Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

261–270 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#261

Post by _0w8t »

capableweb wrote: post #114
robin_reala wrote: post #81

Earlier quoted context omitted.

There’s an easier way than that: embed from youtube-nocookie.com. Of course that doesn’t necessarily help with the Munich ruling…

IP information will still be sent to Google, and a notice would have to put up before. Easiest way to deal with this is to self-host the videos. Most people over-estimate how popular their websites are, and for the ones who don't, getting a dedicated instance with unmetered bandwidth is trivial to get and setup for video-hosting.

Unmetered is often means 1 Gbit. With 4K video that means less than 100 streams. It may work, but the moment the video is shared among friends the site can be in trouble.

Plus YouTube handles all re-encoding and adjust the quality based on the speed and device.

It is possible to do it with open-source components, but it requires a server farm and just not feasible using single cheap private server or VPS.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#262

Post by yayr »

brtkdotse wrote: post #56
onli wrote: post #23

Earlier quoted context omitted.

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

Look and learn from Yubico, they don’t show any YouTube embedded videos until you agree to functional cookies: https://www.yubico.com/?lang=sv

This case is about IP address exposure, not cookies. This would still happen. So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure… this could probably be avoided by extending the sites terms.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#263

Post by LudwigNagasena »

loceng wrote: post #220
LudwigNagasena wrote: post #174

Earlier quoted context omitted.

That's just technical details. For all I care the website executes the code on my computer without my volition.

So turn that off or don't use that browser? Where's your personal responsibility here?

Where is my personal responsibility in making sure that the food I buy isn't poisoned and that the producer doesn't use slave labor? Where is my personal responsibility in making sure that my friend will return me a loan I made to him? Of course it is sensible to make basic precautions, but it is also sensible to expect social institutions like the legal system to help.

Our society is immensely complex; it is quite naive to assume that everyone has enough time and power to watch out for things like that and fix them. It is also quite dystopian to think that people should by default treat every stranger and company as adversary.

TL;DR separation of concerns is good

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#264

Post by paulgb »

_0w8t wrote: post #212
paulgb wrote: post #183

Earlier quoted context omitted.

Does this ruling distinguish between “does” and “could”, though? Because any CDN could spy if they wanted. Google fonts has a pretty reasonable privacy policy[1]. I don’t read German, so I wonder if there’s nuance here that I’m missing (like, did they find that Google actually was misusing the data?) https://developers.google.com/fonts/faq#what_does_using_the_...

Google is a US company and the US government can and do ask companies to provide any data on the servers even if it is against the policy Google has written in that document.

That’s no different than a CDN hosted in any other country, though, so it gets back to HL33tibCe7‘s point that this seems it would apply to CDNs.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#265

Post by jstummbillig »

Hnrobert42 wrote: post #191
HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

It’s not a question of what is necessary. It’s a question of transparency and consent. You must gain consent for giving Google personal data for tracking purposes.

But why? Why must you do that to begin with?

ELI5: Why does the EU not just prevent Google from using personal data they receive by law in any way they see fit? Would that not be a lot more effective than requiring the millions of small businesses and small web devs to figure it out on their end?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#266

Post by dgb23 »

maxwell86 wrote: post #96
rokizero wrote: post #38

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make se…

As a German citizen, this isn’t nuts. Leaking extremely sensitive user data, like their IP addresses, to third parties, enable them to finger print users. Leaking those to third parties outside the EU, and in particular to companies whose revenue depends on this finger printing, like Google, just to serve a font, it’s the dumbest thing I’ve heard all week. The whole purpose of the GDPR is to discourage this behavior,…

You have a point and I as a dev will ensure to follow this principle. The issue is that serving fonts and other assets from an external service is pretty much normal practice. This is new ground. The understanding so far was explicit tracking being the issue and not serving static assets. This ruling makes sense but goes way beyond what the consensus was so far.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#267

Post by bondarchuk »

maratc wrote: post #258
bondarchuk wrote: post #203

Earlier quoted context omitted.

But technically, the user itself is sending his own data to the third party, and the original website is merely requesting the user to do so. You could interpret it like this: "To use this website, it's best if you have this font. You can get it from here: https://google.com/fonts/blah ". It's not exactly the same case as a more obvious GDPR violation, where the website would collect information from the user, and th…

> the original website is merely requesting the user to do so ... in a violation of GPDR, because user's informed consent was not received beforehand. > it's exactly what the court is there for I might have been more clear: it hardly matters what you or I could say — what does matter is only what the lawyers say. In this case, I assume that either A. the defendant's lawyers have brought this argument before the court…

At the end of the day, nothing matters, so why discuss anything at all?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#268

Post by tyilo »

leobg wrote: post #187
isbvhodnvemrwvn wrote: post #122

Earlier quoted context omitted.

Using this logic I can send full fingerprinting data as long as I do it from the front-end? I mean courts are not that dumb, it's still the website owner which decides what is done.

I can put “rm -r /user” in my HTML as long as I want. It’s the user’s browser that decides what gets executed. This is a fundamental principle in the architecture of the internet. You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those.

Going further with this argument would all hacking also be ok?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#269

Post by discardable_dan »

arendtio wrote: post #209
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs brow…

This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c0.wp.com, i0.wp.com, s.w.org, ssl.p.jwpcdn.com).

If this ruling is upheld, either (a) browsers need to immediately stop interpreting these commands, instead providing user prompts for _each offsite load event_, or (b) a very large swath of websites are all open to the same legal issue. As a small example, the Aesop wine company site (https://www.aesopwines.com/), made with Squarespace, uses typekit, squarespace, and google CDN loads. They're subject to the same ruling, right? And so on, and so on...

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#270

Post by manmal »

denton-scratch wrote: post #214

I don't know why people use fonts served from Google on their websites. Just serve the fonts from the server the site is on. It's like having javascript libraries served by 3rd parties; it's less robust.

I think it allowed browsers to cache font files across websites. But that might not even work anymore as I understand many browser vendors are moving towards resource isolation.
Post reply on HN