Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

341–350 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#341

Post by aembleton »

mrweasel wrote: post #235
HL33tibCe7 wrote: post #195

Earlier quoted context omitted.

Okay but let’s say you have permission to host the content — e.g: you actually own the video. Do you still think it’s reasonable that it should be a legal requirement that to embed a video on your web page you must develop your own video delivery infrastructure?

You could just link to YouTube and not embed the video. I think the important part is that this is an issue, only because companies like have had a surprising hard time not misusing every single bit of information sent their way. The result is that companies have forced governments to step in and now they are overregulating.

But if you link and your browser preloads links to speed up browsing, then your IP address would still be leaked.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#342

Post by 7373737373 »

maratc wrote: post #320
7373737373 wrote: post #277

Earlier quoted context omitted.

There's a difference between data sent to the website provider (and through it, indirectly to third parties), and interactions between the browser and third parties. The linked ruling forces the provider to ask the user for consent for third parties (even though the provider has nothing to do with the interaction!), instead of mandating a direct opt-in interaction between the user (agent) and third parties. Imagine e…

> even though the provider has nothing to do with the interaction I beg your pardon, but in this case "the provider" (website) has directly sent the user's browser to a third party (google fonts) by including an instruction in the code (HTML) that the provider has sent to the user's browser. The browser did not decide to contact google fonts all by itself; it was directed to do so by the provider. Arguing the provide…

I don't think you get the agency argument. Of course the request to the third party provider is causally related to the website sending the instructions. But while that is necessary for it to happen, it is not sufficient. The user agent's execution, on behalf of the user, makes it happen.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#343

Post by Acinyx »

jstummbillig wrote: post #265
Hnrobert42 wrote: post #191

Earlier quoted context omitted.

It’s not a question of what is necessary. It’s a question of transparency and consent. You must gain consent for giving Google personal data for tracking purposes.

But why? Why must you do that to begin with? ELI5: Why does the EU not just prevent Google from using personal data they receive by law in any way they see fit? Would that not be a lot more effective than requiring the millions of small businesses and small web devs to figure it out on their end?

That's the main revenue stream of Google it would pretty much mean Google itself would be forbidden.

The EU gives companies the option and only requires all this hoopla if you want to use the data for something else than the user requested. The "problem" is that Google does want that, as they are an advertising network, so they give web developers access to their tools but tell you that you have to ask the user for consent. That everyone totally forgets those warnings and somehow forgets that Google is an advertising network is on them, just like it is your responsibility what are random dependencies you download using whatever dependency tool you use.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#344

Post by marcus_cemes »

rpadovani wrote: post #313
npteljes wrote: post #196

Earlier quoted context omitted.

>The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. I wouldn't say so. By making use of the Google Fonts service, the website owner set up a scenario where the browser would then share the user's IP with Google. That's the default behavior of most browser setups. It's as good as sharing with Google directly, no? I feel like the scenar…

> Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame? Well said. Law is not a programming language, the fact that the website didn't _technically_ share the IP, but did it through the browser, is not relevant.

I agree, but the definition of the law can also be interpreted many different ways, until it's clarified, I guess. This seems to me like a very grey area.

There was no trap, in my opinion, document clearly specifies that an additional resource, here a font, will help the website look as intended by the designer. It's visible and its effects are well known (it's part of a well understood specification) and can be blocked. Websites have a responsibility, absolutely, but this is just feels like going too far...

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#345

Post by YXNjaGVyZWdlbgo »

onli wrote: post #250
HL33tibCe7 wrote: post #195

Earlier quoted context omitted.

Okay but let’s say you have permission to host the content — e.g: you actually own the video. Do you still think it’s reasonable that it should be a legal requirement that to embed a video on your web page you must develop your own video delivery infrastructure?

Well, it depends. If it's a short video that fits into your available traffic that you can just self-host with a video tag, why shouldn't you take that option? If it would be a huge burden like where you really would have to develop infrastructure despite that not being in your budget nor competence, then of course not. I already agreed in a comment above that these questions wrongly answered by a pure privacy maximi…

https://github.com/heiseonline/embetty

maybe just use software to fix the problem instead of spreading FUD. HuGe DaNgEr

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#346

Post by drstewart »

bruce343434 wrote: post #24
brtkdotse wrote: post #17

Earlier quoted context omitted.

Running a website in Germany seems like a god damned nightmare: https://allaboutberlin.com/guides/abmahnung-creative-commons

You just need to have a bit of common sense about what's good for your users and what's not good for them. That copyright example by the way, that applies everywhere.

My common sense would say embedding a link to Google Fonts to make use of caching is possible is good for the user

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#347

Post by Isinlor »

marcus_cemes wrote: post #319
npteljes wrote: post #196

Earlier quoted context omitted.

>The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. I wouldn't say so. By making use of the Google Fonts service, the website owner set up a scenario where the browser would then share the user's IP with Google. That's the default behavior of most browser setups. It's as good as sharing with Google directly, no? I feel like the scenar…

This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear. I'm curious to know whether DNS and your IP being in the the header…

This ruling will 100% be upheld in the higher courts.

The website is arguing that they have a legitimate interest in downloading fonts from Google in client browser, but as the court correctly states the website can provide these fonts directly. There is no reason to infringe on the user privacy, so there is no legitimate interest. And therefore use of Google fonts was without a legal basis.

BTW - The website could have used a different legal basis out of 6 available, like consent. See: https://gdpr-info.eu/art-6-gdpr/

> I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing?

Unless there is another way to achieve the same purpose there is a legitimate interest in processing that data for the purposes expected by the client i.e. providing internet service.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#348

Post by dave333 »

oblio wrote: post #170
dave333 wrote: post #158

So would other Google resources like running Adsense ads also reveal IP addr or other private info? I think Google allows users to opt out of being tracked?

GDPR works the other way around. By default it should be >, not >. You don't get to track me and then force me to tell you "don't track me", you should do nothing by default and ask me "may I track you?". Companies don't do that because opt-out is sneaky and it means they can track, say, 95% of users. With out-in, they get to track maybe 80% of users if they're allowed to use dark patterns (where they hide stuff or l…

But a site owner running Adsense won't get sued like the site owner running Google fonts did?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#349

Post by bouke »

marcus_cemes wrote: post #319
npteljes wrote: post #196

Earlier quoted context omitted.

>The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. I wouldn't say so. By making use of the Google Fonts service, the website owner set up a scenario where the browser would then share the user's IP with Google. That's the default behavior of most browser setups. It's as good as sharing with Google directly, no? I feel like the scenar…

This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear. I'm curious to know whether DNS and your IP being in the the header…

That we’ve been doing a certain thing in the past, is no excuse to allow it to continue going forward. It is a good that we are challenging practices that we have taken for granted and validate whether we want such practices to continue.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#350

Post by xg15 »

discardable_dan wrote: post #269
arendtio wrote: post #209

Earlier quoted context omitted.

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs brow…

This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c…

> browsers need to immediately stop interpreting these commands, instead providing user prompts for _each offsite load event_

No, why should they? The ruling makes the (pretty realistic) assumption that users are in no position to decide about individual load requests. Therefore, those are the responsibility of the site author.

This way to interpret the events seems most consistent with real-world usage. Meanwhile pretending the user is responsible to vet any individual network requests seems like a legal fiction - except there is no reason why it should be applied.

Post reply on HN