The issue with google fonts is the CDN tracking I believe, not the license or the font itself.
If you need a google (or other) fonts, do self hosting. Simplest way is to build them into your site as a dependency... npm @fontsource for individual fonts is great for this [0] This is also better in terms of HTTPS overhead, and the process of self hosting is good for font file weight awareness due to the affect on your build size, especially when using lots of styles.
Same principle for any other CDNs you use, they all have the potential to track. The risk benefit of CDNs is being reversed, public CDNs disadvantages are: increased HTTPS overhead, increases points of failure, increased risk of users getting arbitrarily blocked by CDN provider IP blacklists, increased risk of tracking. Benefits: small developer convenience, potential advantage of caching (unlikely these days, and unlikely to outweigh the cost of HTTPS overhead especially in terms of total latency).
Indeed, the issue with Google Fonts (and Google Analytics) is how they track users. You need explicit consent for your visitors.
In reality, I'd suggest you avoid both services and go for simpler choices. E.g.: fontsource.org for fonts, and maybe something like plausible if you really need analytics.
If you need a google (or other) fonts, do self hosting. Simplest way is to build them into your site as a dependency... npm @fontsource for individual fonts is great for this [0] This is also better in terms of HTTPS overhead, and the process of self hosting is good for font file weight awareness due to the affect on your build size, especially when using lots of styles.
Same principle for any other CDNs you use, they all have the potential to track. The risk benefit of CDNs is being reversed, public CDNs disadvantages are: increased HTTPS overhead, increases points of failure, increased risk of users getting arbitrarily blocked by CDN provider IP blacklists, increased risk of tracking. Benefits: small developer convenience, potential advantage of caching (unlikely these days, and unlikely to outweigh the cost of HTTPS overhead especially in terms of total latency).
[0] https://github.com/fontsource/fontsource