Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

31–40 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#31

Post by onli »

brtkdotse wrote: post #17
HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Running a website in Germany seems like a god damned nightmare: https://allaboutberlin.com/guides/abmahnung-creative-commons

That specific scam does not have to work anymore though. Abmahnungen in Germany are the most stupid and lawyer serving system in the world, but the CC image scam got closed by judges deciding no monetary harm was done. Possible that these lawyers are still trying, but note that the article started 2018.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#32

Post by vanviegen »

brtkdotse wrote: post #17
HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Running a website in Germany seems like a god damned nightmare: https://allaboutberlin.com/guides/abmahnung-creative-commons

Whereas in the US you don't need to worry about frivolous lawsuits at all...?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#33

Post by noja »

HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Seems pretty simple to me. I visit not-google.com, then don't load anything from elsewhere without being asked first. It's not too dissimilar to app-level permissions.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#34

Post by izacus »

l0rn wrote: post #6

german law doesn't really know "precedent cases". However it looks like a whole new industry of lawyers sueing pages embedding stuff could arise...

Leaking customer data to Cloudflare is also a very interesting question here.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#35

Post by fsloth »

l0rn wrote: post #6

german law doesn't really know "precedent cases". However it looks like a whole new industry of lawyers sueing pages embedding stuff could arise...

Very good point, the courts in countries with common law work quite differently than where the courts are based on civil law. There is a quite large difference of the two systems.

https://en.m.wikipedia.org/wiki/Common_law

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#36

Post by brtkdotse »

ianpurton wrote: post #19

Hopefully we won't see popups like "This site will forward your IP address to Google is that OK?", because I'm already beyond bored with "This site uses cookies do you accept?".

I too was pissed about the popups until I realized it the companies throwing up the popups that are to blame.

Hosting all your assets by yourself, on your own servers and doing analytics without sending data to a third party is not a terribly tall order.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#37

Post by kiallmacinnes »

kleiba wrote: post #25
kiallmacinnes wrote: post #13

Earlier quoted context omitted.

Honestly, it's not that big a leap to reach this interpretation. 1) Your IP address is considered personal data, as it can be used to identify you. In general, everyone can see and agree with this. 2) In the absence of additional protections and/or contract terms[1], the transfer of personal data out of the EU is an offense under the GDPR (well, technically it's not out of EU, but transfer to a country without GDPR e…

1) Your IP address is considered personal data, as it can be used to identify you. In general, everyone can see and agree with this. Only if you're the sole user of that IP, which is e.g. not the case in a family.

I stand corrected - not everyone can agree!

In reality, as a service provider, you have no ability to determine if the client IP belongs to an individual or not - so you have no choice but to assume it does identify an individual.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#38

Post by rokizero »

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make sense?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#39

Post by Vespasian »

mro_name wrote: post #14
HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

yes. That's a fact. A 3rd party is a 3rd party and a website leaks it's visitors to it. Just don't do it but serve your stuff from your domain.

Also Google can definitely make use of That information because they know so much about the user that a single IP connect is enough to establish that a specific user visited that website.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#40

Post by the_mitsuhiko »

Scarblac wrote: post #28
ZeroGravitas wrote: post #18

Earlier quoted context omitted.

This seems logical and reasonable to me, though it seems others are surprised/appalled. What would a technical solution that respects privacy look like? The website making the call to Google in the background (minus user details) and forwarding the response onward? Why isn't it done that way, it feels like it's the more obvious solution if you're not trying to track users. Early internet was very wary of 'hotlinking'…

A main selling point of using CDNs for commonly used assets (like Google fonts) is that lots of websites use the same URL, so the browser is likely to have the asset in cache already from a previous use on another site. Makes the site faster and uses less bandwidth. I don't think there is a solution right now. Maybe browsers can stop sending these headers to well known CDN domains by default.

Browsers do not share these caches due to privacy concerns. There is no benefit to it being in a central vs your own cdn.
Post reply on HN