Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

311–320 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#311

Post by jstummbillig »

Vespasian wrote: post #293
jstummbillig wrote: post #194

Earlier quoted context omitted.

> and this can then be used for advertising purposes. Can it? Is this within the range what Google is allowed to do in the EU right now? Because, if that is the case and we also wanted to stop that, wouldn't it be a lot more reasonable to just... forbid Google from doing that, instead of slapping every confused wordpress hack in the EU with a fine?

Google cannot escape the US government agencies (CLOUD act) etc. It doesn't matter what the promise. They could sell their software stack to an independent European partner over whom they don't have any control and who doesn't transmit data back to the US.

If that was true, how does Google work within China?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#312

Post by Jyaif »

Puts wrote: post #218
account-5 wrote: post #177

I'm torn here. I can see it from both points of view. As a user I don't want any of my data going to third parties at all. As a website owner trying to provide a service to my users I want the best experience for them. This might be linking to third party services that are doing a better job than I could. I only see this going one way. The user will have to agree to the sharing of their data with third parties if the…

Note that GDPR talks about data minimisation - data you should not share more data then necessary. If there are no other way then linking to a third party then that would be just fine. But if there is another way to do it that don't requires you to share someone else data you should do that instead (in this case self host the fonts). Also consent may not actually help here because the principle of data minimisation a…

By that logic it sounds like you must use your own servers to host the data, otherwise you are sharing the IP with a cloud provider.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#313

Post by rpadovani »

npteljes wrote: post #196
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

>The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. I wouldn't say so. By making use of the Google Fonts service, the website owner set up a scenario where the browser would then share the user's IP with Google. That's the default behavior of most browser setups. It's as good as sharing with Google directly, no? I feel like the scenar…

> Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame?

Well said. Law is not a programming language, the fact that the website didn't _technically_ share the IP, but did it through the browser, is not relevant.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#314

Post by foxfluff »

johnchristopher wrote: post #9

Wait, what prevents the next court to say that the browser vendor is responsible for the leak ? Per default the browser is not asking the user if it's okay to download fonts from Google (or any resources from any another resources provider) after all.

Why is it not the author of your NIC driver who is responsible for the leak? Per default the driver isn't asking whether to send a packet to Google's IP address.

Here's why: the driver is just doing what it's told to do. The responsible falls on the party who does the telling. If a website tells my browser to load resources from Google, it's not on my cpu or my nic or its driver or kernel or firewall or the browser.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#315

Post by cryptime »

arendtio wrote: post #209
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs brow…

This is called plausible deniability- the site owner knows what he is doing, but does not care. He could have downloaded the font or used a analytic service which does not collect IP address. Great ruling.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#316

Post by magicalist »

Puts wrote: post #229
asadkn wrote: post #116

Curious how useful is an IP address with a simple HTTP get request? As long as a sane Referer-Policy is set, the Referer won't be sent. Sure there's a lot more to browser fingerprinting but with just an HTTP request, all the data that would be known from it is the language and the user agent. Both of which are not unique data points and shared by thousands of other users. No cookies either in this case of Google Font…

Well technically you share a lot more data. IP, browser agent, time (which in combination with IP can tell exactly who used that specific computer) and cookies set on the *.google.com domain. So it's actually interesting that the court only focused on the IP-address although the ruling would probably have been the same even if they widened the scope.

> and cookies set on the *.google.com domain.

The request doesn't include cookies (and they're served from fonts.googleapis.com so wouldn't include google.com cookies).

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#317

Post by Jyaif »

fooblat wrote: post #131
rokizero wrote: post #38

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make se…

It seems pretty reasonable to me. 1. In Germany an IP address is considered PI under GDPR because it is easily associated to a natural person. 2. Google is open about the fact that they log IP address with Google Font request activity, which includes the page you are on. 3. GDPR requires justification by necessity to collect and/or send PI to a 3rd party without consent. 4. No consent was given. 5. It is not necessar…

By that logic you must self-host any landing page, otherwise you are leaking IP addresses to whoever is hosting your website.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#318

Post by 7373737373 »

ratww wrote: post #249
bondarchuk wrote: post #203

Earlier quoted context omitted.

But technically, the user itself is sending his own data to the third party, and the original website is merely requesting the user to do so. You could interpret it like this: "To use this website, it's best if you have this font. You can get it from here: https://google.com/fonts/blah ". It's not exactly the same case as a more obvious GDPR violation, where the website would collect information from the user, and th…

Technicalities don't matter. The user never consented to this data being shared with third parties, and there is no simple mechanism for the user to block them that is available to all website users. As other mentioned, GDPR also requires opt-in. There is a case for third-party requests, and considering that some websites make tens and sometimes hundreds (eg Yahoo) of third-party requests, passing the burden of filte…

> passing the burden of filtering those requests to the customer doesn't really scale

I think it scales better than forcing millions of website providers to engage in the legal fiction that they are an intermediary between the user and all external content providers that are embedded on their page

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#319

Post by marcus_cemes »

npteljes wrote: post #196
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

>The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. I wouldn't say so. By making use of the Google Fonts service, the website owner set up a scenario where the browser would then share the user's IP with Google. That's the default behavior of most browser setups. It's as good as sharing with Google directly, no? I feel like the scenar…

This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear.

I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#320

Post by maratc »

7373737373 wrote: post #277
maratc wrote: post #200

Earlier quoted context omitted.

There are two options to do what's required by the law: either A. not sending users' personal data to third parties; or B. receive informed consent from the users before sending their personal data to third parties. If the option B seems unwanted for some reason (any reason), there is still option A. Implementing a different solution (that breaks the law) has consequences.

There's a difference between data sent to the website provider (and through it, indirectly to third parties), and interactions between the browser and third parties. The linked ruling forces the provider to ask the user for consent for third parties (even though the provider has nothing to do with the interaction!), instead of mandating a direct opt-in interaction between the user (agent) and third parties. Imagine e…

> even though the provider has nothing to do with the interaction

I beg your pardon, but in this case "the provider" (website) has directly sent the user's browser to a third party (google fonts) by including an instruction in the code (HTML) that the provider has sent to the user's browser. The browser did not decide to contact google fonts all by itself; it was directed to do so by the provider. Arguing the provider "has nothing to do with the interaction" looks a bit disingenuous to me.

Post reply on HN