Font licensing for the web: OFL, desktop vs webfont licences and what you may embed

A desktop (or standard) licence lets you install the font on a stated number of computers and use it to produce artwork: documents, posters, images, PDFs for print. It is usually silent about, or explicitly excludes, serving the font file to a browser. A webfont licence covers exactly that: putting a WOFF2 on a server so that visitors' browsers download and render it.

There are usually further products beyond those two: an app licence for embedding in a mobile or desktop application, an ePub licence for books, a broadcast or game licence, and a logo or trademark licence for using the letterforms as a mark. Buying the desktop licence gives you none of them. Conversely, a webfont licence typically does not let you install the font locally to design with — which is why foundries bundle the two.

The OFL is the licence behind most of Google Fonts and a large share of independent releases. It permits use, study, modification and redistribution, commercially and without payment, and it does not care about pageviews, domains or company size. For a web project it effectively means: host it wherever you like, subset it, and ship it.

Three obligations come with it. First, the font itself — original or modified — may never be sold on its own; it may be bundled and sold as part of something larger, but not as the product. Second, every copy you redistribute must carry the copyright notice and the licence text, which is why an OFL.txt sits next to the file in a proper download. Third, if the font declares a Reserved Font Name, a modified version must not use that name: change Lato and you may not call the result Lato.

That third rule is the one that catches teams who subset a font with a tool that rewrites the family name, or who tweak the metrics and keep the name. Subsetting alone is a modification the OFL permits; keeping the reserved name on a modified file is not.

Commercial webfont licences are usually priced by monthly pageviews, sometimes as a one-off purchase of a tier and sometimes as a subscription. A tier is a cap: exceed it and you are expected to upgrade. Some foundries sell unlimited pageviews for a fixed multiple of the desktop price; some price by number of domains; a few still price per weight, so a family of six costs six times one.

Read the definitions rather than the headline number. Pageviews are usually counted per domain and often per month across all domains in the licence; staging and preview environments may or may not count; an intranet may be a separate product entirely. If your traffic is lumpy, a tier you exceed twice a year is still a breach on those two months.

The fonts on Google Fonts are OFL or Apache 2.0, so downloading them and serving them from your own domain is explicitly allowed. It is also usually the better technical choice: since browsers partitioned their HTTP caches by top-level site in 2020, a font loaded from a shared CDN is no longer reused across sites, so the cross-site caching argument for the hosted API has gone.

There is a privacy argument too. A German court decided in January 2022 (Landgericht München I, 3 O 17493/20) that embedding Google Fonts from Google's servers passed the visitor's IP address to a third country without consent and awarded damages against the site operator. Whatever one thinks of the reasoning, self-hosting removes the question: the request never leaves your domain.

Subsetting — stripping out the characters you do not need — is the single most effective thing you can do for font performance, and it is a modification of the file. Under the OFL it is permitted, subject to the Reserved Font Name rule. Under a commercial EULA it is often permitted for the sole purpose of web performance and forbidden for anything else; a minority of licences forbid modification outright, which effectively forbids subsetting too.

Related restrictions to look for: whether you may convert formats (TTF to WOFF2 is a conversion), whether you may serve the font from a CDN you do not control, and whether you must apply technical measures such as serving only WOFF2 or setting a referrer check. Some licences require the latter and treat an unprotected .ttf on a public path as a distribution of the font.

The OS/2 table carries a 16-bit field called fsType that encodes the vendor's embedding policy in a machine-readable way. Value 0 means installable embedding — no restriction. Bit 1 means restricted licence embedding: the font must not be embedded at all. Bit 2 means preview and print only, so a PDF may carry it but the text may not be edited. Bit 3 means editable embedding. Two further bits say no subsetting and bitmap embedding only.

Word, Acrobat and InDesign read these bits and will refuse to embed a font that forbids it, so fsType has practical force even though it is not itself a contract. It is also a decent sanity check on a file of unknown provenance: a commercial text face with fsType 0 and an OFL notice in name ID 13 is probably what it claims to be.

What fsType is not is the licence. The bits reflect what the vendor set when the font was compiled, sometimes years before the current agreement; they can be edited by anyone with a font editor; and a permissive setting is not permission. FontPeeker shows the decoded value next to the name-table strings precisely so you can compare the two and then go and read the agreement.