I think this is important to consider. In practice, it's difficult to have any recourse with an American company. In Europe it's more expected and common that government and consumer orgs take an active role. Both legal culture and culture-culture (?) are just very different, leading people to preferring to steer clear of this expensive and adversarial (compared to EU climes) environment.
That's the exact scentiment the parent to my comment is suggesting; I'm saying that GDPR agencies probably aren't going to care at all about the type of data sent to a web host when all they're doing is serving fonts for 3p websites.
I think this is important to consider. In practice, it's difficult to have any recourse with an American company. In Europe it's more expected and common that government and consumer orgs take an active role. Both legal culture and culture-culture (?) are just very different, leading people to preferring to steer clear of this expensive and adversarial (compared to EU climes) environment.