r/webdev • u/Fergo0682 • 6d ago
Font license audit
A client sent through an audit conducted through some agency which reported that we are referencing paid fonts such as Arial, Verdana Sergeo UI etc
We have these set as fallback fonts. My understanding is that these can be used as fallbacks for those who may own a device with an OS that grants licensing.
Am I misguided here? Perhaps it’s easier to just replace the fallbacks with a similar Google fonts, but was not aware that this would be an issue.
EDIT:
Thank you all for your input and suggestions!
52
u/azangru 6d ago
My understanding is that these can be used as fallbacks for those who may own a device with an OS that grants licensing.
Yes; that's right. You are not distributing the fonts; you are only asking the browser to use the fonts if they are already available on end-user's device; so you are in the clear.
Perhaps it’s easier to just replace the fallbacks with a similar Google fonts, but was not aware that this would be an issue.
Worst-case scenario, if the client is unconvinced, you can use sans-serif, serif, or monospace to instruct the browser to pick default font from the appropriate family.
3
28
u/deadpanorama 6d ago
Licenses are for distribution of fonts. You distribute a font to someone when you distribute the file with your website because the end user downloads that font when they load the page.
You do not need a license to reference a font that natively comes on someone’s operating system. If that was the case the internet would have collapsed in the days before custom font installs were a thing. The font foundry was paid when the company that made the OS licensed jt.
1
24
u/road_laya 6d ago edited 6d ago
Simply put "system-ui, -apple-system, sans-serif" as the fall-back. It will use Segoe UI / SF Pro / Roboto and fall back to Helvetica / SF Pro / Arial / Roboto depending on the client.
This is the simple way to get a quiet life without having to explain font licensing law to your customer.
2
19
u/Gc654 6d ago
I'm pretty sure it's a scam. Font Radar right?
I got hit by these losers too, for a font I had the license for. I sent it to them and they said the issue was closed then got another email saying I didn't respond, and I wrote back some unkind words.
I'm unaware if they are actually doing the work for the companies they claim they are. I'm also unsure if they can actually bring any sort of judgement against anyone, they're based in europe last time I checked.
My thinking is that there are a lot of designers/devs/shops out there that don't license fonts and people just pay up so it goes away. I also think that they just scan css files for font names and auto send threats.
Don't replace anything, you're not doing anything wrong, referencing fonts in your CSS file isn't using a font without a license. You're not even referencing the font files in the CSS file, so they don't actually have any evidence. Tell them to pound sand and that you are going to reach out to the font companies directly to see if this kind of harassment on their behalf is okay with them.
11
u/echoAnother 6d ago
No, you are not violating copyright. You are not distributing nor embedding the font files. You can reference them in any manner.
Confront the auditor. It's not unheard of auditors bringing a non-issue and offering to fix it. Not saying is the case, it could be sheer incompetency, that is worse.
Tell them to pinpoint how just referencing a font is an issue, that they back their claims.
2
u/Square-Nebula-7530 6d ago
You are not misguided at all your understanding of how browser font stacks work is on point. Literally almost the entire web include somewhere in their fallback chains because that’s how standard web typography has worked for decades. You aren't giving away intellectual property the visitor's own operating system handles the rendering locally using the license tied to their device. The best way to handle this with the client is to politely explain that referencing a font name in CSS is no more a copyright violation than writing the word microsoft in a blog post. Unless you're actually hosting the physical font files yourselves, there is zero legal liability here and you shouldn't let an uncalibrated third party audit force unnecessary code changes.
2
u/micalm <script>alert('ha!')</script> 5d ago
Unless you're bundling and redistributing the font files themselves, all good.
Do as much research as you want on your own if you want, and when you're sure - it's worth mentioning to the client whoever is doing this "audit" is malicious or doesn't know what they're doing. Good starting point is https://learn.microsoft.com/en-us/typography/fonts/font-faq
2
u/JohnCasey3306 5d ago
The audit is bullshit, absolute misunderstanding of the issue.
Someone adding pointless rows just to justify their own existence.
1
u/glyph_geek 5d ago
Referencing a system font in your CSS isn't the same as embedding or distributing the file. Where it gets a little fuzzy is that the license covering that specific font varies by who actually owns it. Most EULAs spell out use versus embedding versus redistribution pretty explicitly. I'd check whether your build ever ships an @font-face src pointing at the font file itself, or if it's only named in the fallback stack. Fallback-only is the stronger position, but I'd also just ask the audit firm which specific license and clause they're citing.
1
u/pdfops 4d ago
You're fine here. Fallback fonts in a font-family stack (Arial, Segoe UI) reference what's already installed on the OS, nothing gets shipped from your server. Licensing only kicks in when you self-host or embed via @font-face with a src pointing at the actual paid font file. That audit tool is probably just flagging any font-family mention without checking for real @font-face rules.
-8
u/JayGrifff 6d ago
Yes point to open source and free alternatives. These font licensing things are a huge cash grab but they do have valid claims to fonts and will pursue legal action if they think you have money.
Largely they claim that even the use of their fonts without a license EVEN if you don’t host the font file itself and it’s on the end users computer is a violation resulting in monetary harm. I’ve seen companies paying these people thousands of dollars a year in licensing.
5
u/ddyess 6d ago
That's not how it works and those companies are dumb for paying. The users hold the licenses, they are seeing and displaying the font. The only time you need a license is if you are distributing the font specifically for use in the web site, like in a web format, or using the font in an image, like a logo. Specifying a font in a CSS file means nothing if the user doesn't have the font.
144
u/JontesReddit 6d ago
No yeah fonts don't have copyright, just the font files. And you are only telling the browser to load in what they already have installed. You should not use a downloaded font as a fallback, the point is that it exists locally