Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

171–180 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#171

Post by ZeroGravitas »

burntoutfire wrote: post #100
zinekeller wrote: post #78

Earlier quoted context omitted.

> For example, say I want to embed an instagram post on my website. In that case, you could: a) get a license (your suggestion), b) link but not embed Instagram pages, or c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. And indeed, some websites use c) without any problem, they even integrate it into the cooki…

> c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. This is how we arrive at cookie popups and annoying "you're leaving our website" notifications. I posit that perhaps both of these could be a feature of HTTP protocol and the browsers - i.e. a browser could just display a small standard icon in its UI notifyin…

The "annoying" popups is also how you end up with businesses like plausible analytics that provide analytics, but don't require the popup, because they dont store the information that causes the popup to be required.

So, working as intended I think.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#172

Post by sqrt2 »

onli wrote: post #128
sqrt2 wrote: post #101

Earlier quoted context omitted.

The website tried to rely on legitimate interest as the legal basis for processing the data, and that precisely requires a balancing test between the interests of the website host and the interests of the data subject. If you want to make sure that you're not getting the balancing test wrong, you can always go for the legal basis of last resort: consent. Just ask the user whether you can load content from Instagram a…

> In fact, since in parallel to the question of your legal basis under GDPR, you also have to comply with the cookie provision from the e-Privacy Directive, where there is no "legitimate interest" exception to the requirement to ask for consent, you will have to ask for consent anyway (as Instagram embeds place cookies). I don't think that's true. The cookie provision is misunderstood when you think you have to ask f…

It is not true that "functional" cookies are generally exempt from the consent requirement. What is concretely exempt are necessary cookies for a service that the user explicitly requested. This is not the case for cookies placed by Instagram embeds.

These are the guidelines on consent exemption by the Article 29 Working Party (the European Data Protection Board's predecessor) that explain it: https://ec.europa.eu/justice/article-29/documentation/opinio...

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#173

Post by croes »

brtkdotse wrote: post #17
HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Running a website in Germany seems like a god damned nightmare: https://allaboutberlin.com/guides/abmahnung-creative-commons

Spreading your data across the internet is the real nightmare

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#174

Post by LudwigNagasena »

leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

That's just technical details. For all I care the website executes the code on my computer without my volition.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#175

Post by Mo3 »

leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

Absolutely not surprising. I am originally from Germany and the whole of Bavaria is excruciatingly underdeveloped when it comes to IT.

Outside Munich, it gets even worse as you venture deep into beer county where people who can reformat Windows are admired as the next Linus Torvalds and competition consists of people with varying degrees of beginner-level knowledge competing against each other.

Merkel once said that the internet is a new territory for all of us... I am surprised the court even understood half of this.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#176

Post by maratc »

bondarchuk wrote: post #99
maratc wrote: post #74

Earlier quoted context omitted.

> It could be configured not to That's an opt-out and GPDR requires an opt-in.

You could also say that the user is opting in to loading a font from google when he actively sends the request to google. You could also say the user is opting in to storing cookies by accepting the file and writing it to his own disk, and sending the file back when the site asks for it. I think it is too late for these kinds of arguments in the EU though, and maybe with good reason, if it turns out the average citiz…

It hardly matters in the court of law what you "could also say".

The law is clear: you don't have to send your users' data to third parties, but if you decide to do it, you have to receive their informed consent first. In this case, the defendant chose to send personal data to a third party without receiving their informed consent.

The option of conforming with the law by not sending that data anywhere still stands, as does the option of receiving informed consent beforehand.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#177

Post by account-5 »

I'm torn here. I can see it from both points of view.

As a user I don't want any of my data going to third parties at all.

As a website owner trying to provide a service to my users I want the best experience for them. This might be linking to third party services that are doing a better job than I could.

I only see this going one way. The user will have to agree to the sharing of their data with third parties if they want to view third party content, or want the fonts rendered in a better was. Link NPRs text version when you don't agree.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#178

Post by npteljes »

Andrew_nenakhov wrote: post #157
isbvhodnvemrwvn wrote: post #122

Earlier quoted context omitted.

Using this logic I can send full fingerprinting data as long as I do it from the front-end? I mean courts are not that dumb, it's still the website owner which decides what is done.

Browser can be configured not to send this data. If I ask you to jump from the bridge, and you do, how is it my fault that you chose to comply?

So code in frontend would be "asking" in this case, in your opinion? Javascript is executed by default by all major browser deployments.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#179

Post by hexo »

HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

Yes, it would. Actually so many uses of CDN's are nonsensical. I mean, I literally block those requests and sites just work OK. (For my definition of OK. If I don't see autoloading autoplaying video it's only a big big plus)

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#180

Post by herbstein »

zinekeller wrote: post #78
remus wrote: post #71

Earlier quoted context omitted.

The part I find hard to understand is how you decide whether it is a necessity to load external content. For example, say I want to embed an instagram post on my website. You could argue that I should talk to the person who took the picture and get a license for the image so that I can host i on my own domain rather than loading the content for instagram. In practice this is obviously much, much more cumbersome than…

> For example, say I want to embed an instagram post on my website. In that case, you could: a) get a license (your suggestion), b) link but not embed Instagram pages, or c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. And indeed, some websites use c) without any problem, they even integrate it into the cooki…

Option c is how the Danish BBC-equivalent does it, and I deeply appreciate that kind of care for their users.
Post reply on HN