Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

291–300 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#291

Post by zuzun »

leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

The ruling explicitly says the right owner does not need to take precautions, because such an obligation would restrict the right holder in the exercise of their rights worthy of protection.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#292

Post by yawaworht1978 »

csomar wrote: post #278

I don't understand German but understand HTML/HTTP. Technically, you only get HTML from the website you visited. Then, YOUR browser, requests more data based on that HTML. So technically, it is your browser who requested the font and as a result leaked the IP address. Am I getting this correctly or not?

Kind of, the good thing is, if the user used chrome(good chance), the billing just goes to a different department.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#293

Post by Vespasian »

jstummbillig wrote: post #194
Luc wrote: post #146

Earlier quoted context omitted.

The end result is that the fact that you visited this website is passed to Google, and this can then be used for advertising purposes.

> and this can then be used for advertising purposes. Can it? Is this within the range what Google is allowed to do in the EU right now? Because, if that is the case and we also wanted to stop that, wouldn't it be a lot more reasonable to just... forbid Google from doing that, instead of slapping every confused wordpress hack in the EU with a fine?

Google cannot escape the US government agencies (CLOUD act) etc.

It doesn't matter what the promise.

They could sell their software stack to an independent European partner over whom they don't have any control and who doesn't transmit data back to the US.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#294

Post by Jyaif »

Vespasian wrote: post #213
asadkn wrote: post #116

Curious how useful is an IP address with a simple HTTP get request? As long as a sane Referer-Policy is set, the Referer won't be sent. Sure there's a lot more to browser fingerprinting but with just an HTTP request, all the data that would be known from it is the language and the user agent. Both of which are not unique data points and shared by thousands of other users. No cookies either in this case of Google Font…

Consider the following scenario: You are logged in to to google and so are your family members. You visit YouTube.com from IP X with device (user agent) Y. Your family member visits YouTube.com from IP X with device Z. Google Fonts gets a request via the API key of mydomain.de from IP X and device Y. Google now knows that you visited mydomain.de Edit: I stand corrected that Google Fonts doesn't use an API key. I susp…

There is not "API key" needed to request a font from Google Font...

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#295

Post by dannyw »

discardable_dan wrote: post #269
arendtio wrote: post #209

Earlier quoted context omitted.

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs brow…

This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c…

Then get Squarespace to stop pinging random third parties on page load. The website owner is paying for Squarespace, why is it loading Google CDN (and Google trackers?)

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#296

Post by discardable_dan »

c01n wrote: post #275

On the one hand I don't want lawyers, government and politicians to shape cyberspace. But I also like this ruling it seems to set a precedent for users to be able to opt-in to APIs (and probably javascript the obvious next step if this goes on). Client-server interactions should be transparent, this will prevent allot of privacy related issues. It also makes the web more decentralized, getting developers back into a…

On its face, this appears to be death of the third-party CDN. The largest issue is this means companies will no longer be able to use third-party hosting services like Squarespace which rely on shared (technically third-party) CDNs.

A secondary, but similar, issue, is that now all embeds are opt-in: streams, videos, everything must first be clicked on to even load the thumbnail.

A third, and less-important, issue is that advertising providers are basically over: the website, on load, can't query the third-party ad service to figure out what ad to display. Which I'm fine with, abstractly, but it's also a very large revenue issue.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#297

Post by rpadovani »

csomar wrote: post #278

I don't understand German but understand HTML/HTTP. Technically, you only get HTML from the website you visited. Then, YOUR browser, requests more data based on that HTML. So technically, it is your browser who requested the font and as a result leaked the IP address. Am I getting this correctly or not?

Technically, yes, but legislation is not code, and many other things have to be considered.

I cannot sign that I will sell my firstborn, but _technically_ I've read, understood, and accepted a contract

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#298

Post by anilakar »

oblio wrote: post #204
HL33tibCe7 wrote: post #103

Unfortunately, GDPR is an insane web of laws and regulations that any non-lawyer has absolutely no hope of understanding.

https://gdpr.eu/compliance/ The whole thing, including guides, is much shorter than the spec for HTML: https://html.spec.whatwg.org/multipage/ Probably clearer, too. And just like for specs there are even better third party doc sites you can use: https://gdpr-info.eu/ Dry reads, but it's not like RFCs are heart wrenching novels either :-D

It always puzzles me how people making six figures a year for translating real-life requirements to technical ones suddenly throw a tantrum when said requirements involve law.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#299

Post by leobg »

npteljes wrote: post #178
Andrew_nenakhov wrote: post #157

Earlier quoted context omitted.

Browser can be configured not to send this data. If I ask you to jump from the bridge, and you do, how is it my fault that you chose to comply?

So code in frontend would be "asking" in this case, in your opinion? Javascript is executed by default by all major browser deployments.

The court did not even see this issue, i.e. the distinction between issuing a suggestion or directive vs. actually executing the request directly. The court, in fact, states that the was the website itself that did the sharing. The ruling suffers from unsound reasoning.

It could be, however, that the website owner never brought up these arguments. The court does not have to do its own investigation. This is called the “maxim of disposition” in German law. Whatever both parties agree on what is true has be treated as true by the court.

So if the claim that the website itself issued the request to Google servers was uncontested, then this ruling is sound, based on the claims brought forth by the parties in this particular case.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#300

Post by janoc »

discardable_dan wrote: post #269
arendtio wrote: post #209

Earlier quoted context omitted.

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs brow…

This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c…

That's true but the mitigation to that is that it would have been OK if the user has consented to this "data processing".

The court isn't ruling this sort of technology en bloc but says in its ruling that it is a problem because the user didn't consent to his personal data (IP address) being given to a third party (Google in this case).

Personally I have mixed feelings about this ruling too because this sort of technical solution is widespread and an army of GDPR vigilantes has the potential to cripple large portions of the web by filing similar suits. Or we won't be able to access websites without having to go through entire multi-page EULAs and consent forms for every and all kinds of similar 3rdparty technology embedding.

Law is a blunt tool and will have unintended consequences, unfortunately :(

Post reply on HN