GDPR penalty for passing on of IP address to Google by using Google Fonts • Hacker News Board

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#131

Post by fooblat » Sun, Jan 30, 2022, 11:37 AM UTC

rokizero wrote: post #38

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make se…

It seems pretty reasonable to me.

1. In Germany an IP address is considered PI under GDPR because it is easily associated to a natural person.

2. Google is open about the fact that they log IP address with Google Font request activity, which includes the page you are on.

3. GDPR requires justification by necessity to collect and/or send PI to a 3rd party without consent.

4. No consent was given.

5. It is not necessary in this case because it is possible to use Google Fonts in other ways that don't send PI to Google, without significant burden.

I'm not a lawyer but I am responsible for GDPR compliance at a German startup.

edit: typo

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#132

Post by krehl » Sun, Jan 30, 2022, 11:37 AM UTC

izacus wrote: post #34

l0rn wrote: post #6

german law doesn't really know "precedent cases". However it looks like a whole new industry of lawyers sueing pages embedding stuff could arise...

Leaking customer data to Cloudflare is also a very interesting question here.

What about using e.g. Webflow? Can I leak the IP address of the customer if I don't know it myself?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#133

Post by izacus » Sun, Jan 30, 2022, 11:37 AM UTC

maxwell86 wrote: post #96

rokizero wrote: post #38

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make se…

As a German citizen, this isn’t nuts. Leaking extremely sensitive user data, like their IP addresses, to third parties, enable them to finger print users. Leaking those to third parties outside the EU, and in particular to companies whose revenue depends on this finger printing, like Google, just to serve a font, it’s the dumbest thing I’ve heard all week. The whole purpose of the GDPR is to discourage this behavior,…

IP Address is far from "extremely sensitive user data". Really.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#134

Post by mro_name » Sun, Jan 30, 2022, 11:37 AM UTC

7373737373 wrote: post #51

randalluk wrote: post #41

Earlier quoted context omitted.

Doesn't this attitude overlook the "agency" of the "User-Agent"?

Yeah, the plaintiff's browser made the request after all, no?

no. It didn't decide and so isn't responsible. Have you ever seen a gun in jail?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#135

Post by everdrive » Sun, Jan 30, 2022, 11:38 AM UTC

I try to block web fonts using Pihole. This makes me want to add an overly-broad rule blocking any occurrence of the word “font” in a domain. It’s yet another web technology that really has no need to exist. My computer already has multiple fonts. There’s way that I benefit by downloading them from a remote site.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#136

Post by laurent92 » Sun, Jan 30, 2022, 11:38 AM UTC

HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

The whole strategy with Google providing “services for everyone out of pure gratitude” is:

- With Google Fonts, to track the identity of users AND the real popularity of websites,

- With Google DNS 8.8.8.8, to track everyone’s DNS resolutions,

- With Google Analytics, to track who sees what, even if they only display masked IPs to the owner of the GA profile,

- Etc with Google Maps, emails, they don’t provide those services for free, they can track everyone’s profile, down to their obedience to Covid rules.

I wouldn’t be surprised if Germany bans more aspects of using Google’s free services.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#137

Post by ratww » Sun, Jan 30, 2022, 11:38 AM UTC

ChrisKnott wrote: post #50

noja wrote: post #33

Earlier quoted context omitted.

Seems pretty simple to me. I visit not-google.com, then don't load anything from elsewhere without being asked first. It's not too dissimilar to app-level permissions.

The counterargument to this is that you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML. This ruling could easily get overturned.

> you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML

Am I? Maybe I am, because I have worked as a web developer, but most people don't really have this knowledge.

And even if they suddenly start having the knowledge, what is their choice? Stop using the web for good?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#138

Post by skyeto » Sun, Jan 30, 2022, 11:38 AM UTC

Youden wrote: post #80

questiondev wrote: post #68

Earlier quoted context omitted.

that is true but it increases the barrier to entry for those who use google fonts for system resource issues, a lot of people offload because they don’t have the space or money to self host everything one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of servers

A $5 VPS comes with several gigabytes of storage. A standard web font (e.g. Roboto) is ~1MB. Bandwidth is essentially free through CloudFlare. Who doesn't have the space or money to self-host their fonts?

(in reply to krehl) And in that specific case you should probably have a DPA ready. Big issue with anything Google-related (and probably CloudFlare) is that they may transfer the data outside of the EU[0].

[0] https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#139

Post by Andrew_nenakhov » Sun, Jan 30, 2022, 11:39 AM UTC

Youden wrote: post #80

questiondev wrote: post #68

Earlier quoted context omitted.

that is true but it increases the barrier to entry for those who use google fonts for system resource issues, a lot of people offload because they don’t have the space or money to self host everything one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of servers

A $5 VPS comes with several gigabytes of storage. A standard web font (e.g. Roboto) is ~1MB. Bandwidth is essentially free through CloudFlare. Who doesn't have the space or money to self-host their fonts?

I wonder if you can get penalized for sending users' IPs to CloudFlare..

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#140

Post by Vespasian » Sun, Jan 30, 2022, 11:39 AM UTC

maxwell86 wrote: post #96

rokizero wrote: post #38

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make se…

As a German citizen, this isn’t nuts. Leaking extremely sensitive user data, like their IP addresses, to third parties, enable them to finger print users. Leaking those to third parties outside the EU, and in particular to companies whose revenue depends on this finger printing, like Google, just to serve a font, it’s the dumbest thing I’ve heard all week. The whole purpose of the GDPR is to discourage this behavior,…

I agree with everything you said except the last paragraph.

100€ was fine in my opinion, because a) it isn't that big of an infraction b) it probably was their first offense and c) this legal ruling is indeed setting some kind of precedence and therefore was unexpected given industry practices. If the ruling stands and other courts follow a similar reasoning I would expect higher fines in the future.