A client sent us a font audit claiming that our website references paid fonts such as Arial, Verdana, and Segoe UI. These fonts only appear in CSS fallback stacks; we do not host or embed the font files. My understanding is that the browser uses them only when they are already installed and licensed on the visitor's operating system. Is that generally acceptable, or should we replace them with open-source alternatives such as Google Fonts?
3 Answers
If the fonts only appear as names in a CSS font-family stack, you are not distributing the font files. The browser checks whether the visitor already has one installed and uses it locally. That is very different from downloading or embedding a font with @font-face. You should still verify the details for the relevant jurisdiction and ask the auditor to identify the exact license clause they believe applies.
Font licenses can restrict embedding, redistribution, or other specific uses, so it is worth reviewing the license rather than making an absolute claim. However, merely naming a locally available system font in CSS normally does not send that font to the user. I would respond professionally and ask the audit company to explain exactly what is being distributed and which license provision they are relying on before changing the design.
The important distinction is whether your site ships the actual files. A fallback such as Arial, Segoe UI, or sans-serif generally relies on fonts already supplied with the user’s operating system. Check your build output for @font-face rules and font-file URLs; if none are present, the audit may simply be flagging font names without understanding how fallback stacks work. Using system-ui, -apple-system, sans-serif is also a convenient modern stack if you want to avoid the argument.
Related Questions
How to Build a Custom GPT Journalist That Posts Directly to WordPress
Cloudflare Origin SSL Certificate Setup Guide
How To Effectively Monetize A Site With Ads