Why would sending requests to Google's servers (complete with Referer headers) not be a privacy violation? It allows Google to track every page you visit that has Google Fonts, which is definitely a privacy concern.