Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

221–230 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#221

Post by somytsu »

mawadev wrote: post #124
HL33tibCe7 wrote: post #103

Unfortunately, GDPR is an insane web of laws and regulations that any non-lawyer has absolutely no hope of understanding.

This is exactly what stops me from hosting websites. I simply have given up trying to keep up with the rules. It is a massive burden if you are not a corporation trying to extract information and just want to host a simple blog from a german server. At some point, private persons and maybe small businesses won't be able to keep up and the web becomes even more centralized.

It is possible to host a blog wihout third party services.

Maybe small businesses should focus on minimal websites and build from that. As you grow, you can more easily affort the costs for lawyers to check if the features you want to build are GDPR compliant.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#222

Post by keewee7 »

Germany is terribly backwards when it comes to IT. It's insane that such a backward country should have that much say on EU regulations.

I'm not kidding. Countries like Denmark and Estonia are light-years ahead of Germany in terms of eGov and mobile payments.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#223

Post by schleck8 »

HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

Wrong. In this case it's illegal because Google Fonts can be served from the origin server as they are downloadable.

The same does not apply to sideside CDNs.

However, I believe NPM CDNs are the same scenario, so I'd start serving packages from the server as well.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#224

Post by bondarchuk »

kawsper wrote: post #190
bondarchuk wrote: post #99

Earlier quoted context omitted.

You could also say that the user is opting in to loading a font from google when he actively sends the request to google. You could also say the user is opting in to storing cookies by accepting the file and writing it to his own disk, and sending the file back when the site asks for it. I think it is too late for these kinds of arguments in the EU though, and maybe with good reason, if it turns out the average citiz…

GDPR requires informed consent.

I know, which is why I said: "and maybe with good reason, if it turns out the average citizen is not actually able to configure these kinds of decisions."

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#226

Post by freemint »

izacus wrote: post #133
maxwell86 wrote: post #96

Earlier quoted context omitted.

As a German citizen, this isn’t nuts. Leaking extremely sensitive user data, like their IP addresses, to third parties, enable them to finger print users. Leaking those to third parties outside the EU, and in particular to companies whose revenue depends on this finger printing, like Google, just to serve a font, it’s the dumbest thing I’ve heard all week. The whole purpose of the GDPR is to discourage this behavior,…

IP Address is far from "extremely sensitive user data". Really.

Giving an IP Address to Google including referrer header is. They can do a lot with this and as long as the Google Font hosting service doesn't give out assurances (they can be sued for for breaking) that this data is not used in any way which would enable Google to track a person.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#227

Post by 7373737373 »

npteljes wrote: post #178
Andrew_nenakhov wrote: post #157

Earlier quoted context omitted.

Browser can be configured not to send this data. If I ask you to jump from the bridge, and you do, how is it my fault that you chose to comply?

So code in frontend would be "asking" in this case, in your opinion? Javascript is executed by default by all major browser deployments.

Yes, definitely. Ad absurdum, browsers could be mandated to have the user opt-in to every single instruction that is executed. It's technically possible, the user has control.

I think it's a slippery slope to imagine/enforce a transfer of agency between the website user and provider, where the latter will try to make the opt-in appear as simple as possible. An ideal opt-in is more than the click of a button, it's an understanding. A button accompanied by a wall of text isn't understanding.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#228

Post by rpadovani »

leobg wrote: post #217
amelius wrote: post #184

Earlier quoted context omitted.

> It is the the user’s browser that initiates a request to Google’s server. A request by the website itself to Google sharing the user’s IP address never actually occurs. Manipulating a system so that it gives up information that wasn't intended to be given away, is called hacking.

When I specify that the font used on my page can be accessed at a particular URL, I’m neither asking you to download it (the font might already be installed on your system), nor am I requesting that, if you do download it, you pass along a “referer” header. I am not only not making your browser do this - I’m not even asking it to do so.

> When I specify that the font used on my page can be accessed at a particular URL

But this is not what you are specifying with Google Fonts (usually). You are saying: "To properly see this page, download this instruction file (CSS) from this other host". It doesn't matter if I have the font already installed, I still ask the CSS file to Google.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#229

Post by Puts »

asadkn wrote: post #116

Curious how useful is an IP address with a simple HTTP get request? As long as a sane Referer-Policy is set, the Referer won't be sent. Sure there's a lot more to browser fingerprinting but with just an HTTP request, all the data that would be known from it is the language and the user agent. Both of which are not unique data points and shared by thousands of other users. No cookies either in this case of Google Font…

Well technically you share a lot more data. IP, browser agent, time (which in combination with IP can tell exactly who used that specific computer) and cookies set on the *.google.com domain.

So it's actually interesting that the court only focused on the IP-address although the ruling would probably have been the same even if they widened the scope.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#230

Post by LudwigNagasena »

ChrisLomont wrote: post #193
amelius wrote: post #184

Earlier quoted context omitted.

> It is the the user’s browser that initiates a request to Google’s server. A request by the website itself to Google sharing the user’s IP address never actually occurs. Manipulating a system so that it gives up information that wasn't intended to be given away, is called hacking.

The system is designed to do it. If you don't want your system operating as it was designed to do don't use it. It's not hacking.

I doubt that WWW was designed with intention to allow that. A bunch of different people with different goals do stuff they want and the result is something that just happens without anyone's intention. And we have legal systems and regulations to clear up such situations.
Post reply on HN