Yes, I am confused on this point as well.

By this logic, it sounds like all forms of hotlinking would be illegal, not just fonts but images, js, css, etc. How does a modern website operate under this law? Are there other options besides: 1. locally hosted resources, 2. an annoying consent popup ?

Tangent: I found this 2018 article about a list of websites that block visitors from GDPR countries. I wonder how many of these blocks are still in place today. I assume they were removed after the websites became GDPR compliance.

https://econsultancy.com/gdpr-which-websites-are-blocking-vi...