Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

101–110 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#101

Post by sqrt2 »

remus wrote: post #71
onli wrote: post #23

Earlier quoted context omitted.

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

The part I find hard to understand is how you decide whether it is a necessity to load external content. For example, say I want to embed an instagram post on my website. You could argue that I should talk to the person who took the picture and get a license for the image so that I can host i on my own domain rather than loading the content for instagram. In practice this is obviously much, much more cumbersome than…

The website tried to rely on legitimate interest as the legal basis for processing the data, and that precisely requires a balancing test between the interests of the website host and the interests of the data subject.

If you want to make sure that you're not getting the balancing test wrong, you can always go for the legal basis of last resort: consent. Just ask the user whether you can load content from Instagram and only do it if they agree. In fact, since in parallel to the question of your legal basis under GDPR, you also have to comply with the cookie provision from the e-Privacy Directive, where there is no "legitimate interest" exception to the requirement to ask for consent, you will have to ask for consent anyway (as Instagram embeds place cookies).

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#102

Post by maratc »

7373737373 wrote: post #89
maratc wrote: post #64

Earlier quoted context omitted.

The plaintiff's browser did what the defendant's code ordered it to do. If the defendant's code violated GPDR (which seems to be the court's conclusion) by sending the plaintiff's browser somewhere, it's a defendant's problem, not plaintiff's.

Yeah, that's exactly the agency argument. It's not as if the plaintiff's browser is actually under control of the defendant, a user agent is not forced to follow the instructions that are contained in a website it requested on behalf of its user.

> not forced to follow the instructions

Again, you're talking about an opt-out. GPDR (the law) requires an opt-in.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#104

Post by mawadev »

rokizero wrote: post #38

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make se…

Exactly. Why would you serve your own copy of the fonts if a previous request to that cdn may have cached them in your browser already? Opt-In goes against the architecture of websites. What's next? A popup for each third party request? It is not feasible and just another stumbling block - like Impressum for private persons and third party cookie consent to host websites in Germany. It makes more sense to fix the issue at the fundamental browser level by the vendor (natively, without the need for plugins) and explain the dangers to the users. Educated users block requests anyway for example.

I think hosting it by yourself is the solution here, but it's getting difficult to keep up with all the rules, especially when the fundamental design of the web moves in the opposite direction.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#105

Post by isbvhodnvemrwvn »

_ixnm wrote: post #86
kiallmacinnes wrote: post #37

Earlier quoted context omitted.

I stand corrected - not everyone can agree! In reality, as a service provider, you have no ability to determine if the client IP belongs to an individual or not - so you have no choice but to assume it does identify an individual.

This is ludicrous. Nginx logs are regulated now? What if you just want to make a static website and get on with your life?

You're not sending your nginx logs to Google, a well known advertiser, do you?

In this case you can store IP addresses if you have a legitimate reason (e.g. you can show you need it for troubleshooting etc), as long as it's reasonable and doesn't infringe on the rights of the user, and you have documented it along with the retention strategy.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#106

Post by mro_name »

iqanq wrote: post #53
randalluk wrote: post #41

Earlier quoted context omitted.

Doesn't this attitude overlook the "agency" of the "User-Agent"?

Isn't regulation precisely the act of acting in behalf of the citizens because they are seen as "too stupid" to know what they are doing?

no. They just can't care about everything themselves individually all the time.

So penalising unwanted behaviour isn't about stupidity at all.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#107

Post by ratww »

randalluk wrote: post #70
dividedbyzero wrote: post #52

Earlier quoted context omitted.

What does the browser's user agent have to do with this?

The browser is the user-agent, ie. an agent acting on behalf of the user. The browser chose to fetch the font, based on the orinal response. It could be configured not to.

> It could be configured not to.

Not in practice. It requires configuration that is non-trivial for most users and might not be available for them in all cases (eg: using a computer in a library).

In fact, I can't think of a solution that doesn't require third-party software/hardware/product and some computer expertise (AdBlock? Pi-Hole? VPN? Little Snitch? Hosts File?).

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#108

Post by bryanrasmussen »

iqanq wrote: post #53
randalluk wrote: post #41

Earlier quoted context omitted.

Doesn't this attitude overlook the "agency" of the "User-Agent"?

Isn't regulation precisely the act of acting in behalf of the citizens because they are seen as "too stupid" to know what they are doing?

or too under-powered in relation to the powerful organizations that take advantage of them, or too overworked by all the tasks and details of their lives to deal adequately with all the things it might be beneficial for them to deal with, but are not strictly necessary for getting through the day.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#109

Post by leobg »

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the website itself to Google sharing the user’s IP address never actually occurs.
Post reply on HN