GDPR penalty for passing on of IP address to Google by using Google Fonts
1–10 of 656 posts
Re: GDPR penalty for passing on of IP address to Google by using Google Fonts
#2After translating - the violation here is a website included third-party fonts from Google, and the fact that Google would be able to see their IP from the request violates GDPR?
Seems as though anybody who uses a CDN or third-party to load _any_ resources will violate GDPR by this measure? Seems like a pretty wide interpretation of this law.
Re: GDPR penalty for passing on of IP address to Google by using Google Fonts
#3So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell?
Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202...
> The defendant is sentenced to pay the plaintiff €100.00
> The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction with Section 1004 of the German Civil Code.
> It is undisputed that the plaintiff's IP address was forwarded to Google when the plaintiff visited the defendant's website.
Re: GDPR penalty for passing on of IP address to Google by using Google Fonts
#4The reasoning behind this judgement is:
The services (here: web fonts) could be supplied another way, so exposing the user's IP to google is not strictly necessary, from a technical POV.
The user's IP is PII, and exposing it unnecessarily to third party is a GDPR violation.
The way this is phrased, the reasoning applies to basically every static resource loaded from a CDN or other third-party website.
Re: GDPR penalty for passing on of IP address to Google by using Google Fonts
#5After translating - the violation here is a website included third-party fonts from Google, and the fact that Google would be able to see their IP from the request violates GDPR? Seems as though anybody who uses a CDN or third-party to load _any_ resources will violate GDPR by this measure? Seems like a pretty wide interpretation of this law.
That is exactly my reading as well.
Re: GDPR penalty for passing on of IP address to Google by using Google Fonts
#6german law doesn't really know "precedent cases". However it looks like a whole new industry of lawyers sueing pages embedding stuff could arise...
Re: GDPR penalty for passing on of IP address to Google by using Google Fonts
#7The reasoning behind this judgement is: The services (here: web fonts) could be supplied another way, so exposing the user's IP to google is not strictly necessary, from a technical POV. The user's IP is PII, and exposing it unnecessarily to third party is a GDPR violation. The way this is phrased, the reasoning applies to basically every static resource loaded from a CDN or other third-party website.
It’s “personal data” in GDPR. PII is the US concept and much narrower.
Re: GDPR penalty for passing on of IP address to Google by using Google Fonts
#8After translating - the violation here is a website included third-party fonts from Google, and the fact that Google would be able to see their IP from the request violates GDPR? Seems as though anybody who uses a CDN or third-party to load _any_ resources will violate GDPR by this measure? Seems like a pretty wide interpretation of this law.
IANAL, but it sounds to me like a very important part of the story is that Google was not listed to end user as entity that would treat their data. Another way to read this could be: failure to inform users that their IP addresses were sent to Google resulted in a 100 € fine.
Re: GDPR penalty for passing on of IP address to Google by using Google Fonts
#9Wait, what prevents the next court to say that the browser vendor is responsible for the leak ? Per default the browser is not asking the user if it's okay to download fonts from Google (or any resources from any another resources provider) after all.
Re: GDPR penalty for passing on of IP address to Google by using Google Fonts
#10Can you someone translate? Does this mean that hot linking any static media or asset from a third party is against the law unless explicit approval from the user is first received?