GDPR penalty for passing on of IP address to Google by using Google Fonts • Hacker News Board

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#41

Post by randalluk » Sun, Jan 30, 2022, 11:07 AM UTC

mro_name wrote: post #14

HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

yes. That's a fact. A 3rd party is a 3rd party and a website leaks it's visitors to it. Just don't do it but serve your stuff from your domain.

Doesn't this attitude overlook the "agency" of the "User-Agent"?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#42

Post by Mystlix » Sun, Jan 30, 2022, 11:07 AM UTC

This decision is incredibly coherent with the fact that tracking can be done in many ways other than with cookies. Your residential IP doesn't change that much and Google keeps track of it. Google can track your navigation through websites and associate it to your google account or shadow account just by seeing if you downloaded one of their fonts through said websites. So bravo to the Munich court for actually upholding rules against opt-out third party tracking

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#43

Post by Scarblac » Sun, Jan 30, 2022, 11:07 AM UTC

the_mitsuhiko wrote: post #40

Scarblac wrote: post #28

Earlier quoted context omitted.

A main selling point of using CDNs for commonly used assets (like Google fonts) is that lots of websites use the same URL, so the browser is likely to have the asset in cache already from a previous use on another site. Makes the site faster and uses less bandwidth. I don't think there is a solution right now. Maybe browsers can stop sending these headers to well known CDN domains by default.

Browsers do not share these caches due to privacy concerns. There is no benefit to it being in a central vs your own cdn.

Ah OK, I'm probably years out of date then. I'll look it up.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#44

Post by brtkdotse » Sun, Jan 30, 2022, 11:07 AM UTC

onli wrote: post #31

brtkdotse wrote: post #17

Earlier quoted context omitted.

Running a website in Germany seems like a god damned nightmare: https://allaboutberlin.com/guides/abmahnung-creative-commons

That specific scam does not have to work anymore though. Abmahnungen in Germany are the most stupid and lawyer serving system in the world, but the CC image scam got closed by judges deciding no monetary harm was done. Possible that these lawyers are still trying, but note that the article started 2018.

Interesting, thanks for the update!

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#45

Post by ehnto » Sun, Jan 30, 2022, 11:07 AM UTC

bArray wrote: post #2

After translating - the violation here is a website included third-party fonts from Google, and the fact that Google would be able to see their IP from the request violates GDPR? Seems as though anybody who uses a CDN or third-party to load _any_ resources will violate GDPR by this measure? Seems like a pretty wide interpretation of this law.

> Seems like a pretty wide interpretation of this law.

That was my initial reaction, but I must admit I have since decided that was because it's an inconvenient truth to me. No one visiting mydomain.com should have to assume google.com is going to receive information about them without their prior consent, and there's usually no mechanism for consent prior to loading webfonts or CDN assets.

It is very much in the spirit of the GDPR that all knowledge sharing should have prior consent, and this follows with that.

You can see the industry flailing to compensate for the sudden increase in responsibilities it has been getting recently. It's not a wild west anymore, we should be a mature industry, and mature industries have regulations earned from previous failures to be ethical or safe. That's what I see happening, the industry is getting harder to operate in, but it's just reaping what it sowed.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#46

Post by the_mitsuhiko » Sun, Jan 30, 2022, 11:07 AM UTC

bArray wrote: post #2

After translating - the violation here is a website included third-party fonts from Google, and the fact that Google would be able to see their IP from the request violates GDPR? Seems as though anybody who uses a CDN or third-party to load _any_ resources will violate GDPR by this measure? Seems like a pretty wide interpretation of this law.

It seems like if there were a data processing agreement with Google that they don’t process the IP for web fonts it would be fine too.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#47

Post by Vespasian » Sun, Jan 30, 2022, 11:08 AM UTC

miohtama wrote: post #10

Can you someone translate? Does this mean that hot linking any static media or asset from a third party is against the law unless explicit approval from the user is first received?

If there are different means to host the asset and the hot linking would transfer data out of the EU (in particular to the US and to a giant marketing company) that might be problematic.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#48

Post by rndgermandude » Sun, Jan 30, 2022, 11:08 AM UTC

bArray wrote: post #2

After translating - the violation here is a website included third-party fonts from Google, and the fact that Google would be able to see their IP from the request violates GDPR? Seems as though anybody who uses a CDN or third-party to load _any_ resources will violate GDPR by this measure? Seems like a pretty wide interpretation of this law.

There are some important points to mention:

* the court explicitly stated that this case was about transferring personal data (the IP) without prior consent. If the user had consented, there would have been no case.

* the court explicitly criticized using google, because google a) is known to collect user information and b) google is a US company and the European courts have found the US is lacking in privacy laws. So my reading is that the judgement would not apply if you transferred such data in certain circumstances, e.g. if you transferred such data to provide "essential services" and you have contracts with the data processor about how they can use and store the data that are in accordance with German privacy laws.

* the court further stated that it sees no reason to transfer such personal data, as the website could have easily provided the fonts itself. This seems to be a crucial part of the courts reasoning, as it is a ruling on the plaintiff's claim that this use of google was exempt because it was "necessary" to provide the service.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#49

Post by ZeroGravitas » Sun, Jan 30, 2022, 11:08 AM UTC

tgv wrote: post #26

ZeroGravitas wrote: post #18

Earlier quoted context omitted.

This seems logical and reasonable to me, though it seems others are surprised/appalled. What would a technical solution that respects privacy look like? The website making the call to Google in the background (minus user details) and forwarding the response onward? Why isn't it done that way, it feels like it's the more obvious solution if you're not trying to track users. Early internet was very wary of 'hotlinking'…

> What would a technical solution that respects privacy look like? In case of fonts: hosting it on your domain.

Google Fonts actually provides a couple of extra services, which can't be replicated just by 'hosting' the files.

Not as relevant now, but in the past a big feature was serving the smallest font file to the user based on the browser version they had.

Nowadays, the ability to use a Unicode aware font without sending the whole thing to every user is another feature they offer.

Both feel like things that browser improvements could take care of themselves eventually though and in the meantime libraries running locally could handle.

(For similar services, licencing plays a part, as you may be paying for the font per view or something like that, but that Doesn't apply for Google Fonts)

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#50

Post by ChrisKnott » Sun, Jan 30, 2022, 11:08 AM UTC

noja wrote: post #33

HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Seems pretty simple to me. I visit not-google.com, then don't load anything from elsewhere without being asked first. It's not too dissimilar to app-level permissions.

The counterargument to this is that you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML.

This ruling could easily get overturned.