Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

251–260 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#251

Post by bondarchuk »

Fargren wrote: post #219
bondarchuk wrote: post #99

Earlier quoted context omitted.

You could also say that the user is opting in to loading a font from google when he actively sends the request to google. You could also say the user is opting in to storing cookies by accepting the file and writing it to his own disk, and sending the file back when the site asks for it. I think it is too late for these kinds of arguments in the EU though, and maybe with good reason, if it turns out the average citiz…

> You could also say that the user is opting in to loading a font from google when he actively sends the request to google. Consent is not consent unless it's informed consent. If the user was not made aware of the request in a clear way before the request happened, he did not have a choice. If the person (and by person we mean the human being, not their browser) did not make the choice, then he did not consent. Ther…

So it is the responsibility of the website owner, to make sure that the user is informed about how his own browser works. Couldn't you make a case for shifting this responsibility to e.g. the browser vendor or the regulating bodies who decide on web standards?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#252

Post by leobg »

Mo3 wrote: post #175
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

Absolutely not surprising. I am originally from Germany and the whole of Bavaria is excruciatingly underdeveloped when it comes to IT. Outside Munich, it gets even worse as you venture deep into beer county where people who can reformat Windows are admired as the next Linus Torvalds and competition consists of people with varying degrees of beginner-level knowledge competing against each other. Merkel once said that…

Bavaria only? If it had been up to Germany’s buerocrats, the whole internet would not exists.

(Also, no cars. For calling a Ford Model T an “automobile” if it still needs a human driver is misleading to consumers, according to, again, the Munich district court.)

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#254

Post by arendtio »

asadkn wrote: post #116

Curious how useful is an IP address with a simple HTTP get request? As long as a sane Referer-Policy is set, the Referer won't be sent. Sure there's a lot more to browser fingerprinting but with just an HTTP request, all the data that would be known from it is the language and the user agent. Both of which are not unique data points and shared by thousands of other users. No cookies either in this case of Google Font…

So how valuable would it be to you if I would share with you that I spent $20 yesterday on shopping groceries. Probably not so much. But if I would share with you 90% of my spending, you might be able to infer a lot more information about me.

So the question isn't how useful the single request is, but rather what can be done with a lot of these requests. And Google and Facebook are specialists in generating lots of said requests with services like google fonts and like-buttons. And once you realize that the sum of these requests is so valuable that they are considered personal information, you want to protect them with laws.

These laws, like the GDPR, are already in place and this is one of the instances where someone didn't respect such a law. So you can argue now, that this single request isn't so valuable, but isn't that true for every penny of a million dollars?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#255

Post by Hnrobert42 »

losvedir wrote: post #245
brtkdotse wrote: post #36

Earlier quoted context omitted.

I too was pissed about the popups until I realized it the companies throwing up the popups that are to blame. Hosting all your assets by yourself, on your own servers and doing analytics without sending data to a third party is not a terribly tall order.

Actually, your comment made me wonder how far does this go? Where does "third party" end? If I self host on Hertzner or Linode, I imagine their infrastructure logs IP addresses like Google Fonts here. But surely that doesn't require consent. Why not, what's the difference? What if you host with a much sketchier provider? I could see politicians thinking users would want to know if their requests were served by, say,…

For that matter, does the fact that reaching my self hosted site must travel the last mile along a service I paid for (my ISP), mean I must gain consent for using them?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#256

Post by marcus_cemes »

arendtio wrote: post #209
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs brow…

> the w3c standards define, that browsers execute the commands they receive from the server

I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly configure to leak their data, even if spec-adhering behaviour of rendering the webpage should not), to attempt to understand the document and retrieve any other resources that may assist displaying the content correctly.

On the other hand, if one was to send CPU instructions back to the user, I guess it's also there choice to execute them...? Also, it's not possible to determine which resources are for display purposes (fonts), and which are for tracking purposes, the browser will blindly have to retrieve the resource, so websites have a certain responsibility to issue privacy-respecting "instructions".

I'm trying to argue both sides here, I still believe that the user chooses voluntarily to use the browser, visit the webpage and therefore parse the document and initiate any subsequent requests that the document proposes, on the other hand, this is beyond most people, they just want to view a frickin' website, so perhaps the lives of web developers should be made harder to make the lives of the average Joe, who is not an IT expert, a little easier? The architecture of the web is inherently not privacy-respecting, in order to save bandwidth (and for sake of simplicity), we only send fragments and let the browser choose what else it needs, which can be tracked.

It's like walking in a park. You choose to show your face to people, we've come to just accept the fact that by the laws of nature, we cannot prevent other people from seeing our face (unless you use a mask, but then you make them very uneasy), we leak data that others can remember and use to identify us later.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#257

Post by exegete »

leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

Would that logic also work for loading images from other sites and services? I never sent the info to the server myself but told the browser to load the image from that server. Is you argument that it’s client-side code so doesn’t count?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#258

Post by maratc »

bondarchuk wrote: post #203
maratc wrote: post #176

Earlier quoted context omitted.

It hardly matters in the court of law what you "could also say". The law is clear: you don't have to send your users' data to third parties, but if you decide to do it, you have to receive their informed consent first . In this case, the defendant chose to send personal data to a third party without receiving their informed consent. The option of conforming with the law by not sending that data anywhere still stands,…

But technically, the user itself is sending his own data to the third party, and the original website is merely requesting the user to do so. You could interpret it like this: "To use this website, it's best if you have this font. You can get it from here: https://google.com/fonts/blah ". It's not exactly the same case as a more obvious GDPR violation, where the website would collect information from the user, and th…

> the original website is merely requesting the user to do so

... in a violation of GPDR, because user's informed consent was not received beforehand.

> it's exactly what the court is there for

I might have been more clear: it hardly matters what you or I could say — what does matter is only what the lawyers say. In this case, I assume that either A. the defendant's lawyers have brought this argument before the court, and the verdict still was what it was; or B. the defendant's lawyers have failed to bring this argument before the court.

The courts are not there to discuss arguments made in HN comments.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#259

Post by isbvhodnvemrwvn »

loceng wrote: post #220
LudwigNagasena wrote: post #174

Earlier quoted context omitted.

That's just technical details. For all I care the website executes the code on my computer without my volition.

So turn that off or don't use that browser? Where's your personal responsibility here?

The law puts the responsibility on that on the website owner. A user can't be reasonably expected to know these mechanisms in depth.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#260

Post by skinkestek »

leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

It might sound weird and even sounded weird to me at first but I think it reduces to setting a trap for the user:

If

1. we accept that Google knowing we visit certain websites can hurt a user

2. one can get punished for not fencing of a construction website because someone could get hurt

then in my mind this is a very obvious digital equivalent.

Post reply on HN