Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

121–130 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#121

Post by hdjjhhvvhga »

zinekeller wrote: post #78
remus wrote: post #71

Earlier quoted context omitted.

The part I find hard to understand is how you decide whether it is a necessity to load external content. For example, say I want to embed an instagram post on my website. You could argue that I should talk to the person who took the picture and get a license for the image so that I can host i on my own domain rather than loading the content for instagram. In practice this is obviously much, much more cumbersome than…

> For example, say I want to embed an instagram post on my website. In that case, you could: a) get a license (your suggestion), b) link but not embed Instagram pages, or c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. And indeed, some websites use c) without any problem, they even integrate it into the cooki…

> they can say that this is to preserve the context in case that the user subsequently deleted the post).

And this is how it should be done, otherwise you read the article a few years latter and see a strange mess with empty holes.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#122

Post by isbvhodnvemrwvn »

leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

Using this logic I can send full fingerprinting data as long as I do it from the front-end?

I mean courts are not that dumb, it's still the website owner which decides what is done.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#123

Post by martincmartin »

onli wrote: post #23
HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

> (I assume they mean self-hosting)

Or proxying. Or proxying with caching, which is kind of part way between self-hosting and proxying. :)

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#124

Post by mawadev »

HL33tibCe7 wrote: post #103

Unfortunately, GDPR is an insane web of laws and regulations that any non-lawyer has absolutely no hope of understanding.

This is exactly what stops me from hosting websites. I simply have given up trying to keep up with the rules. It is a massive burden if you are not a corporation trying to extract information and just want to host a simple blog from a german server. At some point, private persons and maybe small businesses won't be able to keep up and the web becomes even more centralized.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#125

Post by foepys »

5e92cb50239222b wrote: post #60
ianpurton wrote: post #19

Hopefully we won't see popups like "This site will forward your IP address to Google is that OK?", because I'm already beyond bored with "This site uses cookies do you accept?".

Go to uBlock Origin settings and check every item in the 'annoyances' list. I haven't seen a single cookie banner for a few years now. (This is assuming you're using uBO, because who the hell isn't these days?)

The interesting thing that a lot of services don't consider is that blocking these cookie banners is perfectly allowed and does not implicitly allow services to collect personal data.

Twitter is one of those service that just states "we collect data, deal with it when using this website" (which is already not legal) but the thing is, I don't even see this pop-up because uBlock is filtering it out. If Twitter now collects my personal data, it is not only breaking the opt-in component of GDPR but also doesn't even notify me about data collection.

Quite a lot of services have JS-only popups which I also don't see. Do they collect data? I think so. Do they know they are doing it illegally? I would bet quite a bit of money that they never thought about somebody getting past their cookie banner without consenting, so probably no.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#126

Post by cuu508 »

Youden wrote: post #80
questiondev wrote: post #68

Earlier quoted context omitted.

that is true but it increases the barrier to entry for those who use google fonts for system resource issues, a lot of people offload because they don’t have the space or money to self host everything one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of servers

A $5 VPS comes with several gigabytes of storage. A standard web font (e.g. Roboto) is ~1MB. Bandwidth is essentially free through CloudFlare. Who doesn't have the space or money to self-host their fonts?

> A standard web font (e.g. Roboto) is ~1MB.

Currently on HN frontpage there is an article "How to avoid layout shifts caused by web fonts" [1]. It lists several techniques you can use to reduce font size. One of the examples shows how subsetting reduces Roboto Regular size to 11KB.

[1] https://simonhearne.com/2021/layout-shifts-webfonts/.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#127

Post by smilespray »

5e92cb50239222b wrote: post #60
ianpurton wrote: post #19

Hopefully we won't see popups like "This site will forward your IP address to Google is that OK?", because I'm already beyond bored with "This site uses cookies do you accept?".

Go to uBlock Origin settings and check every item in the 'annoyances' list. I haven't seen a single cookie banner for a few years now. (This is assuming you're using uBO, because who the hell isn't these days?)

People who have other priorities and interests than technology.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#128

Post by onli »

sqrt2 wrote: post #101
remus wrote: post #71

Earlier quoted context omitted.

The part I find hard to understand is how you decide whether it is a necessity to load external content. For example, say I want to embed an instagram post on my website. You could argue that I should talk to the person who took the picture and get a license for the image so that I can host i on my own domain rather than loading the content for instagram. In practice this is obviously much, much more cumbersome than…

The website tried to rely on legitimate interest as the legal basis for processing the data, and that precisely requires a balancing test between the interests of the website host and the interests of the data subject. If you want to make sure that you're not getting the balancing test wrong, you can always go for the legal basis of last resort: consent. Just ask the user whether you can load content from Instagram a…

> In fact, since in parallel to the question of your legal basis under GDPR, you also have to comply with the cookie provision from the e-Privacy Directive, where there is no "legitimate interest" exception to the requirement to ask for consent, you will have to ask for consent anyway (as Instagram embeds place cookies).

I don't think that's true. The cookie provision is misunderstood when you think you have to ask for consent for functional cookies. Follows from the GDPR, and there is no specific cookie law actually implemented in european countries. See also https://gdpr.eu/cookies/. Ah, but maybe I misunderstood and you are only talking about the cookie set by the embed?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#129

Post by 7373737373 »

maratc wrote: post #102
7373737373 wrote: post #89

Earlier quoted context omitted.

Yeah, that's exactly the agency argument. It's not as if the plaintiff's browser is actually under control of the defendant, a user agent is not forced to follow the instructions that are contained in a website it requested on behalf of its user.

> not forced to follow the instructions Again, you're talking about an opt-out. GPDR (the law) requires an opt-in.

I don't think forcing each and every single website provider to implement their own consent forms is the right approach to regulating this. User agents should have the ability to convey and enforce privacy preferences on behalf of the user, and website providers should be legally required to comply with these if possible (or refuse service if not). But requiring ever more complex, explicit and custom opt-in consent forms for various provider, third party and user jurisdiction combinations is just inane.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#130

Post by perlgeek »

ddmma wrote: post #65

This could be extended to any API request, if involves IP tracking

I'd say for requests that return dynamic data, a case could be made that there is technical merit for the client doing the request instead of the server proxying the request.
Post reply on HN