Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

371–380 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#371

Post by kevincox »

schleck8 wrote: post #223
HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

Wrong. In this case it's illegal because Google Fonts can be served from the origin server as they are downloadable. The same does not apply to sideside CDNs. However, I believe NPM CDNs are the same scenario, so I'd start serving packages from the server as well.

What if my origin server is behind Google Cloud CDN anyways? I mean it is possible for me to run my own datacenter with a direct connection to the users IP but that is obviously unreasonable. As soon as I outsource anything it can now see the users IP.

I guess this particular case seems somewhat reasonable, but where is the line.

Also note that Google Fonts is a lot more that just hosting a download. It has different font files for different browsers for max compatibility as well as font splitting so that you aren't downloading too many glyphs and weights that you don't need for this page. Reimplementing Google Fonts isn't trivial.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#372

Post by maratc »

bondarchuk wrote: post #327
maratc wrote: post #281

Earlier quoted context omitted.

No. The responsibility of the website owner is not to send users' personal data to third parties, OR to receive their users' informed consent to such sending BEFORE that sending occurs. That's the law. It's enforced by courts. Web standards aren't law. They aren't enforced. You can't sue anyone in W3C court for using non-standard CSS or forgetting to close a ` ` with a ` `.

> not to send users' personal data to third parties > receive their users' informed consent to such sending BEFORE that sending occurs. Neither of these are what's actually happening in this case. According to this court's decision, the responsibility of the website owner is not to send instructions to the user's machine that might expose their personal data to third parties after the user's machine follows these ins…

IANAL but

   For the purposes of this Regulation:
   (1)
   ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person

   — Clause 26 of GPDR [0].
Whereas I would point out the directly or indirectly part, the latter of which happened here.

[0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#375

Post by xaedes »

yayr wrote: post #240

So what happens if you include e.g. a Wikipedia image or a youtube video? Is that a GDPR violation too? These scenarios also lead to making the users IP available to a third party. If so, how do we avoid breaking the web while keeping privacy needs in balance?

> how do we avoid breaking the web while keeping privacy needs in balance?

One thing that I feel would help: Massive decentralization. Self-hosting of content and regular synching of the hosted content on the server sides; or tunneling, think duckduckgo.

Self-hosting would make knowledge storage more redundant which protects against (also partial) network blackouts.

On the other hand this knowledge is then harder to control. Removing or redacting content would have to rely on the particular sites to "pull the updates" from the upstream. Copyright will also be problematic: each site would have to make copies of content with the (probably commercial) intent of serving it to consumers.

Still I can't help to think we need more decentralization and self-hosting.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#376

Post by oblio »

dave333 wrote: post #348
oblio wrote: post #170

Earlier quoted context omitted.

GDPR works the other way around. By default it should be >, not >. You don't get to track me and then force me to tell you "don't track me", you should do nothing by default and ask me "may I track you?". Companies don't do that because opt-out is sneaky and it means they can track, say, 95% of users. With out-in, they get to track maybe 80% of users if they're allowed to use dark patterns (where they hide stuff or l…

But a site owner running Adsense won't get sued like the site owner running Google fonts did?

This comment thread provides more insight, I think: https://news.ycombinator.com/reply?id=30135827&goto=item%3Fi...

And regarding lawsuits, small fish websites don't really matter. Look at this case, breaking the law meant a €100 fine.

I feel that reasonable people are super afraid of the GDPR. Just read it, it's shorter than a spec. Talk to a lawyer if you're still super afraid.

It applies to every business but it's targeting huge corporations tracking stuff, not the average Johann.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#377

Post by quyse »

HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

What if I host my website on Google Cloud Platform? I guess it should be OK then to use Google Fonts CDN on the website, because it's the same entity, and visitor's IP was already leaked to Google when the HTML page was served. Can't really ask user for consent before loading the HTML page!

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#378

Post by leobg »

gatgeagent wrote: post #280
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

Which is the same thing with cookies, you just set some string in a HTTP header, if the browser actually honors that is up to user (in the way what browser he installs and how the user configures it).

Exactly. Your browser preferences are your cookie settings.

The whole business of littering the web with cookie consent forms is as far from a sensible technical solution to the problem as can be imagined. The people who invented the web and who designed browsers have had at least the aspiration to build a system that’s going to work as a whole. Courts and lawmakers, in the other hand, have no such vision.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#379

Post by ratww »

marcus_cemes wrote: post #336
ratww wrote: post #328

Earlier quoted context omitted.

Your post basically amounts to blaming victims of malware and spyware. "Sure your honor, the victim died by carbon monoxide asphyxiation, but it was his choice to inhale the gas, even though it smells the same as normal air"

I'm not trying to put any blame here, we can twist metaphors to support either side of the argument. I definitely think that websites have a huge responsibility in keeping the user safe, but this feels to me like an over-extension of GDPR that will make websites much more difficult to develop in the future for the layman without a team of layers. It's a font, there was no malicious intent.

But I am trying to put blame: people who wrote the malware/spyware code are to blame. Similarly to people who write website code that leaks user personal information. The choice to embed third-party code was made by them.

It is nowhere near reasonable to ask a common user to protect themselves from such things: they might not have the technical expertise. They might not be using their own computer (library, etc). The browser doesn't provide enough tools for it and requires third-party solutions. Third-party solutions can either cost money (Little Snitch), additional hardware (Pi-Hole), are not available in all browsers (uBlock Origin due to its interface) or require technical knowledge (other ad-blockers that use lists).

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#380

Post by elevader »

discardable_dan wrote: post #269
arendtio wrote: post #209

Earlier quoted context omitted.

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs brow…

This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c…

There is an important point to this ruling that shouldn't be omitted:

> Der Einsatz von Schriftartendiensten wie Google Fonts kann nicht auf Art. 6 Abs. 1 S.1 lit. f DSGVO gestützt werden, da der Einsatz der Schriftarten auch möglich ist, ohne dass eine Verbindung von Besuchern zu Google Servern hergestellt werden muss.

To roughly translate: One can use Google Fonts without forcing users to make a request to google servers (by downloading the fonts and serving them locally) so this doesn't fall under GDPR (which allows sharing/using user data if it is necessary for functionality).

Which would most likely include CDNs but a point could be made for things like youtube and twitch where that isn't really possible/feasible.

Edit: One addition to the "necessary" part: Necessary for what the USER wants to do when visiting your site. Might be arguing semantics but this is law after all, which is all about semantics

Post reply on HN