Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

181–190 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#181

Post by isbvhodnvemrwvn »

mawadev wrote: post #104
rokizero wrote: post #38

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make se…

Exactly. Why would you serve your own copy of the fonts if a previous request to that cdn may have cached them in your browser already? Opt-In goes against the architecture of websites. What's next? A popup for each third party request? It is not feasible and just another stumbling block - like Impressum for private persons and third party cookie consent to host websites in Germany. It makes more sense to fix the iss…

The browsers don't share third-party caches across domains, because it made it easier to leak information about which sites the user has visited.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#182

Post by germanier »

Andrew_nenakhov wrote: post #157
isbvhodnvemrwvn wrote: post #122

Earlier quoted context omitted.

Using this logic I can send full fingerprinting data as long as I do it from the front-end? I mean courts are not that dumb, it's still the website owner which decides what is done.

Browser can be configured not to send this data. If I ask you to jump from the bridge, and you do, how is it my fault that you chose to comply?

Depending on the circumstances, telling people to jump from the bridge can be a crime.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#183

Post by paulgb »

tomp wrote: post #153
HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

A CDN that sells your data (or doesn’t otherwise protect it) is more accurately termed “spying network”

Does this ruling distinguish between “does” and “could”, though? Because any CDN could spy if they wanted. Google fonts has a pretty reasonable privacy policy[1]. I don’t read German, so I wonder if there’s nuance here that I’m missing (like, did they find that Google actually was misusing the data?)

https://developers.google.com/fonts/faq#what_does_using_the_...

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#184

Post by amelius »

leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

> It is the the user’s browser that initiates a request to Google’s server. A request by the website itself to Google sharing the user’s IP address never actually occurs.

Manipulating a system so that it gives up information that wasn't intended to be given away, is called hacking.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#185

Post by netizen-936824 »

account-5 wrote: post #177

I'm torn here. I can see it from both points of view. As a user I don't want any of my data going to third parties at all. As a website owner trying to provide a service to my users I want the best experience for them. This might be linking to third party services that are doing a better job than I could. I only see this going one way. The user will have to agree to the sharing of their data with third parties if the…

What's wrong with system fonts

This is a serious question, I personally prefer to set my own font for web browsing so why do people feel the need to force fonts on me and load them from google of all places?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#186

Post by Puts »

I think this is actually a really interesting ruling because it's based on Article 6 and not Schrems II. The problem is that they are not taking enough steps to share as little data as possible which is a fair point, but it would also be interesting to see if Google Fonts actually is legal in the sense that personal data (IP, browser agent, timestamp) may end up in the US and used for other purposes (tracking) then just delivering a font.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#187

Post by leobg »

isbvhodnvemrwvn wrote: post #122
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

Using this logic I can send full fingerprinting data as long as I do it from the front-end? I mean courts are not that dumb, it's still the website owner which decides what is done.

I can put “rm -r /user” in my HTML as long as I want. It’s the user’s browser that decides what gets executed. This is a fundamental principle in the architecture of the internet. You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#188

Post by isbvhodnvemrwvn »

Scarblac wrote: post #43
the_mitsuhiko wrote: post #40

Earlier quoted context omitted.

Browsers do not share these caches due to privacy concerns. There is no benefit to it being in a central vs your own cdn.

Ah OK, I'm probably years out of date then. I'll look it up.

It was implemented within the last 2 years, with exception of Safari which did it in 2013.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#189

Post by Andrew_nenakhov »

germanier wrote: post #182
Andrew_nenakhov wrote: post #157

Earlier quoted context omitted.

Browser can be configured not to send this data. If I ask you to jump from the bridge, and you do, how is it my fault that you chose to comply?

Depending on the circumstances, telling people to jump from the bridge can be a crime.

Ok, don't jump from a bridge. Take off your clothes, and go to your neighbors, I'm asking you right now. Are you going to comply?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#190

Post by kawsper »

bondarchuk wrote: post #99
maratc wrote: post #74

Earlier quoted context omitted.

> It could be configured not to That's an opt-out and GPDR requires an opt-in.

You could also say that the user is opting in to loading a font from google when he actively sends the request to google. You could also say the user is opting in to storing cookies by accepting the file and writing it to his own disk, and sending the file back when the site asks for it. I think it is too late for these kinds of arguments in the EU though, and maybe with good reason, if it turns out the average citiz…

GDPR requires informed consent.
Post reply on HN