Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

231–240 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#231

Post by elygre »

nightgarden wrote: post #150
rndgermandude wrote: post #48

Earlier quoted context omitted.

There are some important points to mention: * the court explicitly stated that this case was about transferring personal data (the IP) without prior consent. If the user had consented, there would have been no case. * the court explicitly criticized using google, because google a) is known to collect user information and b) google is a US company and the European courts have found the US is lacking in privacy laws. S…

So, soon on top of all the cookie notices that are already there, we are also going to have to consent initially before anything loads to downloading the javascript from 3rd party to manage all the consents? Lol.... Just what the internet needs...

There is also the option of not messing around with personal data. It would get rid of all the cookie notices that are there, as well as not adding new ones.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#232

Post by onli »

sqrt2 wrote: post #172
onli wrote: post #128

Earlier quoted context omitted.

> In fact, since in parallel to the question of your legal basis under GDPR, you also have to comply with the cookie provision from the e-Privacy Directive, where there is no "legitimate interest" exception to the requirement to ask for consent, you will have to ask for consent anyway (as Instagram embeds place cookies). I don't think that's true. The cookie provision is misunderstood when you think you have to ask f…

It is not true that "functional" cookies are generally exempt from the consent requirement. What is concretely exempt are necessary cookies for a service that the user explicitly requested. This is not the case for cookies placed by Instagram embeds. These are the guidelines on consent exemption by the Article 29 Working Party (the European Data Protection Board's predecessor) that explain it: https://ec.europa.eu/ju…

Sorry, but an opinion from 2012 has no chance to be relevant if it disagrees with the current GDPR interpretation I linked to. Note how it explains that the ePrivacy Regulation is not in effect. I do not see how there could be any basis to legislate cookie usage if it is not linked to private data/analytics, if this happens it will not survive the courts I think. I do understand that this cookie consent interpretation is common - one just has to look at those stupid cookie consent forms on private blogs - but it does not follow from real legislation.

However:

> This is not the case for cookies placed by Instagram embeds.

Yeah, I can see how this is complicated and how it fits the topic. It's not a third party cookie for the embed, but for the website it might be, and is it even a functional cookie? I doubt it. I'm not sure how those would be judged and what is a reasonable way to work with embeds. It's only certain that there is not a solution as easy as it was in this case, where self-hosting the fonts was possible.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#233

Post by austhrow743 »

maratc wrote: post #64
7373737373 wrote: post #51

Earlier quoted context omitted.

Yeah, the plaintiff's browser made the request after all, no?

The plaintiff's browser did what the defendant's code ordered it to do. If the defendant's code violated GPDR (which seems to be the court's conclusion) by sending the plaintiff's browser somewhere, it's a defendant's problem, not plaintiff's.

Website have no authority over the browsers accessing them. They can't order. Just state information. "There's a font over here" not "you have to go access this font over here".

That browsers by default tend to follow links to resources automatically doesn't change that. It's still the agent the user has chosen to represent them when talking to the website making the decision not the website.

If a legal body want to make the call that users shouldn't be responsible for choosing what their browsers automatically do or don't do on their behalf that's fine. But it's absurd to do it by making it the website creators problem. It's the browser that's choosing to do things without asking the person it represents for explicit permission. It's the browser sending the information to the third party. Put it on the browsers!

We've got a handful of choices for browsers. They all gratuitously send every bit of information they can get their hands on to every website they can. Just straight up informational security Judas'. And GDPR blames websites? It's crazy to me.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#234

Post by isbvhodnvemrwvn »

progval wrote: post #199
isbvhodnvemrwvn wrote: post #181

Earlier quoted context omitted.

The browsers don't share third-party caches across domains, because it made it easier to leak information about which sites the user has visited.

> The browsers don't share third-party caches across domains Do you have a source for this? I believe(d?) it too, but when re-checking just now, I could not find any.

I couldn't find anything related to Edge.

Safari: https://webkit.org/blog/8613/intelligent-tracking-prevention...

Chrome: https://developers.google.com/web/updates/2020/10/http-cache...

Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1536058

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#235

Post by mrweasel »

HL33tibCe7 wrote: post #195
onli wrote: post #95

Earlier quoted context omitted.

I think there is not. You are not allowed to download the video and host it yourself, that would be a copyright violation. Am I missing a legally valid way?

Okay but let’s say you have permission to host the content — e.g: you actually own the video. Do you still think it’s reasonable that it should be a legal requirement that to embed a video on your web page you must develop your own video delivery infrastructure?

You could just link to YouTube and not embed the video.

I think the important part is that this is an issue, only because companies like have had a surprising hard time not misusing every single bit of information sent their way. The result is that companies have forced governments to step in and now they are overregulating.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#236

Post by verytrivial »

afrcnc wrote: post #207

ok...this is just downright silly and dumb now on the other hand, always host your fonts

I find it hilarious that the entire internet tracking and surveylance industry simply thinks it is entitled to this level of information now.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#237

Post by jannes »

leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

> [...], if not installed on the user’s computer, [...]

This is incorrect. The font is downloaded regardless of whether a font with the same name is installed on the system.

The only exception is when you specify a local() function in @font-face [0], but almost nobody does that.

[0]: https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face#...

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#238

Post by [deleted] »

robin_reala wrote: post #81
brtkdotse wrote: post #56

Earlier quoted context omitted.

Look and learn from Yubico, they don’t show any YouTube embedded videos until you agree to functional cookies: https://www.yubico.com/?lang=sv

There’s an easier way than that: embed from youtube-nocookie.com. Of course that doesn’t necessarily help with the Munich ruling…

[deleted]

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#239

Post by leobg »

brazzy wrote: post #202
leobg wrote: post #164

Earlier quoted context omitted.

This is true. But the request containing that information is being sent by your own computer. It’s bit a “doing” of the website owner.

It really depends. If the website links to a URL that is the same for everyone on every website which uses that font, then without a referrer header (which is up to the browser to send) there is not much tracking info. But if the website uses a URL that is unique for that site, or even for each user, that is absolutely something I'd hold the website owner responsible for.

Of course. Good point. If an individualized URL would be used, it would be another story.

Though I don’t think that Google Fonts URLs contain individualized parameters by default that disclose either the user’s IP address or the site visited. The ruling also does not mention that this is what happened here. All the site user did, from what I can see, is embed a Google Font.

Had the site owner put an automatic JavaScript redirect to Google on his page, he’d be just as liable, according to the logic of this ruling.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#240

Post by yayr »

So what happens if you include e.g. a Wikipedia image or a youtube video? Is that a GDPR violation too? These scenarios also lead to making the users IP available to a third party.

If so, how do we avoid breaking the web while keeping privacy needs in balance?

Post reply on HN