Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

331–340 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#331

Post by gnud »

discardable_dan wrote: post #296
c01n wrote: post #275

On the one hand I don't want lawyers, government and politicians to shape cyberspace. But I also like this ruling it seems to set a precedent for users to be able to opt-in to APIs (and probably javascript the obvious next step if this goes on). Client-server interactions should be transparent, this will prevent allot of privacy related issues. It also makes the web more decentralized, getting developers back into a…

On its face, this appears to be death of the third-party CDN. The largest issue is this means companies will no longer be able to use third-party hosting services like Squarespace which rely on shared (technically third-party) CDNs. A secondary, but similar, issue, is that now all embeds are opt-in: streams, videos, everything must first be clicked on to even load the thumbnail. A third, and less-important, issue is…

Using a third party is not illegal in itself. But you need an agreement with the third party as to how they will store/process any user data they collect.

This is fairly fundamental under GDPR. It's the 'data controller'/'data processor' split.

I suspect (but IANAL of course) that most CDNs would fail here, because the blanket agreements they offer are basically worthless.

But it's easy to imagine a CDN that has a different business model (charges a tiny amount pr. resource stored, for example), and is completely fine under the GDPR.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#332

Post by dathinab »

leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

The technical implementation details don't matter.

What matters is that the IP will be shared with Google as consequence of visiting the site as long as the user didn't take additional actions and without the user having took additional actions which made that happen.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#333

Post by makeitdouble »

ChrisKnott wrote: post #50
noja wrote: post #33

Earlier quoted context omitted.

Seems pretty simple to me. I visit not-google.com, then don't load anything from elsewhere without being asked first. It's not too dissimilar to app-level permissions.

The counterargument to this is that you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML. This ruling could easily get overturned.

The point of GDPR is to bring the responsibility back into the provider’s side.

Instead of blaming the user for not having technical means and personal rules to apply privacy best practices, the site creator has to offer options to review the situation _before_ letting loose all the trackers and third party carnival.

And it makes sense to me. If tomorrow a site decide to get their favicon from microsoft‘s new marketing service, it would be unreasonable to expect the users to know to block that.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#334

Post by Hnrobert42 »

jstummbillig wrote: post #265
Hnrobert42 wrote: post #191

Earlier quoted context omitted.

It’s not a question of what is necessary. It’s a question of transparency and consent. You must gain consent for giving Google personal data for tracking purposes.

But why? Why must you do that to begin with? ELI5: Why does the EU not just prevent Google from using personal data they receive by law in any way they see fit? Would that not be a lot more effective than requiring the millions of small businesses and small web devs to figure it out on their end?

I was not arguing the sanity of the policy. I was merely correcting GP’s interpretation of the ruling. Better for the millions of small businesses to only have to post a list of sub-processors than to have to determine what would be “necessary” in the eyes of the law.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#335

Post by xg15 »

leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

The user's browser is not the user.

By that logic, any and all tracking pixels, javascript, iframes, etc would be regulatory no man's land, because all of those are technically just "intents" the server signals.

Nevertheless, users are seldomly in a position to decide whether or not those intents are followed (and site owners can get quite mad if a user instructed their browser to "decline" such an intent e.g. through an ad blocker). All of that makes it reasonable to treat those intents as commands.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#336

Post by marcus_cemes »

ratww wrote: post #328
marcus_cemes wrote: post #256

Earlier quoted context omitted.

> the w3c standards define, that browsers execute the commands they receive from the server I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly config…

Your post basically amounts to blaming victims of malware and spyware. "Sure your honor, the victim died by carbon monoxide asphyxiation, but it was his choice to inhale the gas, even though it smells the same as normal air"

I'm not trying to put any blame here, we can twist metaphors to support either side of the argument.

I definitely think that websites have a huge responsibility in keeping the user safe, but this feels to me like an over-extension of GDPR that will make websites much more difficult to develop in the future for the layman without a team of layers. It's a font, there was no malicious intent.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#337

Post by foxfluff »

marcus_cemes wrote: post #319
npteljes wrote: post #196

Earlier quoted context omitted.

>The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. I wouldn't say so. By making use of the Google Fonts service, the website owner set up a scenario where the browser would then share the user's IP with Google. That's the default behavior of most browser setups. It's as good as sharing with Google directly, no? I feel like the scenar…

This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear. I'm curious to know whether DNS and your IP being in the the header…

> This ruling will never stand in higher courts imo, because it would break the internet through fear.

It wouldn't break the internet. The internet was fine when the vast majority of sites hosted all their own content and didn't ask your browser to load crap from dozens of domains. It wasn't even that long ago. Honestly I think it was better.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#338

Post by leobg »

hnarn wrote: post #243
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

If you ask me, this argument is what we in Sweden call "satan reading the bible". I think you're fully aware that the practical result, i.e. what happens in reality, is that as the court puts it: > The transfer of the user's IP address in the above-mentioned manner and the associated encroachment on general personal rights Furthermore, the court is correct in stating that: > The use of font services such as Google Fo…

You’re making a good argument here. And you might just be right. You’re saying that website owners should be legal-politically responsible for typical privacy risks incurred by users if they are using popular browsers. And perhaps that is the right way to go.

However, what strikes me is that the court hasn’t even seen this problem at all. Your train of thought - that the request was issued from the user’s browser, but that the site owner was essentially in control because he essentially tricked the user into sharing his information with Google without being asked - is just not being discussed at all.

It might be very well that the end result is just. But then it would be a case of the blind chicken finding a grain.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#339

Post by onli »

sqrt2 wrote: post #288
onli wrote: post #232

Earlier quoted context omitted.

Sorry, but an opinion from 2012 has no chance to be relevant if it disagrees with the current GDPR interpretation I linked to. Note how it explains that the ePrivacy Regulation is not in effect. I do not see how there could be any basis to legislate cookie usage if it is not linked to private data/analytics, if this happens it will not survive the courts I think. I do understand that this cookie consent interpretatio…

You're making the mistake of thinking that the cookie consent requirements are somehow a consequence of GDPR. The cookie consent requirements exist separately from and additionally to GDPR as a consequence of the e-Privacy Directive. What GDPR changed in regard to cookie consent is what exactly constitutes "consent", as it updated the Data Protection Directive in that regard, but it did not change when consent for co…

Also the e-Privacy Directive does exempt strictly necessary cookies from any consent requirements, or am I completely confused now?

Edit: No, I'm not. The GDPR page I linked states the situation that follows both from the GDPR and the e-Privacy Directive. It also fits to what is written in the directive itself.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#340

Post by krono »

discardable_dan wrote: post #304
dannyw wrote: post #295

Earlier quoted context omitted.

Then get Squarespace to stop pinging random third parties on page load. The website owner is paying for Squarespace, why is it loading Google CDN (and Google trackers?)

It's loading fonts. So squarespace needs to host those fonts, fine. But more to the point, it could be argued even the Squarespace CDN is "different" from the actual website, so we need CDN shims that forward local domain requests to the CDNs and return the results. All to hide an IP number for downloading fonts." Moreover, "host it yourself" is easy if you're technically skilled, but very, very difficult if you aren…

Technical skill is kind of a requirement if you want to achieve something that's technical by nature - such as website development or web hosting.

And hosting a font file entails dumping it next to your index.html file and adding some very basic CSS. Not exactly difficult.

Post reply on HN