11–20 of 656 posts
Wait, what prevents the next court to say that the browser vendor is responsible for the leak ? Per default the browser is not asking the user if it's okay to download fonts from Google (or any resources from any another resources provider) after all.
The reasoning behind this judgement is: The services (here: web fonts) could be supplied another way, so exposing the user's IP to google is not strictly necessary, from a technical POV. The user's IP is PII, and exposing it unnecessarily to third party is a GDPR violation. The way this is phrased, the reasoning applies to basically every static resource loaded from a CDN or other third-party website.
Because an IP address needed to receive a download. This kind of decision means that any hot linking of static media assets is now in hot waters.
A sensible judge would say IP address is not PII but a prerequisite to use Internet in the first place. Like a license plate on car e.g. other broken analogue of tracking. Like a power socket. However the definition of PII in Europe is overly capturing (saying this as an European.)
After translating - the violation here is a website included third-party fonts from Google, and the fact that Google would be able to see their IP from the request violates GDPR? Seems as though anybody who uses a CDN or third-party to load _any_ resources will violate GDPR by this measure? Seems like a pretty wide interpretation of this law.
1) Your IP address is considered personal data, as it can be used to identify you. In general, everyone can see and agree with this.
2) In the absence of additional protections and/or contract terms[1], the transfer of personal data out of the EU is an offense under the GDPR (well, technically it's not out of EU, but transfer to a country without GDPR equivalence).
So - embedding code / data from a 3rd party into your website results in a transfer of personal data.
[1] The idea of additional protections/contract terms is even questionable, but that's a whole other thing...
So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…
Just don't do it but serve your stuff from your domain.
Wait, what prevents the next court to say that the browser vendor is responsible for the leak ? Per default the browser is not asking the user if it's okay to download fonts from Google (or any resources from any another resources provider) after all.
The browser can be set to dissallow third party resources
After translating - the violation here is a website included third-party fonts from Google, and the fact that Google would be able to see their IP from the request violates GDPR? Seems as though anybody who uses a CDN or third-party to load _any_ resources will violate GDPR by this measure? Seems like a pretty wide interpretation of this law.
Since you have no control over what Google does with the data of visitors when you embed Google Fonts, it is not compatible with the GDPR (just like Google Analytics).
https://de.wikipedia.org/wiki/Datenverarbeitung_im_Auftrag https://www.gdpr.org/regulation/article-28.html
This is a good decision by the court. Sure, web developers may not like it, but it may force them to improve on how they work.
So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…
https://allaboutberlin.com/guides/abmahnung-creative-commons
The reasoning behind this judgement is: The services (here: web fonts) could be supplied another way, so exposing the user's IP to google is not strictly necessary, from a technical POV. The user's IP is PII, and exposing it unnecessarily to third party is a GDPR violation. The way this is phrased, the reasoning applies to basically every static resource loaded from a CDN or other third-party website.
What would a technical solution that respects privacy look like? The website making the call to Google in the background (minus user details) and forwarding the response onward? Why isn't it done that way, it feels like it's the more obvious solution if you're not trying to track users.
Early internet was very wary of 'hotlinking' because it costs money to serve things, people used to try to offload hosting costs to others. Now it seems people take that on willing with the expectation to make enough money to cover it.
Is it just scale, or is it the user info that makes these services viable?
Early Google used to use the argument that them making the web better was profitable, because more people using the web meant more money for them. Does that still apply? Would they still provide Google Fonts if they were legally bound to not use any user information they recieved?
Can you someone translate? Does this mean that hot linking any static media or asset from a third party is against the law unless explicit approval from the user is first received?