Well, they can track people across sites that use Google Fonts, so maybe having a larger set of characters and encouraging more use gives them a farther tracking reach.
For the lazy, a snippet indicating that no such tracking occurs:
What does using the Google Fonts API mean for the privacy of my users?
The Google Fonts API is designed to limit the collection, storage, and use of end-user data to what is needed to serve fonts efficiently.
Use of Google Fonts is unauthenticated. No cookies are sent by website visitors to the Google Fonts API. Requests to the Google Fonts API are made to resource-specific domains, such as fonts.googleapis.com or fonts.gstatic.com, so that your requests for fonts are separate from and do not contain any credentials you send to google.com while using other Google services that are authenticated, such as Gmail.
In order to serve fonts quickly and efficiently with the fewest requests, responses are cached by the browser to minimize round-trips to our servers.
Google also said that their new messaging app would be end-to-end encrypted by default, and then quickly changed their mind when business reasons prevailed. Business reasons will always prevail. But even beyond that:
>For the lazy, a snippet indicating that no such tracking occurs: Requests to the Google Fonts API are made to resource-specific domains, such as fonts.googleapis.com or fonts.gstatic.com, so that your requests for fonts are separate from and do not contain any credentials you send to google.com while using other Google services that are authenticated, such as Gmail.
That's not what the snippet says. It is a technical statement, not a privacy statement. It doesn't mean they can't track you, it means it's a tiny bit harder to track you. Nothing in there says "we don't cross-reference these data" or "these data aren't used for tracking purposes" or anything else. Just that your Google account information isn't sent to the font servers.
More relevantly, the Google Fonts privacy policy links to the general Google privacy policy, which doesn't have any special "if you're using Google Fonts we collect a whole lot less than this" subsection. They might be using the data. They might not be. They might not be using the data today but decide to start using it tomorrow.
But nothing requires you to link directly to the font on their CDN. The sources, the whole build pipeline, everything is available and you can host it all by yourself.
The font they created has nothing to do with tracking you, it just so happens that if hosted on Google Fonts they can also do that. But that's a feature of Google Fonts, not Noto.
Pure speculation, but I would guess the vast majority of people do NOT self-host. I use their CDN as it's faster and much easier to set up, just link in your CSS or whatever.
The SIL Open Font License restricts subsetting, so you do need to be careful when doing this (the license requires that you change the font name if you reduce the font's display quality). Google has gotten waivers to allow them to alter the fonts without changing their names.
For it to be a valid point, it has to be a sensible strategy or position for Google to take. Do you actually think that under the list of goals and objectives for this project there was a bullet point that was like "* Better user tracking across the web". There are loads of reasons why it makes sense for Google to do this project ahead of user tracking. It's possible - anything is possible really - but does it make sense?
Even if this was remotely close to their goal, it still doesn't make sense. They already have Google Analytics on basically every website in existence. Investing millions of dollars in an extremely robust font to increase web tracking by 0.0000000001% seems like a terrible investment.
You're saying that Google, THE tracking company, is possibly sitting on this huge pipeline of data from IPs connecting to their CDN downloading fonts and they're just not doing anything with it? I would have a very hard time believing this.
Let me elaborate. I offer two situations and you can choose which one of them is more plausible.
a) What should we do next? Our cash is burning! Well, lets use countless human hours to make a beautiful font to make the world a better place!
b) How can we reach to more traffic that might be currently not visible to us? Well, maybe we should design a really beautiful font that everyone likes and host it in our server? Sounds like a plan, lets do it!
c) We're making products supporting an unprecedented amount of locales and there's no font family out that that covers them all and still looks consistent, we're going to have to make it ourselves. Hey, if we open it up then there will be even more international content out there to put AdSense on!
