One aspect of this is that data processing which is necessary to do what the customer explicitly requested is permitted (GDPR article 6.1.b). Making the payment for your purchase is such a thing and this processing is lawful, but doing analytics or tracking who viewed the site through fonts is not, and generally requires explicit opt-in consent.