Can text-native web fonts protect websites from AI companies scraping data?

Open-source project ShieldFont changes the text that basic AI scrapers extract while preserving what people see, offering websites another defence against unauthorised data collection

France-based S&A Studio, in partnership with Danish type foundry Playtype, has developed ShieldFont, an open-source, text-native method designed to protect online writing from unauthorised AI data scrapers. According to the creative studio, ShieldFont uses a font to replace selected words in a webpage's underlying HTML with unrelated ones. A human reader sees the original article, but a basic scraper extracting the page's source code can end up with a version that says something entirely different.

 

The approach reflects how difficult the fight over online content has become as AI companies increasingly rely on the web for data. Website owners have traditionally used robots.txt files, user-agent blocking and other bot-management tools to restrict automated access. But AI crawlers can operate at a scale that puts pressure on websites, while some have also been reported to evade conventional measures by changing user agents and using residential IP addresses. 

 

AI changed the economics of the open web

Web scraping itself is not new. Websites have long been crawled by search engines, research tools, price-monitoring services and other automated systems.

 

AI has changed the scale and purpose of that activity.

 

IBM describes AI scraping as the automated extraction of website data using AI to make the process more adaptive and efficient, with AI companies among the users that can extract data to train models.

 

The pressure is also visible in the traffic data. According to the Thales Bad Bot Report 2026, bots accounted for 53 per cent of global internet traffic in 2025, compared with 47 per cent generated by humans. Bad or unverified bots alone accounted for 40 per cent. Thales also recorded a 12.5-fold increase in AI-driven bot attacks during the year.

 

For websites, not all AI traffic has the same value. A crawler collecting material for model training may provide little or no immediate traffic in return. An AI search crawler, on the other hand, can potentially send users to the original website. That distinction is increasingly important as AI assistants become another way of discovering information.

The problem is not limited to publishers.

 

Ars Technica reported that some open-source projects have seen AI-company bots account for as much as 97 per cent of traffic. In one case, aggressive Amazon crawler traffic repeatedly caused instability and downtime despite robots.txt changes, user-agent blocking and traffic filtering. Crawlers were also reported to spoof user agents and use residential IP addresses.

The legal fight is already under way

The dispute over AI training is no longer simply about whether a website can technically stop a bot. It has moved into courts and regulation.

 

OpenAI itself argued in a 2024 submission to the UK House of Lords that it would be impossible to train leading AI models without copyrighted material because copyright covers much of the world's written and creative expression. Publishers and authors, however, have challenged the assumption that publicly accessible material is automatically available for commercial AI training.

 

Ziff Davis sued OpenAI in 2025, alleging that its publications were used without permission. In 2026, CNN also sued Perplexity, alleging that its stories, videos and images were copied and reused in its AI services.

 

The courts have not produced one simple answer. Reuters reported that US rulings in 2025 generally found that training on lawfully obtained material could qualify as fair use in some circumstances, while also drawing a much harder line around pirated or improperly obtained material. The Anthropic case, for example, found training on lawfully acquired books to be fair use but treated the use of pirated copies differently.

 

Regulation is moving alongside the litigation. Under the EU AI Act, providers of general-purpose AI models must implement a copyright policy and publish a sufficiently detailed summary of the content used to train their models. They must also respect rights reservations under EU copyright law.

 

India has its own dispute.

 

News agency ANI sued OpenAI over unauthorised use of its content for training ChatGPT. While OpenAI denied the allegation, it stated that US law requires preserving the disputed data for ongoing litigation, making immediate deletion impossible.

Blocking bots creates another problem

For publishers, simply blocking every AI crawler is not necessarily the answer.

 

AI companies have increasingly entered licensing and content partnerships with publishers. OpenAI, for example, has agreements with the Financial Times, Axel Springer, News Corp, Le Monde, Prisa Media, Condé Nast and others. Some agreements explicitly allow content to contribute to model training, while also providing attribution and links in AI products.

 

That creates a difficult choice. Blocking training crawlers can protect content from unauthorised collection, but blocking search or agent traffic can also reduce visibility in AI-powered discovery. Cloudflare has described the situation as a choice between blocking AI crawlers and potentially missing licensing or referral opportunities.

 

The industry is therefore moving towards more granular controls. Cloudflare's AI Crawl Control allows website owners to monitor individual AI crawlers and allow or block them. Its current system distinguishes between Search, Agent and Training activity, rather than treating every AI bot as identical.

 

AWS WAF Bot Control similarly allows websites to monitor, block or rate-limit scrapers and crawlers. Its targeted protection can detect bots that disguise themselves using residential proxies and headless browsers. AWS has also introduced Web Bot Authentication, allowing authorised automated agents to prove their identity cryptographically.

 

Akamai offers similar controls for publishers, including identifying bot traffic, deciding which automated systems can access particular content and blocking or allowing them based on defined rules.

 

Cloudflare has also tried a more unusual method. Its AI Labyrinth sends unauthorised crawlers into dynamically generated pages designed to waste their resources instead of simply returning a block. Cloudflare said AI crawlers were generating more than 50 billion requests to its network every day when it introduced the system.

ShieldFont takes a different route

ShieldFont takes a simpler approach than tools that try to identify and block AI bots. It works on the assumption that many large-scale scrapers do not actually open and display a webpage. Instead, they download the HTML code and pull the text directly from it.

 

This is where the font comes in. Fonts normally decide how letters and words appear on a screen. ShieldFont uses a feature called ligatures to make the browser display the original words even though different words are present in the webpage's code. For example, the code could contain the word "potato", but the browser would show "horse" to a reader. A basic scraper that reads the code, however, would collect "potato". The result is a version of the article that may look normal at first but has a different meaning.

 

The ShieldFont Project said its current dictionary contains nearly 12,000 word pairs. Publishers can also use different word mappings, including different mappings for different paragraphs. This makes it harder for a scraper to decode one set of substitutions and use it across an entire website.

 

Its reported results are notable, although they come from the project's own testing.

 

ShieldFont said it changes about 24.4 per cent of all words on a page and 45.8 per cent of the words that carry most of the meaning. In tests involving six publicly available scraping systems, more than 90 per cent of pages that would normally have passed their quality checks were rejected after ShieldFont was applied. Of the pages that still passed, 19.4 per cent of the words carried false meaning.

It is not a perfect shield

ShieldFont's biggest weakness comes from the same idea that makes it work. If a person can see the correct words, a sufficiently determined machine can also find a way to read them.

 

For example, a scraper could open the webpage like a normal browser, take an image of what is displayed and use optical character recognition, or OCR, to read the words from that image. The ShieldFont authors acknowledge that the font can also be studied and decoded by someone specifically targeting a website. The project is therefore aimed mainly at stopping large-scale, automated scraping rather than someone deliberately targeting one particular site.

 

There are also problems for legitimate users. Search engines read the same underlying webpage code as basic scrapers, which means they could pick up the altered words instead of the original ones. Screen readers can also read the wrong words because they rely on the source code. Translation tools face a similar problem, while copying and pasting shielded text can produce the altered version. ShieldFont is also currently available only for English.

 

That leaves ShieldFont in an unusual position. It is not a replacement for robots.txt, bot-blocking tools, licensing agreements or copyright law. Instead, it is another layer in the growing effort by websites to control how automated systems access their content. The bigger question is whether making content harder to scrape can keep pace with AI companies that have both the incentive and the resources to find ways around these defences.