Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 80 posts

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#11

Post by tomxor »

The issue with google fonts is the CDN tracking I believe, not the license or the font itself.

If you need a google (or other) fonts, do self hosting. Simplest way is to build them into your site as a dependency... npm @fontsource for individual fonts is great for this [0] This is also better in terms of HTTPS overhead, and the process of self hosting is good for font file weight awareness due to the affect on your build size, especially when using lots of styles.

Same principle for any other CDNs you use, they all have the potential to track. The risk benefit of CDNs is being reversed, public CDNs disadvantages are: increased HTTPS overhead, increases points of failure, increased risk of users getting arbitrarily blocked by CDN provider IP blacklists, increased risk of tracking. Benefits: small developer convenience, potential advantage of caching (unlikely these days, and unlikely to outweigh the cost of HTTPS overhead especially in terms of total latency).

[0] https://github.com/fontsource/fontsource

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#12

Post by iforgotpassword »

yladiz wrote: post #3
rglullis wrote: post #2

How about "Don't use Google Analytics and Google Fonts"? Like, at all ? There are self-hosted alternatives. Plausible Analytics is good. Find web fonts that you can host yourself. Not only you will reduce your risk exposure, you'll see that it is not that difficult to get rid of Google. Your users, European or not, will thank you later.

Although you're right, there are alternatives to Google Analytics, you really should work on your messaging. Snark isn't necessary when someone is (seemingly) genuinely asking for help. In any case, for the OP I would also recommend to use an alternative. I don't know about Plausible Analytics but I have heard good things about Simple Analytics [1]. I'm not sure about Google Fonts. In terms of GDPR compliance, just k…

Agree that GP's tone was off, but it kinda rubbed me the wrong way too that OP said the GDPR got worse and then goes ahead ans mentions embedding Google fonts as the first thing. Like you can't even be arsed to self-host static assets and rather expose your visitors/customers to the almighty spying kraken. So while I'm sick and tired of cookie banners, I have little sympathy in this specific case.

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#13

Post by danbulant »

panphora wrote: post #4

You can use privacy-focused drop-in alternatives to Google Analytics and Google Fonts: • https://www.growthfyi.com/custom-ga • https://fonts.bunny.net/ I personally choose to use Plausible Analytics with a custom domain [0] and the default "System Font Stack" [1], which means my sites load fast, don't have a flash of unstyled text, and my analytics script doesn't get blocked by ad blockers. [0] https://plausible.io/d…

I don't see a difference with fonts.bunny.net and Google Fonts? From the perspective of GDPR, they still both receive your IPA and browser info, which was what made it illegal to use G fonts.

You can download fonts from both of them and host them on your own server to avoid processing that information.

I'm all for privacy and such (I don't use Google Fonts or tracking ads/analytics), but I don't really see a difference in here. According to G Fonts privacy policy, they don't store any PII. (This also reminds me that based on what I understand of the ruling, almost any 3rd party requests for assets should be blocked? Including G fonts, bunny fonts and jsdelivr)

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#15

Post by martin_a »

danbulant wrote: post #13
panphora wrote: post #4

You can use privacy-focused drop-in alternatives to Google Analytics and Google Fonts: • https://www.growthfyi.com/custom-ga • https://fonts.bunny.net/ I personally choose to use Plausible Analytics with a custom domain [0] and the default "System Font Stack" [1], which means my sites load fast, don't have a flash of unstyled text, and my analytics script doesn't get blocked by ad blockers. [0] https://plausible.io/d…

I don't see a difference with fonts.bunny.net and Google Fonts? From the perspective of GDPR, they still both receive your IPA and browser info, which was what made it illegal to use G fonts. You can download fonts from both of them and host them on your own server to avoid processing that information. I'm all for privacy and such (I don't use Google Fonts or tracking ads/analytics), but I don't really see a differen…

> According to G Fonts privacy policy, they don't store any PII.

Do they log IP addresses? That would be enough as those count as PII. Maybe bunny.net has logs disabled and that's what makes them stand out.

But especially with fonts it's just so easy to self-host them that it's kind of a no-brainer.

> almost any 3rd party requests for assets should be blocked

That could be a very good practice/state of mind for developing privacy-respecting websites/apps and will save you from stress, before it can happen.

As you have no more advantages due to separated caches from using CDNs for scripts etc., you can self-host those, too. Saves on DNS lookups and you have control over the caching-times, too.

I'd try to run as much as possible from the same domain.

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#16

Post by lmkg »

ponyous wrote: post #6

Got a relevant question myself: What bothers me the most for solo founders with GDPR is that you can't analyse individual user journeys without some kind of consent. I don't care who you are, but I care how you use my product so I can improve it. Aggregated / backend analytics will give me only the most basic insights. Am I right in that? Is it possible to work around that? I don't track to sell or analyse personal d…

You need consent to read or write data from the user's computer except that which is strictly necessary for providing the service provided. This torpedoes analytics which identify users by setting their own pseudonymous identifier.

There's a bit more leeway to take data you already need to use for your service, and using it for a secondary purpose like analytics. So things like analyzing logs, including making use of a user identifier which you had to collect and process for other reasons. There are still restrictions, but much less severe than "strict consent." You can use "Legitimate Interest," legitimately.

Note that reading cookies is covered by the ePrivacy Directive, while processing personal data is covered by GDPR (reading cookies with personal data is covered by both). This is the source of many issues. In this case, it means collection is severely restricted (ePD) but use afterwards is less-restricted (GDPR).

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#18

Post by ensignavenger »

As a small, bootstrapped one person startup, the part of GDPR that seems impossible for me to comply with (I am not lawyer nor am I European, so maybe I am wrong, but everything I have read about it indicates I am right) is the appointment of a Data Protection Officer. I do the duties of the DPO myself, but from what I have read, this is not in compliance with GDPR, which requires the DPO to be "independent". See https://edps.europa.eu/data-protection/data-protection/refer...

Re: Ask HN: GDPR in 2022 – What do I need to know as a solo founder?

#20

Post by hgomersall »

coenhyde wrote: post #17

If I was starting a startup today. I'd probably just block Europe and focus on other markets initially. Loop back on Europe once you have product market fit and the resources to deal with GDPR.

Or alternatively, think why the GDPR exists and make sure you can deal with privacy concerns from the outset.
Post reply on HN