This Is Not a Technical Oversight
A commercial typeface — Helvetica, Gotham, Avenir, Proxima Nova, Futura — is intellectual property. The font software (the .otf, .ttf, .woff2 file) is protected by copyright in the US, EU, UK, and most other markets. Serving those files to browsers through @font-face, or converting a designer’s desktop copy into a webfont kit, without a grant that allows web embedding is copyright infringement.
“I found it on a free-download site,” “it came with the theme,” and “the agency handled fonts” are not defenses. The site owner is typically the party the foundry writes to. For the short version of exposure ranges, see Legal Risks of Unlicensed Fonts. This article is the process: what usually happens, in order — and why detecting the font and knowing which license you hold are two different, equally necessary facts.
This is informational, not legal advice. Jurisdiction and facts vary. Speak to qualified counsel for your case.
How Foundries Usually Find You
Rights holders and their enforcement partners crawl the public web. They look for commercial family names, file hashes, and CSS that loads self-hosted kits. They do not need access to your Figma file. If the font is on the live site, it is visible.
That is why font detection is not a nice-to-have for the brand team. It is the same class of evidence the other side already has. If you cannot list every commercial family on production — including tag-manager extras and leftover /fonts folders — you are negotiating blind. How to inventory a site: How to Check What Fonts a Website Uses and How to Audit Fonts on Your Website.
The Typical Legal Path
1. Detection, then a demand
You receive a cease-and-desist or licensing demand: named families, your domain, a deadline, and a number. Often it is a form letter triggered by a crawl. What to do in the first 48 hours: Font Cease-and-Desist Letter.
2. Retroactive fees, not “buy it from today”
Purchasing a license going forward rarely wipes the past. Foundries commonly want back usage — duration, traffic, number of domains, number of weights. “We’ll buy it now” without removing the files can still leave a claim for the years the site was live.
3. Negotiation
Many disputes settle. Initial figures are often opening positions. Speed, documented removal, and a complete (not selective) inventory help. Admitting liability in an angry email does not.
4. Escalation if you ignore it
Silence, deletion of the letter, or swapping the CSS while the same WOFF2 stays cached can lead to follow-ups, higher demands, and in some cases litigation. Courts can order injunctions (stop using the files) and damages. In the US, statutory damages for willful copyright infringement can be severe per work; even “we didn’t know” can be framed as negligence if you never audited. Enforcement exists in the EU, UK, and elsewhere under local copyright statutes — the brand risk is not US-only.
5. Judgment and costs
If it reaches a judgment, you may face damages, legal fees, and a public record. That is far more expensive than a web license or an OFL substitute. Real-world outcomes: Font Infringement Cases.
Why “We Have a License Somewhere” Fails
Two facts must both be true:
- What is live — which families and files the site actually serves.
- What you own — vendor, license type (desktop is not web), domains, seats, dates, and the PDF.
A desktop seat for print does not authorize @font-face. An Adobe Fonts subscription that lapsed does not authorize extracted files on your CDN. A license for brand.com does not cover the campaign microsite. Desktop vs Web and EULAs are the usual failure modes.
If you cannot produce the invoice and map it to the live family and host, the foundry will treat the use as unlicensed. Memory is not proof.
Why Detection and License Knowledge Belong Together
Detection without an inventory tells you that Gotham is on the homepage. It does not tell you whether procurement bought a web grant for that domain in 2024.
An inventory without a crawl tells you that finance filed a Monotype PDF. It does not tell you that last month’s theme still ships Helvetica Neue from /assets/fonts.
The legal process starts when those two pictures diverge. The practical control is: scan, then match each commercial detection to a registered license.
FontScanner’s license management is built for that join. You store vendor, type, domains, seats, and proof. On every scan, if a detected family matches a record and the host is covered, the report marks it Verified. If you own the family but not this domain: Domain not covered. If there is no record: Missing. How that engine works: How FontScanner Matches Licenses on Every Scan.
That match will not replace a lawyer. It will tell you, before a letter arrives, whether you can show coverage — or whether you should remove or buy a grant this week.
What to Do Before Anyone Writes to You
- Scan production, not only staging.
- Register every paid family you believe you own — My Font Licenses.
- Attach the PDF. No PDF → treat it as Missing until procurement recovers it.
- Triage Domain not covered separately from Missing. They are different legal stories.
- Replace or properly license anything you cannot prove. OFL options: SIL Open Font License.
- Re-scan after a redesign. Matching is only as current as the last crawl.
Conclusion
Using a paid font without the right license is a copyright problem with a predictable pipeline: crawl, letter, retroactive fees, possible suit. The cheapest day to care is the day before the letter. You need to know which fonts are on the site and which licenses you actually hold — and you need those two lists to meet.