> However, if the company running the web page were to take that IP address and store it and use it for deep analytics

Or, in fact, sending off to Google Fonts. As a German court case reveals, that is considered sending the IP to Google -- breaking GDPR since it is done without consent on first launch of the site.