GDPR penalty for passing on of IP address to Google by using Google Fonts • Hacker News Board

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#301

Post by rpadovani » Sun, Jan 30, 2022, 12:20 PM UTC

rnestler wrote: post #271

denton-scratch wrote: post #214

I don't know why people use fonts served from Google on their websites. Just serve the fonts from the server the site is on. It's like having javascript libraries served by 3rd parties; it's less robust.

I guess one advantage could be to better use browser caches for these things? If you visit multiple websites that include the same fonts or javascript libraries, the browser can reuse the cache for them.

This was the case once upon a time.

Nowadays, cache is partitioned by website (https://developers.google.com/web/updates/2020/10/http-cache...)

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#302

Post by liveoneggs » Sun, Jan 30, 2022, 12:20 PM UTC

dgellow wrote: post #272

brtkdotse wrote: post #36

Earlier quoted context omitted.

I too was pissed about the popups until I realized it the companies throwing up the popups that are to blame. Hosting all your assets by yourself, on your own servers and doing analytics without sending data to a third party is not a terribly tall order.

You don’t even need to host yourself the asset, just setup a reverse proxy that drops personal information and redirect the request to the source (Google, or whatever). It’s a simple Nginx rule.

Google rate limits and then blocks your server ip? oops

Doubling your bandwidth costs vs hosting the woff files? oops

Still forwarding the ip address in the X-Forwarded-For header? oops

Not following the license agreements of font providers? my bad

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#303

Post by huijzer » Sun, Jan 30, 2022, 12:21 PM UTC

Mikeb85 wrote: post #276

leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

So does this mean assets hosted by CDNs are illegal now? Since it doesn't ask the user's permission to direct the browser to another site to download said assets? And what if they're already cached in the browser. Distinction? Seems like laws don't understand how tech works...

> And what if they're already cached in the browser.

It is a common misconception that CDN objects are cached. They are not: https://httptoolkit.tech/blog/public-cdn-risks/

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#304

Post by discardable_dan » Sun, Jan 30, 2022, 12:21 PM UTC

dannyw wrote: post #295

discardable_dan wrote: post #269

Earlier quoted context omitted.

This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c…

Then get Squarespace to stop pinging random third parties on page load. The website owner is paying for Squarespace, why is it loading Google CDN (and Google trackers?)

It's loading fonts. So squarespace needs to host those fonts, fine. But more to the point, it could be argued even the Squarespace CDN is "different" from the actual website, so we need CDN shims that forward local domain requests to the CDNs and return the results. All to hide an IP number for downloading fonts." Moreover, "host it yourself" is easy if you're technically skilled, but very, very difficult if you aren't.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#305

Post by Puts » Sun, Jan 30, 2022, 12:22 PM UTC

c01n wrote: post #275

On the one hand I don't want lawyers, government and politicians to shape cyberspace. But I also like this ruling it seems to set a precedent for users to be able to opt-in to APIs (and probably javascript the obvious next step if this goes on). Client-server interactions should be transparent, this will prevent allot of privacy related issues. It also makes the web more decentralized, getting developers back into a…

This ruling has nothing to do with opt-in or consent. It has to do with the concept of data minimization. According to the GDPR you should only process as much data as necessary and this applies no matter what legal basis (eg consent) you have. So basically the point with GDPR is that you as a user should not even have to care, the company that processes your data is responsible to care for you. And it's actually cool that we see this enforced now.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#306

Post by drakonka » Sun, Jan 30, 2022, 12:22 PM UTC

Reading our layman developer interpretations of the legalities here is very interesting, but that aside this really makes me rethink my own use of Google hosted fonts in my projects. Whether it is the browser responsible for making the request or my website being responsible for asking the browser to make the request, hosting the font myself is a readily available option. From the perspective of respecting users' data, why call out to Google at all when I don't really have to, for _any_ resource where there's a straightforward alternative?

I say this as someone who does use Google Analytics as well (which I am removing). But mostly for me it isn't a case of dropping all third party convenience services, but a case of remembering to be _mindful_ of what I'm doing.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#307

Post by Acinyx » Sun, Jan 30, 2022, 12:22 PM UTC

HL33tibCe7 wrote: post #166

mola wrote: post #98

Earlier quoted context omitted.

Why do you think google fonts exist? For google to Get visitor IP all over the web without any form of user consent, this is exactly what the gdpr tries to kill.

What value exactly is there in Google seeing that IP X requested font Y, assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?

Under the GDPR, an IP address is personally identifiable data, so you can't leak it.

And for someone with masses of extra data like Google it is enough to identify who is doing the browsing, so this isn't some crazy overreach.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#308

Post by ryandrake » Sun, Jan 30, 2022, 12:22 PM UTC

marcus_cemes wrote: post #256

arendtio wrote: post #209

Earlier quoted context omitted.

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs brow…

> the w3c standards define, that browsers execute the commands they receive from the server I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly config…

Try making this argument with compiled code instead of HTML:

"The company included the code to do $BAD_THING in the binary executable, but it was the user's choice to run it, and he could have easily modified the binary to ignore $BAD_THING, but didn't. Therefore, it was the user doing $BAD_THING, not the company."

A lot of people in this discussion are splitting hairs here, trying to blame the user or the browser. The technical details of what a browser does are less important than the end effect: Fundamentally, the web developer added "stuff" to the HTML, knowing that this "stuff" will cause most browsers in the field to access these fonts on another computer. The fact that the end user could technically block it, doesn't change the developer's intent.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#309

Post by benmmurphy » Sun, Jan 30, 2022, 12:22 PM UTC

HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

The plaintiff’s IP address was also leaked to every intermediate router and potentially to the DNS server(s) that resolved the IP address.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#310

Post by ratww » Sun, Jan 30, 2022, 12:22 PM UTC

7373737373 wrote: post #129

maratc wrote: post #102

Earlier quoted context omitted.

> not forced to follow the instructions Again, you're talking about an opt-out. GPDR (the law) requires an opt-in.

I don't think forcing each and every single website provider to implement their own consent forms is the right approach to regulating this. User agents should have the ability to convey and enforce privacy preferences on behalf of the user, and website providers should be legally required to comply with these if possible (or refuse service if not). But requiring ever more complex, explicit and custom opt-in consent f…

Consent forms are not required, just host the font. They are also way more expensive and complicated to implement than self-hosting fonts. Asking for consent over usage of third-party fonts borders on pettiness from the website owner.

> User agents should have the ability to convey and enforce privacy preferences on behalf of the user, and website providers should be legally required to comply with these if possible (or refuse service if not).

The burden of respecting privacy choices in every single other case (data in the backend, data shared with partner, paper data) is already with the website. Every non-privacy-respecting implementation in the frontend is made by website owners.

Keep in mind that sometimes websites don't work with blocking other stuff, or are more difficult to use when blocking fonts (Google Material). So this is not even a practical suggestion.