Open Chrome DevTools. Go to the Network tab. Filter by Font. If you do not recognize a font loading on your own site, and you do not have an invoice for it, you have a problem you cannot see and probably are not budgeting for.
This is not a design nitpick. It is a balance-sheet item that sits quietly until a foundry decides to collect.
A real case, and the math behind it
A pharma company. Six domains. One commercial font family with a base license price of $2,400. They ran it for four years. Without a license.
Adobe, Monotype, and other foundries run automated scans across the public web. They catch you, they invoice you, and it is not pretty. The numbers are not theoretical, so here is the arithmetic the same way the legal team would lay it out.
- Base license: $2,400
- Per domain penalty: $24,000
- Six domains across four years: $576,000
- Willful infringement multiplier: up to $950,000
That last line is the one that matters. A $2,400 oversight does not stay $2,400. The penalty structure is built to punish the years you let it sit, and the willful multiplier is built to punish the fact that nobody looked.
But we hired an agency to build our site
That is the sentence every founder reaches for, and it does not hold. In this case the agency closed two years ago. The designer moved to Bali. Nobody remembers who chose the fonts. And legally, you are still liable. The license attaches to the company running the website, not to the freelancer who picked the typeface and disappeared.
Read that as an operator. The vendor who created the exposure is gone, the institutional memory is gone, and the bill lands on you. The pharma company put it plainly when we showed them the risk assessment. We have been meaning to check on that since 2021. Three years of meaning to check turned into nearly a million in exposure.
What most people get wrong about free and premium fonts
The traps are specific, and they are easy to walk into without noticing.
- That free font from dafont.com. Check the license. Personal use only means exactly that, and a commercial website is not personal use.
- Google Fonts are safe, but only if you are actually loading from Google CDN. Self-hosting the same files without checking the terms is a different situation.
- The premium font your designer used through their Adobe Creative Cloud subscription. That subscription covers their work. It does not cover your commercial website.
None of these are exotic edge cases. They are the default way fonts end up on a site when a designer moves fast and nobody owns compliance afterward.
The fix is 16 hours, not a lawsuit
Cleaning this up is bounded work, which is the part founders tend to miss. The full job runs about 16 hours.
- A full font audit across all properties.
- License verification on every font you load.
- Replacing the fonts that are not licensed.
- Documenting everything, so the next time a foundry asks, you have an answer.
- Putting font governance in place so this does not recur the next time someone ships a landing page.
Sixteen hours of focused work against up to $950,000 of exposure is one of the cleaner trades you will make this quarter. The math only looks bad if you do the audit after the invoice arrives instead of before.
Your move
Take 10 seconds. The Network tab is already open, is it not. Better to spend $2,400 on licenses than $950,000 on lawyers. The decision is not whether to look. It is whether you look on your schedule or on a foundry legal team schedule.
If you want the broader picture, a quick check of your website often surfaces more than fonts. You can run a free website and AI readiness audit at https://readiness.ai4.sale and see what else is quietly exposed before someone else finds it first.