Heh, that's a better question. I have no reason to believe that Google Fonts are being used to track users, but I don't have hard evidence on this either way. I am deeply concerned about the way the modern Internet is turning into a surveillance machine and its potential for abuse, but if I were evil, I'd probably go after much lower hanging fruit than fonts.
either way, loading fonts from google for every website is a stupid idea... it is why an extension like decentraleyes is a good idea (because most website don't think about the consequences).
I think Google might have better ways to track people. Fonts are also cached by CDNs and the local browser so I’m not sure if they provide good tracking data (they get loaded only for the first page visit for example and popular fonts like Open Sans are probably already in your cache when you open a page).
If you’re concerned about tracking as a website operator you can simply load the fonts from your own server, most of them can be found on Github and have liberal licenses (I think all fonts on fonts.google.com)
You can even install the fonts locally to your machine and your browser will favor the local copy. There are some tools like Skyfonts that let you install the top X from Google Fonts and it can be a fun way to speed up a lot of the web; with the tradeoff that not a lot of people have the top X installed for useful large versions of X and that becomes its own fingerprint for surveillance software (testing how long text takes to render in an off screen canvas, for instance).
It's been suggested that Browsers or Operating Systems choose a useful X value and install the top fonts everywhere like they used to install the classic "core web fonts".
Also there's a addon called "decentraleyes" that will cache fonts, amongst other things. It's one of 3 extensions I install in every browser I'm allowed to. The others are uBlock origin and https everywhere. All 3 have good privacy/security/performance benefits with effectively no breakage, in their default configurations.
Decentraleyes is an excellent add-on that improves browsing speed and privacy with no negative side effects. Currently, the only font cached by Decentraleyes is Noto Sans. It also caches Google's Web Font Loader script and many major JavaScript frameworks.
Correction: Decentraleyes doesn't actually cache any fonts. Noto Sans is just used for the add-on interface. Font caching would make an interesting feature if the add-on developer is willing to implement it, especially if it bypasses fingerprinting.
Delivery of fonts aren't what's used to track people. Rendering of fonts is.
Different machines render fonts in a unique way. Consider different GPUs (hardware differences), different drivers (kernel/driver differences), browsers (user-land differences), and sizes (user settings) can all contribute to a font being rendered differently per-user and increasing entropy of a particular unique font id.
