Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

211–220 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#211

Post by ratww »

piaste wrote: post #161
ratww wrote: post #107

Earlier quoted context omitted.

> It could be configured not to. Not in practice. It requires configuration that is non-trivial for most users and might not be available for them in all cases (eg: using a computer in a library). In fact, I can't think of a solution that doesn't require third-party software/hardware/product and some computer expertise (AdBlock? Pi-Hole? VPN? Little Snitch? Hosts File?).

Ublock Origin in advanced mode can be set to block all third-party requests by default. I browse the internet that way, but it's definitely not for everyone.

I also browse the internet this way, but yeah. This solution is not available to people not using their own computers, people using certain browsers that don't have it, or just people that haven't heard of it.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#212

Post by _0w8t »

paulgb wrote: post #183
tomp wrote: post #153

Earlier quoted context omitted.

A CDN that sells your data (or doesn’t otherwise protect it) is more accurately termed “spying network”

Does this ruling distinguish between “does” and “could”, though? Because any CDN could spy if they wanted. Google fonts has a pretty reasonable privacy policy[1]. I don’t read German, so I wonder if there’s nuance here that I’m missing (like, did they find that Google actually was misusing the data?) https://developers.google.com/fonts/faq#what_does_using_the_...

Google is a US company and the US government can and do ask companies to provide any data on the servers even if it is against the policy Google has written in that document.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#213

Post by Vespasian »

asadkn wrote: post #116

Curious how useful is an IP address with a simple HTTP get request? As long as a sane Referer-Policy is set, the Referer won't be sent. Sure there's a lot more to browser fingerprinting but with just an HTTP request, all the data that would be known from it is the language and the user agent. Both of which are not unique data points and shared by thousands of other users. No cookies either in this case of Google Font…

Consider the following scenario:

You are logged in to to google and so are your family members.

You visit YouTube.com from IP X with device (user agent) Y.

Your family member visits YouTube.com from IP X with device Z.

Google Fonts gets a request via the API key of mydomain.de from IP X and device Y.

Google now knows that you visited mydomain.de

Edit: I stand corrected that Google Fonts doesn't use an API key. I suspect they still can correlate the font request with the domain, however I have no proof.

Consider this an example for other services like maps.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#215

Post by loceng »

ChrisLomont wrote: post #193
amelius wrote: post #184

Earlier quoted context omitted.

> It is the the user’s browser that initiates a request to Google’s server. A request by the website itself to Google sharing the user’s IP address never actually occurs. Manipulating a system so that it gives up information that wasn't intended to be given away, is called hacking.

The system is designed to do it. If you don't want your system operating as it was designed to do don't use it. It's not hacking.

And in addition to not being hacking, it's called taking responsibility - probably along with getting out of a coddled, learned helplessness state.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#216

Post by npteljes »

HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

Well, I'd say so yes. It's the same thing that came up when hotlinking was first a major thing[0]. In my opinion, anything but communication with the first party violates expectations. If I visit Imgur, then I expect to deal with Imgur, and not with their myriad of third parties all doing something else that's not directly my business.

People of course don't mind, reality is often like this too.

[0] https://en.wikipedia.org/wiki/Inline_linking#Controversial_u...

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#217

Post by leobg »

amelius wrote: post #184
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

> It is the the user’s browser that initiates a request to Google’s server. A request by the website itself to Google sharing the user’s IP address never actually occurs. Manipulating a system so that it gives up information that wasn't intended to be given away, is called hacking.

When I specify that the font used on my page can be accessed at a particular URL, I’m neither asking you to download it (the font might already be installed on your system), nor am I requesting that, if you do download it, you pass along a “referer” header. I am not only not making your browser do this - I’m not even asking it to do so.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#218

Post by Puts »

account-5 wrote: post #177

I'm torn here. I can see it from both points of view. As a user I don't want any of my data going to third parties at all. As a website owner trying to provide a service to my users I want the best experience for them. This might be linking to third party services that are doing a better job than I could. I only see this going one way. The user will have to agree to the sharing of their data with third parties if the…

Note that GDPR talks about data minimisation - data you should not share more data then necessary. If there are no other way then linking to a third party then that would be just fine. But if there is another way to do it that don't requires you to share someone else data you should do that instead (in this case self host the fonts).

Also consent may not actually help here because the principle of data minimisation applies no matter what legal basis for the processing you use.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#219

Post by Fargren »

bondarchuk wrote: post #99
maratc wrote: post #74

Earlier quoted context omitted.

> It could be configured not to That's an opt-out and GPDR requires an opt-in.

You could also say that the user is opting in to loading a font from google when he actively sends the request to google. You could also say the user is opting in to storing cookies by accepting the file and writing it to his own disk, and sending the file back when the site asks for it. I think it is too late for these kinds of arguments in the EU though, and maybe with good reason, if it turns out the average citiz…

> You could also say that the user is opting in to loading a font from google when he actively sends the request to google.

Consent is not consent unless it's informed consent. If the user was not made aware of the request in a clear way before the request happened, he did not have a choice. If the person (and by person we mean the human being, not their browser) did not make the choice, then he did not consent. There's no "technically" about it, the question is only if the person knew what was happening and was given an opportunity to opt in.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#220

Post by loceng »

LudwigNagasena wrote: post #174
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

That's just technical details. For all I care the website executes the code on my computer without my volition.

So turn that off or don't use that browser? Where's your personal responsibility here?
Post reply on HN