Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

401–410 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#401

Post by marcus_cemes »

ryandrake wrote: post #368
marcus_cemes wrote: post #329

Earlier quoted context omitted.

Yeah, I guess this stands. But HTML is not executable. It has to be parsed, like words in a book, not chemicals in a tube. Who is liable, the person who creates the poison, or the book (encyclopedia) which describes the process (and therefore the person who wrote it/distributes it)? Again, I'm not saying what is right and wrong, but I think this issue is fundamentally much, much more complex than the court may have t…

> Yeah, I guess this stands. But HTML is not executable. It has to be parsed, like words in a book, not chemicals in a tube. Who is liable, the person who creates the poison, or the book (encyclopedia) which describes the process (and therefore the person who wrote it/distributes it)? I know as soon as you typed this, you probably thought "oh crap, what about Python?" so I won't go there. I think the major underlying…

I didn't, actually, but it's a fun thought experiment :)

Python code is instructions that are executed in a very precise manner, they could, in theory, encrypt a hard-drive. You execute the program the same way you execute binary instructions.

HTML is a description of a problem, there are different interpretations, and different solutions, depending on screen-size, etc. You don't always get the same result. Technically, JS could mine crypto, but I don't believe that's illegal (correct me if I'm wrong?), just very inconvienient, and there wasn't any JS involved here. You could make a browser that leaks data due to misinterpretation of the HTML. The problem also lies with the eager-evaluation of HTML, it's difficult to put a disclosure or ask for consent, such as the responsibility clause of most software licenses, without greatly annoying the user...

> makes developers uncomfortable with this court ruling

Guilty. At the end of the day, we need to get stuff done, without creating a private internet infrastructure for our customer. The small guy is at a disadvantage here, not big companies.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#402

Post by jokethrowaway »

ZeroGravitas wrote: post #171
burntoutfire wrote: post #100

Earlier quoted context omitted.

> c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. This is how we arrive at cookie popups and annoying "you're leaving our website" notifications. I posit that perhaps both of these could be a feature of HTTP protocol and the browsers - i.e. a browser could just display a small standard icon in its UI notifyin…

The "annoying" popups is also how you end up with businesses like plausible analytics that provide analytics, but don't require the popup, because they dont store the information that causes the popup to be required. So, working as intended I think.

Have you browsed the internet recently?

We were better off 15 years ago

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#403

Post by ChrisLomont »

LudwigNagasena wrote: post #230
ChrisLomont wrote: post #193

Earlier quoted context omitted.

The system is designed to do it. If you don't want your system operating as it was designed to do don't use it. It's not hacking.

I doubt that WWW was designed with intention to allow that . A bunch of different people with different goals do stuff they want and the result is something that just happens without anyone's intention. And we have legal systems and regulations to clear up such situations.

It was explicitly designed to do that. HTML is explicitly designed to allow content from multiple places; it is designed to do so. Your browser is designed to read that HTML and fetch those resources to render the page. The internet is designed to cache that content. Your browser cache is designed to cache that content so future fetch requests are faster.

There's so many pieces explicitely designed to do this, for exactly this reason, that there is no question as to this being the intended behavior.

Font servers are decades old. CSS added support for it in 1998, replacing earlier less common methods. This is not new or unintended behavior.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#404

Post by phkahler »

onli wrote: post #23
HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

>> This is exactly what happened...

Not quite? Wouldn't the users browser have sent its own IP address to Google? That's different that "forwarding" it, and it may not even be enough for Google to connect the user to that site.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#405

Post by neoromantique »

drstewart wrote: post #346
bruce343434 wrote: post #24

Earlier quoted context omitted.

You just need to have a bit of common sense about what's good for your users and what's not good for them. That copyright example by the way, that applies everywhere.

My common sense would say embedding a link to Google Fonts to make use of caching is possible is good for the user

And because of people like you we are stuck with NoScript and the like

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#406

Post by kevincox »

netizen-936824 wrote: post #185
account-5 wrote: post #177

I'm torn here. I can see it from both points of view. As a user I don't want any of my data going to third parties at all. As a website owner trying to provide a service to my users I want the best experience for them. This might be linking to third party services that are doing a better job than I could. I only see this going one way. The user will have to agree to the sharing of their data with third parties if the…

What's wrong with system fonts This is a serious question, I personally prefer to set my own font for web browsing so why do people feel the need to force fonts on me and load them from google of all places?

I agree! The problem is that most browsers have awful defaults. I'm not sure why this is but it does mean that people end up wanting to change them. However my browser uses beautiful fonts by default and if you specify just serif, sans-serif or monospace. I wish this would be the common case so that we can just respect users font settings instead of picking what we think is the best.

I write an article on this a while back: https://kevincox.ca/2021/06/23/respect-user-fonts/

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#407

Post by ratww »

7373737373 wrote: post #318
ratww wrote: post #249

Earlier quoted context omitted.

Technicalities don't matter. The user never consented to this data being shared with third parties, and there is no simple mechanism for the user to block them that is available to all website users. As other mentioned, GDPR also requires opt-in. There is a case for third-party requests, and considering that some websites make tens and sometimes hundreds (eg Yahoo) of third-party requests, passing the burden of filte…

> passing the burden of filtering those requests to the customer doesn't really scale I think it scales better than forcing millions of website providers to engage in the legal fiction that they are an intermediary between the user and all external content providers that are embedded on their page

> all external content providers that are embedded on their page

All the embedding is being done by the people building the websites, so yes, they do have full control and therefore full responsibility.

Just because I don't perform a crime or violation myself, it doesn't automatically absolve me when I pay or ask someone to commit it.

> forcing millions of website providers

Millions? There are billions of website visitors, and most of those don't have any control or deep knowledge over their tools. There are only 3 significant browser technology suppliers at the moment, and none of them provides the hypothetical tools to users, only third parties, and those tools often break websites.

Website builders, however are significantly more technical and able to control their tech stack. If anything just hire another company. The burden should definitely be on them.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#408

Post by codethief »

HL33tibCe7 wrote: post #166
mola wrote: post #98

Earlier quoted context omitted.

Why do you think google fonts exist? For google to Get visitor IP all over the web without any form of user consent, this is exactly what the gdpr tries to kill.

What value exactly is there in Google seeing that IP X requested font Y, assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?

> assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?

In Firefox 96 network requests to 3rd parties (in this case Google) still seem to include the 1st-party hostname as REFERER header.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#409

Post by verytrivial »

dsego wrote: post #385
verytrivial wrote: post #236

Earlier quoted context omitted.

I find it hilarious that the entire internet tracking and surveylance industry simply thinks it is entitled to this level of information now.

Almost like delivery services industry that are entitled to know your residential address.

"Almost" is doing a lot of work here.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#410

Post by kevincox »

lucian1900 wrote: post #7
perlgeek wrote: post #4

The reasoning behind this judgement is: The services (here: web fonts) could be supplied another way, so exposing the user's IP to google is not strictly necessary, from a technical POV. The user's IP is PII, and exposing it unnecessarily to third party is a GDPR violation. The way this is phrased, the reasoning applies to basically every static resource loaded from a CDN or other third-party website.

It’s “personal data” in GDPR. PII is the US concept and much narrower.

> The services (here: web fonts) could be supplied another way

The problem here is that every service could be provided another way. It seems that the only actual hosting option that doesn't leak a user's IP to a thrird-party is first-party only over Tor. Do we demand that every website is built that way? It turns out that outsourcing actually has a lot of value.

So where do we draw the line? Google Fonts apparently needs to be reimplemented first-party. What about Google Cloud CDN? What about an ISP that sees the user's IP in the packets?

Post reply on HN