Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

411–420 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#411

Post by marcus_cemes »

Isinlor wrote: post #347
marcus_cemes wrote: post #319

Earlier quoted context omitted.

This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear. I'm curious to know whether DNS and your IP being in the the header…

This ruling will 100% be upheld in the higher courts. The website is arguing that they have a legitimate interest in downloading fonts from Google in client browser, but as the court correctly states the website can provide these fonts directly. There is no reason to infringe on the user privacy, so there is no legitimate interest. And therefore use of Google fonts was without a legal basis. BTW - The website could h…

I'm not a layer (web dev in my spare time), but how far does "provide more directly" go? A private ISP? There's no limit, only what seems to be considered by the courts as "reasonable". Then again, that is how law is interpreted most of the time, no?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#412

Post by cryptime »

dgb23 wrote: post #266
maxwell86 wrote: post #96

Earlier quoted context omitted.

As a German citizen, this isn’t nuts. Leaking extremely sensitive user data, like their IP addresses, to third parties, enable them to finger print users. Leaking those to third parties outside the EU, and in particular to companies whose revenue depends on this finger printing, like Google, just to serve a font, it’s the dumbest thing I’ve heard all week. The whole purpose of the GDPR is to discourage this behavior,…

You have a point and I as a dev will ensure to follow this principle. The issue is that serving fonts and other assets from an external service is pretty much normal practice. This is new ground. The understanding so far was explicit tracking being the issue and not serving static assets. This ruling makes sense but goes way beyond what the consensus was so far.

Whose “consensus” ? Google or ad techs. That is not acceptable. The right way is GDPR pop up listing the companies you will share user data. With. If the user approves I am sure no court can touch you.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#413

Post by southerntofu »

yayr wrote: post #262
brtkdotse wrote: post #56

Earlier quoted context omitted.

Look and learn from Yubico, they don’t show any YouTube embedded videos until you agree to functional cookies: https://www.yubico.com/?lang=sv

This case is about IP address exposure, not cookies. This would still happen. So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure… this could probably be avoided by extending the sites terms.

> So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure

Yes, and that's a good thing! A web page should only communicate with the server i've reached, there should be zero third-party involved unless i explicitly consent.

That for example tag can use an arbitrary URL is explained by the fact that back in the day storage/bandwidth was expensive. The same is true for video to this day, but i guess it's good that heavy-to-load content is click-to-play.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#414

Post by kall »

kevincox wrote: post #363
HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

How does this not reduce to hitting any server not owned by you is leaking your IP address? If I host my website behind Google Cloud CDN they have logs of the visitors IP. If I host my site on S3 they log the IP. Does this mean that a visitor must insteract only with services that I own until I can get concent to use "unnecessary" third party services? I think it is pretty significant if "necessary" is reduced to "co…

That‘s what it reduces to, yes, and german courts seem set on actually creating precedents [0] for that dreadful situation.

[0] https://www.taylorwessing.com/en/insights-and-events/insight...

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#415

Post by southerntofu »

phkahler wrote: post #404
onli wrote: post #23

Earlier quoted context omitted.

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

>> This is exactly what happened... Not quite? Wouldn't the users browser have sent its own IP address to Google? That's different that "forwarding" it, and it may not even be enough for Google to connect the user to that site.

Yes, but the website ordered your browser to contact Google without informing you, for no obvious purpose. That's not exactly how consent works.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#416

Post by charcircuit »

luplex wrote: post #390
discardable_dan wrote: post #269

Earlier quoted context omitted.

This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c…

ianal, but I think CDNs would not be affected by the ruling, since they serve an important function. Google Fonts was deemed illegal here since it's not necessary and you can easily provide a font in a privacy-preserving way.

Google Fonts is a CDN. The *C*ontent they *D*eliver are fonts.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#417

Post by akvadrako »

rokizero wrote: post #38

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make se…

Informing them is probably not enough – you would need explicit consent and a fallback option. The only reasonable option is not to do it or maybe it's possible to get a contract with google regarding processing of personal data.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#418

Post by marcus_cemes »

foxfluff wrote: post #337
marcus_cemes wrote: post #319

Earlier quoted context omitted.

This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear. I'm curious to know whether DNS and your IP being in the the header…

> This ruling will never stand in higher courts imo, because it would break the internet through fear. It wouldn't break the internet. The internet was fine when the vast majority of sites hosted all their own content and didn't ask your browser to load crap from dozens of domains. It wasn't even that long ago. Honestly I think it was better.

But it has since evolved, greatly, in complexity. Just because things were like something once, doesn't make it easy to go back. Hey, I'm all for more privacy, I'd like to go back to how it was before but keep the good parts from today, but this would make it harder for the small guy without some advancements in IT, private CDNs and easier font management. IT is already a nightmare just to keep it from breaking.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#419

Post by kevincox »

xaedes wrote: post #375
yayr wrote: post #240

So what happens if you include e.g. a Wikipedia image or a youtube video? Is that a GDPR violation too? These scenarios also lead to making the users IP available to a third party. If so, how do we avoid breaking the web while keeping privacy needs in balance?

> how do we avoid breaking the web while keeping privacy needs in balance? One thing that I feel would help: Massive decentralization. Self-hosting of content and regular synching of the hosted content on the server sides; or tunneling, think duckduckgo. Self-hosting would make knowledge storage more redundant which protects against (also partial) network blackouts. On the other hand this knowledge is then harder to…

People don't just use third-parties because it is fun. They do it because it reduces cost. If we have to build every service from the ground up as first party is that good economically. Does every website need to build its own CDN now?
Post reply on HN