Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

281–290 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#281

Post by maratc »

bondarchuk wrote: post #251
Fargren wrote: post #219

Earlier quoted context omitted.

> You could also say that the user is opting in to loading a font from google when he actively sends the request to google. Consent is not consent unless it's informed consent. If the user was not made aware of the request in a clear way before the request happened, he did not have a choice. If the person (and by person we mean the human being, not their browser) did not make the choice, then he did not consent. Ther…

So it is the responsibility of the website owner, to make sure that the user is informed about how his own browser works. Couldn't you make a case for shifting this responsibility to e.g. the browser vendor or the regulating bodies who decide on web standards?

No.

The responsibility of the website owner is not to send users' personal data to third parties, OR to receive their users' informed consent to such sending BEFORE that sending occurs.

That's the law. It's enforced by courts.

Web standards aren't law. They aren't enforced. You can't sue anyone in W3C court for using non-standard CSS or forgetting to close a `` with a ``.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#282

Post by foxfluff »

ChrisKnott wrote: post #50
noja wrote: post #33

Earlier quoted context omitted.

Seems pretty simple to me. I visit not-google.com, then don't load anything from elsewhere without being asked first. It's not too dissimilar to app-level permissions.

The counterargument to this is that you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML. This ruling could easily get overturned.

By the same token, if you run a binary executable, you are knowingly using a piece of software that has, and has always had, the default behavior of autoloading any dynamic libraries, running any unprivileged machine instructions, making any unprivileged system calls, and having access to all the appropriately mapped memory it might find or obtain.

So you could conclude that my program can do whatever it wants within those constraints, and it's your problem as a user if it does something you don't like.

But I don't think it is fair to expect normal people to analyze a program for malicious behavior before running it. And I don't see how it is relevant whether that program is a compiled binary or a spaghetti blob of html, css, javascript, and web assembly. Also it is not clear that such analysis is permitted by the draconian copyright laws.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#283

Post by Mikeb85 »

Mo3 wrote: post #175
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

Absolutely not surprising. I am originally from Germany and the whole of Bavaria is excruciatingly underdeveloped when it comes to IT. Outside Munich, it gets even worse as you venture deep into beer county where people who can reformat Windows are admired as the next Linus Torvalds and competition consists of people with varying degrees of beginner-level knowledge competing against each other. Merkel once said that…

Lol was trying to check in for a flight using Lufthansa's website today; just hangs and doesn't do anything after you enter all the forms...

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#284

Post by dgellow »

HL33tibCe7 wrote: post #154
ianpurton wrote: post #19

Hopefully we won't see popups like "This site will forward your IP address to Google is that OK?", because I'm already beyond bored with "This site uses cookies do you accept?".

Non-technical users that I’ve seen interacting with these prompts literally just look for the button with the most prominent colour and click it. Frankly, I’ve even found myself doing this without thinking on occasion. The prompts are beyond useless.

For years I was going in the list of vendors and disabling everything. Now I became so bored by these prompts I decided to instead just accept everything and clean my cookies every week. I’m less frustrated this way, and still feel I have control over my privacy.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#285

Post by rpadovani »

Andrew_nenakhov wrote: post #189
germanier wrote: post #182

Earlier quoted context omitted.

Depending on the circumstances, telling people to jump from the bridge can be a crime.

Ok, don't jump from a bridge. Take off your clothes, and go to your neighbors, I'm asking you right now. Are you going to comply?

You know that in many countries, encouraging or assisting illegal activity is a crime in itself, right?

UK:https://en.wikipedia.org/wiki/Encouraging_or_assisting_a_cri... Germany (given we are talking about a German court): https://de.wikipedia.org/wiki/Anstiftung_(Deutschland)

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#286

Post by liveoneggs »

hexo wrote: post #179
HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

Yes, it would. Actually so many uses of CDN's are nonsensical. I mean, I literally block those requests and sites just work OK. (For my definition of OK. If I don't see autoloading autoplaying video it's only a big big plus)

that's not what a cdn is for or does

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#288

Post by sqrt2 »

onli wrote: post #232
sqrt2 wrote: post #172

Earlier quoted context omitted.

It is not true that "functional" cookies are generally exempt from the consent requirement. What is concretely exempt are necessary cookies for a service that the user explicitly requested. This is not the case for cookies placed by Instagram embeds. These are the guidelines on consent exemption by the Article 29 Working Party (the European Data Protection Board's predecessor) that explain it: https://ec.europa.eu/ju…

Sorry, but an opinion from 2012 has no chance to be relevant if it disagrees with the current GDPR interpretation I linked to. Note how it explains that the ePrivacy Regulation is not in effect. I do not see how there could be any basis to legislate cookie usage if it is not linked to private data/analytics, if this happens it will not survive the courts I think. I do understand that this cookie consent interpretatio…

You're making the mistake of thinking that the cookie consent requirements are somehow a consequence of GDPR. The cookie consent requirements exist separately from and additionally to GDPR as a consequence of the e-Privacy Directive. What GDPR changed in regard to cookie consent is what exactly constitutes "consent", as it updated the Data Protection Directive in that regard, but it did not change when consent for cookies is required.

Other than court judgments, the Article 29 Working Party opinion is the most authoritative opinion you will get on the interpretation of the e-Privacy Directive, which is the "real legislation" that you need to look at.

edit: Nobody claims that the e-Privacy Regulation is in effect, by the way -- of course it isn't, it hasn't even been passed. The cookie consent clause of the e-Privacy Directive is however in effect, and has been since 2009.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#289

Post by magicalist »

Vespasian wrote: post #213
asadkn wrote: post #116

Curious how useful is an IP address with a simple HTTP get request? As long as a sane Referer-Policy is set, the Referer won't be sent. Sure there's a lot more to browser fingerprinting but with just an HTTP request, all the data that would be known from it is the language and the user agent. Both of which are not unique data points and shared by thousands of other users. No cookies either in this case of Google Font…

Consider the following scenario: You are logged in to to google and so are your family members. You visit YouTube.com from IP X with device (user agent) Y. Your family member visits YouTube.com from IP X with device Z. Google Fonts gets a request via the API key of mydomain.de from IP X and device Y. Google now knows that you visited mydomain.de Edit: I stand corrected that Google Fonts doesn't use an API key. I susp…

Google fonts doesn't have an API key.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#290

Post by Puts »

csomar wrote: post #278

I don't understand German but understand HTML/HTTP. Technically, you only get HTML from the website you visited. Then, YOUR browser, requests more data based on that HTML. So technically, it is your browser who requested the font and as a result leaked the IP address. Am I getting this correctly or not?

You would not have made that request in the first place unless that company did the request in the background for you.
Post reply on HN