typography is an openly licensed font. The SIL Open Font License is the most widely adopted open font licence in the world. It explicitly allows you to use, embed, modify and redistribute a font, including on commercial websites, at no cost, as long as you follow a few light conditions such as not selling the font on its own. The vast majority of fonts available through Google Fonts are released under it, which is exactly why they have become the default choice for compliant, budget-friendly web design.

If you do want a premium commercial typeface for brand reasons, that is completely fine. Just buy the correct web licence for your level of traffic, keep the receipt and licence terms on file, and renew when required. The cost of a proper web font licence is trivial next to the cost of getting caught without one.

The reason font compliance trips people up is that a single typeface can come with several different licence types, and each one covers a different use. The table below sums up the common ones, so you can see at a glance which permission your website actually needs.

If Google Fonts are free, where is the catch?

The catch with Google Fonts is not the licence, it is privacy. When you embed a font using Google's hosted link, every visitor's browser quietly contacts Google's servers to fetch the file, which can transmit their IP address overseas. In 2022 a regional court in Munich ordered a website operator to pay damages to a visitor for exactly this, ruling that loading Google Fonts remotely without consent unlawfully passed the visitor's IP address to a third party. The decision is reported widely, including by security and privacy news outlets, and it triggered a wave of complaints across Europe.

That ruling was made under European privacy law, but Australian businesses with overseas customers, or simply a duty of care toward visitor data, should not ignore the pattern. The fix is refreshingly simple. Download the open-licensed font files once and host them on your own server, so the browser fetches them from you, not from a third party. You keep every benefit of the free licence and remove the data-transfer problem completely.

How do I audit the fonts on my current website?

Start with an inventory. List every typeface your site loads, and remember that fonts hide in places you do not expect: theme defaults, page builders, plugins, embedded widgets, even old PDFs and banner graphics. For each font, trace it back to a source and a licence, then confirm that licence permits web use at your traffic level. Where you cannot find a valid web licence, you have three clean options: buy the correct licence, swap the font for an open-licensed lookalike, or remove it.

Keep a simple record of each font, its source, its licence type and its renewal date. This single document turns font compliance from a recurring worry into a box you have already ticked. If a demand letter ever does arrive, the difference between a stressful negotiation and a two-line reply is whether you can produce that paperwork on the spot.

What should I do this week?

Treat your typography the way you treat any other licensed asset on your site. Default to open-licensed fonts for new work, self-host them to protect visitor privacy, and only reach for a premium typeface when the brand genuinely calls for it, with the right web licence in hand. Then run a one-off audit of your existing site so you know exactly what you are using and why. Done once and recorded properly, font compliance quietly disappears as a risk, which is precisely where you want it to be.

Watch: the hidden cost of website fonts