Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

161–170 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#161

Post by piaste »

ratww wrote: post #107
randalluk wrote: post #70

Earlier quoted context omitted.

The browser is the user-agent, ie. an agent acting on behalf of the user. The browser chose to fetch the font, based on the orinal response. It could be configured not to.

> It could be configured not to. Not in practice. It requires configuration that is non-trivial for most users and might not be available for them in all cases (eg: using a computer in a library). In fact, I can't think of a solution that doesn't require third-party software/hardware/product and some computer expertise (AdBlock? Pi-Hole? VPN? Little Snitch? Hosts File?).

Ublock Origin in advanced mode can be set to block all third-party requests by default. I browse the internet that way, but it's definitely not for everyone.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#162

Post by jstummbillig »

onli wrote: post #23
HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

> Sounds fair to me.

The part that is tricky, is where we offload additional burden of knowledge and responsibility to the website providers.

When it is on the user to figure out whether they are allowed to use a product – and that means in fact any product – that one of the biggest companies in the world is allowed to offer in my country legally, we are in trouble.

Law is complex. Tech is complicated. Most people are not law or tech experts. Getting sound advice on both is expensive, and the trend to increasingly need more of both is worrisome.

This seems neither fair nor reasonable to me. Or particularly democratic.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#163

Post by Ekaros »

Youden wrote: post #80
questiondev wrote: post #68

Earlier quoted context omitted.

that is true but it increases the barrier to entry for those who use google fonts for system resource issues, a lot of people offload because they don’t have the space or money to self host everything one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of servers

A $5 VPS comes with several gigabytes of storage. A standard web font (e.g. Roboto) is ~1MB. Bandwidth is essentially free through CloudFlare. Who doesn't have the space or money to self-host their fonts?

I'm really starting to question why aren't we using fonts that are standard part of browsers? Just have a reasonable sub-set supported by everyone. This would be great climate action too as we would not be wasting energy to redownload them billions if not trillions of time.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#164

Post by leobg »

Luc wrote: post #146
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

The end result is that the fact that you visited this website is passed to Google, and this can then be used for advertising purposes.

This is true. But the request containing that information is being sent by your own computer. It’s bit a “doing” of the website owner.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#165

Post by oblio »

smilespray wrote: post #127
5e92cb50239222b wrote: post #60

Earlier quoted context omitted.

Go to uBlock Origin settings and check every item in the 'annoyances' list. I haven't seen a single cookie banner for a few years now. (This is assuming you're using uBO, because who the hell isn't these days?)

People who have other priorities and interests than technology.

Aka 95% of people out there.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#166

Post by HL33tibCe7 »

mola wrote: post #98
HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Why do you think google fonts exist? For google to Get visitor IP all over the web without any form of user consent, this is exactly what the gdpr tries to kill.

What value exactly is there in Google seeing that IP X requested font Y, assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#167

Post by jeroenhd »

jlokier wrote: post #85
miohtama wrote: post #10

Can you someone translate? Does this mean that hot linking any static media or asset from a third party is against the law unless explicit approval from the user is first received?

No. (Contrary to the sibling comment). If you have agreements in place with third party data processors to protect user privacy, this ruling does not prevent you from hot linking third party assets under that agreement. In effect, the third party acts as part of your infrastructure - just like you may already use a third party hosting provider, cloud database provider, auth provider, logging service, etc. The GDPR co…

The data processing agreement with American companies is probably not enough because the USA doesn't sufficiently protect the users' privacy under the GDPR.

It's only possible to go this route if the country has the approval of the EU through the necessary legal frameworks. That's what Privacy Shield and its predecessor were, and both were deemed insufficient.

Your point about a data processing agreement is true, but I wouldn't rely on AWS/Cloudflare/Google until the EU and USA manage to get this stuff worked out.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#168

Post by redleader55 »

Youden wrote: post #80
questiondev wrote: post #68

Earlier quoted context omitted.

that is true but it increases the barrier to entry for those who use google fonts for system resource issues, a lot of people offload because they don’t have the space or money to self host everything one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of servers

A $5 VPS comes with several gigabytes of storage. A standard web font (e.g. Roboto) is ~1MB. Bandwidth is essentially free through CloudFlare. Who doesn't have the space or money to self-host their fonts?

You're probably liable to pay the plaintiff 100 EUR for leaking their IP address to CloudFlare, as well as paying 100 EUR for leaking it to Azure/AWS/etc. /partially sarcasm

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#169

Post by HL33tibCe7 »

DavideNL wrote: post #160
HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

Well, a font is not equal to "any content". So perhaps the issue is whether it is necessary/sensible, just for providing a simple font, to contact Google/any cdn. Spoiler, of course we all know it is not...

My reading is that nothing in the argument depends on the exact resource in question being a font, so I don’t see why it wouldn’t generalise to other resources.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#170

Post by oblio »

dave333 wrote: post #158

So would other Google resources like running Adsense ads also reveal IP addr or other private info? I think Google allows users to opt out of being tracked?

GDPR works the other way around.

By default it should be >, not >.

You don't get to track me and then force me to tell you "don't track me", you should do nothing by default and ask me "may I track you?".

Companies don't do that because opt-out is sneaky and it means they can track, say, 95% of users.

With out-in, they get to track maybe 80% of users if they're allowed to use dark patterns (where they hide stuff or lie to the user what tracking actually does) and probably less than 10% if they're not allowed to do that.

Post reply on HN