Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

421–430 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#421

Post by kall »

quyse wrote: post #377
HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

What if I host my website on Google Cloud Platform? I guess it should be OK then to use Google Fonts CDN on the website, because it's the same entity, and visitor's IP was already leaked to Google when the HTML page was served. Can't really ask user for consent before loading the HTML page!

You may not serve a website to german visitors from GCP at all, certainly not without getting consent first.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#422

Post by Spoom »

xg15 wrote: post #350
discardable_dan wrote: post #269

Earlier quoted context omitted.

This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c…

> browsers need to immediately stop interpreting these commands, instead providing user prompts for _each offsite load event_ No, why should they? The ruling makes the (pretty realistic) assumption that users are in no position to decide about individual load requests. Therefore, those are the responsibility of the site author. This way to interpret the events seems most consistent with real-world usage. Meanwhile pr…

By this argument, then, should third party requests always be blocked? If the user "is in no position to decide", that means that the only way to avoid potential liability would be to load everything from the same domain, right? No CDNs, no off-site scripts, no off-site embeds, ever. Seems a bit extreme to me.

Thoughts my own, not those of my employer.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#423

Post by bmn__ »

arka2147483647 wrote: post #326
marcus_cemes wrote: post #256

Earlier quoted context omitted.

> the w3c standards define, that browsers execute the commands they receive from the server I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly config…

I think you confuse user, the Human, and user, the Programming Idiom. User, the Human, is not going to be asked weather or not the browser should open every one of the possibly hundreds of references in a web page!! Now, user, the Programming Idiom, might be configured, programed, etc.. to behave differently, but the reality is that is that's not how the modern web works. If the browser is not configured to behave th…

The terminology for these concepts in common use is "user" and "user agent".

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#424

Post by kevincox »

Vespasian wrote: post #21
bArray wrote: post #2

After translating - the violation here is a website included third-party fonts from Google, and the fact that Google would be able to see their IP from the request violates GDPR? Seems as though anybody who uses a CDN or third-party to load _any_ resources will violate GDPR by this measure? Seems like a pretty wide interpretation of this law.

The court explicitly noted that the IP was exfilled to the United States where adequate data protection measures do not exist and that Google in particular is well known for invasive data collection The court also noted that there was an alternative in the form of embedding the fonts directly into the website. I'm not a lawyer, but the reasoning doesn't sound like CDNs are a problem in General, but that one should be…

That has interesting implications for anycast CDNs. In fact do you now need a separate DNS name for europe to be sure that the DNS query doesn't get anycasted to another country ever?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#425

Post by watwut »

iqanq wrote: post #53
randalluk wrote: post #41

Earlier quoted context omitted.

Doesn't this attitude overlook the "agency" of the "User-Agent"?

Isn't regulation precisely the act of acting in behalf of the citizens because they are seen as "too stupid" to know what they are doing?

No. It is so that they don't have deal with developers tricks and misdirections and intentionally misleading uis and so on. It is also so that they are not required to learn tons of obscure and otherwise useless knowledge to function reasonably.

None of that makes them stupid. Just like, when I am in grocery store I can be sure all food there is reasonably safe, even if I don't know anything about them. I am not expected to research them all personally for dangerous substances else "I am stupid for poisoning myself".

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#426

Post by 7373737373 »

ratww wrote: post #407
7373737373 wrote: post #318

Earlier quoted context omitted.

> passing the burden of filtering those requests to the customer doesn't really scale I think it scales better than forcing millions of website providers to engage in the legal fiction that they are an intermediary between the user and all external content providers that are embedded on their page

> all external content providers that are embedded on their page All the embedding is being done by the people building the websites, so yes, they do have full control and therefore full responsibility. Just because I don't perform a crime or violation myself, it doesn't automatically absolve me when I pay or ask someone to commit it. > forcing millions of website providers Millions? There are billions of website vis…

How many of these billions want or are even capable of understanding what they do when they click the "i accept" button? Legal complexities seem even further removed from public understanding than technical ones. This approach seems equally ineffective for achieving what this regulation is intended to achieve, to not just to have the users sign away their rights with a click, but give them an understanding of what they give away. But I'm not sure whether that will ever be possible.

I agree that its a big problem that the big browsers do not act in the interest of their users, and that their vendors are in fact disincentivized to do so. That would be a good reason for antitrust action and public funding, since they should be public goods.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#427

Post by kall »

Treating IP addresses as PII continues go be incredibly tedious and as far as I can tell, they are PII because providers are forced by law to keep those records. Is that correct?

It would be so much better to just reduce and safeguard that information instead of handing it out to any rando with a court order.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#428

Post by marcus_cemes »

ratww wrote: post #393
marcus_cemes wrote: post #319

Earlier quoted context omitted.

This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear. I'm curious to know whether DNS and your IP being in the the header…

> I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing? The IP has to be there for the return TCP packet, so under GDPR this falls under "strictly necessary" information. If someone sniffs you, they now have your PII. They can't do anything with it that is not "strictly necessary" w…

Sorry, I don't mean to play the devil's advocate, this has already gone way off-topic so take what I say with a pinch of salt.

But technically, the IP is not strictly necessary? I can imagine a feasable future where it could be replaced with an anonymised IP from a larger pool generated by your ISP, with TLS for the payload. This could be solved at the internet infrastructure layer, and not required by to be solved by website developers.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#429

Post by dsego »

no_time wrote: post #353
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

>The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. "Your honor, I merely told the gun to strike the firing pin. Without a round chambered in, the gun wouldn't have done anything."

Your honor, I instructed my browser to point a gun at me and it shot me. Surprised Pikachu face.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#430

Post by Merovius »

capableweb wrote: post #114
robin_reala wrote: post #81

Earlier quoted context omitted.

There’s an easier way than that: embed from youtube-nocookie.com. Of course that doesn’t necessarily help with the Munich ruling…

IP information will still be sent to Google, and a notice would have to put up before. Easiest way to deal with this is to self-host the videos. Most people over-estimate how popular their websites are, and for the ones who don't, getting a dedicated instance with unmetered bandwidth is trivial to get and setup for video-hosting.

> Easiest way to deal with this is to self-host the videos.

For most videos, this would be a copyright violation. i.e. there are now two laws which prevent reasonable technological solutions, making it harder for most people to host and produce content - favoring the already heavily advantaged big companies.

Post reply on HN