A client sent me an audit claiming that our website references paid fonts such as Arial, Verdana, and Segoe UI. These fonts only appear in our CSS font-family fallback stacks; we do not host or embed the font files. My understanding is that the browser uses them only when they are already installed and licensed through the visitor's operating system. Is that correct, or should we replace these fallbacks with open-source fonts to avoid licensing concerns?
4 Answers
Fallback fonts are commonly written this way. You can use generic families such as system-ui, sans-serif, serif, or monospace, or a platform-aware stack like system-ui, -apple-system, sans-serif. That can reduce confusion, but replacing the stack is not necessarily required just because an audit detected a font name.
A font name in a CSS fallback stack is not the same as distributing the font file. If you are not bundling the files or using an @font-face rule that points to them, the visitor’s browser simply checks whether an installed system font is available. That is generally different from hosting or embedding a font, though the exact legal position can depend on the applicable license and jurisdiction.
The important distinction is whether the site ships the actual font files. A scanner that only finds names in font-family declarations may be flagging a much broader issue than the one the license covers.
Some audit services appear to scan CSS for recognizable font names and may produce warnings without verifying whether the files are actually being served. I would not make unnecessary changes based on the warning alone, but I also would not dismiss a formal claim without checking the relevant font licenses or getting advice from a qualified legal professional.
Font licensing usually becomes more relevant when you download, self-host, embed, redistribute, or use the font in things such as image assets. System fonts already installed on a user’s device are a different case. Still, it is worth checking the generated CSS and deployment package to make sure a build tool has not included font files behind the scenes.
I would first ask the auditor to identify the specific license, clause, and behavior they believe is problematic. If the build does not include @font-face sources or font files, they should explain why a plain fallback reference is being treated as distribution.