Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

431–440 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#431

Post by netizen-936824 »

Jyaif wrote: post #312
Puts wrote: post #218

Earlier quoted context omitted.

Note that GDPR talks about data minimisation - data you should not share more data then necessary. If there are no other way then linking to a third party then that would be just fine. But if there is another way to do it that don't requires you to share someone else data you should do that instead (in this case self host the fonts). Also consent may not actually help here because the principle of data minimisation a…

By that logic it sounds like you must use your own servers to host the data, otherwise you are sharing the IP with a cloud provider.

Its only a problem if its a company (and/or) using servers outside of the EU.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#432

Post by quyse »

kall wrote: post #421
quyse wrote: post #377

Earlier quoted context omitted.

What if I host my website on Google Cloud Platform? I guess it should be OK then to use Google Fonts CDN on the website, because it's the same entity, and visitor's IP was already leaked to Google when the HTML page was served. Can't really ask user for consent before loading the HTML page!

You may not serve a website to german visitors from GCP at all, certainly not without getting consent first.

Does it mean Google, AWS, DigitalOcean, Cloudflare, Akamai, and everybody else (except Hetzner) are now outlawed in Germany? Because, as I said, I cannot ask for consent before serving the initial HTML, unless someone develops a magical IP-less protocol for delivering consent. I'm not sure if even Hetzner server is OK, it's still a third party even if Germany-based.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#433

Post by ratww »

marcus_cemes wrote: post #428
ratww wrote: post #393

Earlier quoted context omitted.

> I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing? The IP has to be there for the return TCP packet, so under GDPR this falls under "strictly necessary" information. If someone sniffs you, they now have your PII. They can't do anything with it that is not "strictly necessary" w…

Sorry, I don't mean to play the devil's advocate, this has already gone way off-topic so take what I say with a pinch of salt. But technically, the IP is not strictly necessary? I can imagine a feasable future where it could be replaced with an anonymised IP from a larger pool generated by your ISP, with TLS for the payload. This could be solved at the internet infrastructure layer, and not required by to be solved b…

> I can imagine a feasable future where it could be replaced with an anonymised IP from a larger pool generated by your ISP, with TLS for the payload.

This is already a thing with NAT and Carrier-Grade NAT.

However if the IP + port + time trio, coupled with other information (such as browser, stack, timezone, behavior) can be used to de-anonymise the user, this also instantly becomes PII.

> This could be solved at the internet infrastructure layer, and not required by to be solved by website developers.

It could, but until we get there, website developers will have to deal with it.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#434

Post by ceejayoz »

Andrew_nenakhov wrote: post #362
rpadovani wrote: post #285

Earlier quoted context omitted.

You know that in many countries, encouraging or assisting illegal activity is a crime in itself, right? UK: https://en.wikipedia.org/wiki/Encouraging_or_assisting_a_cri... Germany (given we are talking about a German court): https://de.wikipedia.org/wiki/Anstiftung_(Deutschland)

Stripping and jumping from a bridge is not illegal activity.

Both are illegal in quite a few places. Stripping may violate public nudity laws.

Jumping off bridges is often illegal, as well. For example, Florida: https://www.tcpalm.com/story/news/local/2020/07/06/bridge-ju...

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#435

Post by bryarsdj »

discardable_dan wrote: post #269
arendtio wrote: post #209

Earlier quoted context omitted.

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs brow…

This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c…

But shouldn't the site owner pay for a CDN and host the resources themselves? In which case the CDN wouldn't own the IP information. I think the problem here is that the website author is getting free bandwidth in exchange for their user's IP address, which in the example Google can then use for tracking and other things in exchange.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#436

Post by krono »

dorfsmay wrote: post #398
krono wrote: post #340

Earlier quoted context omitted.

Technical skill is kind of a requirement if you want to achieve something that's technical by nature - such as website development or web hosting. And hosting a font file entails dumping it next to your index.html file and adding some very basic CSS. Not exactly difficult.

And then EVERY site needs to serve the same font? The browser can no longer cache it across sites?

How is that relevant here?

Caching was never mentioned as being a requirement. I'm only giving the most basic solution for achieving compliance with regards to hosting a font file.

Scope creeping, on a Sunday no less... where are we headed

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#437

Post by bryan_w »

Vespasian wrote: post #242
HL33tibCe7 wrote: post #166

Earlier quoted context omitted.

What value exactly is there in Google seeing that IP X requested font Y, assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?

If you are logged in to Google and visited YouTube earlier that day they already know that you are behind IP X with device Z and use that information later on by connecting it with the font API key of mydomain.de Remember that your user agent is sent as well.

Pretty sure the font URL is a static link that doesn't require an "API key"

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#438

Post by Merovius »

I'm confused about the text. It is not obvious, what the defendant actually did.

The assumption from most people seem to be that they used a `` tag or the like, with a Google URL. But the text does not imply that. On the contrary, it repeatedly uses the word "weitergabe" and "weiterleitung" ("forwarding"), which is just not accurate for this process - it seems to imply that the defendant actively made a connection to Google and sending the IP over it.

Of course, this might just be an artifact of the legalese and non-technical phrasing of the verdict. But does anyone know what actually happened, on a technical level?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#439

Post by charcircuit »

ratww wrote: post #393
marcus_cemes wrote: post #319

Earlier quoted context omitted.

This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear. I'm curious to know whether DNS and your IP being in the the header…

> I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing? The IP has to be there for the return TCP packet, so under GDPR this falls under "strictly necessary" information. If someone sniffs you, they now have your PII. They can't do anything with it that is not "strictly necessary" w…

Is it strictly necessary to have that many intermediate parties to handle TCP packets with the user's IP?

You can instead peer with the user's ISP, or install a machine into the user's network (something like a amazon echo / google home could work too) which establishes an encrypted tunnel to your main servers. Sure it would be more expensive to do this, but so would hosting your own copy of a font instead of using a CDN like Google Fonts. What's strictly necessary doesn't mean what's necessary in order for you to host the site cheaply.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#440

Post by rzzzt »

arka2147483647 wrote: post #326
marcus_cemes wrote: post #256

Earlier quoted context omitted.

> the w3c standards define, that browsers execute the commands they receive from the server I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly config…

I think you confuse user, the Human, and user, the Programming Idiom. User, the Human, is not going to be asked weather or not the browser should open every one of the possibly hundreds of references in a web page!! Now, user, the Programming Idiom, might be configured, programed, etc.. to behave differently, but the reality is that is that's not how the modern web works. If the browser is not configured to behave th…

But User, the Human has the means to command its User Agent, the Browser, to conveniently skip loading whatever they would not like to see, like fonts, executable scripts or ads.
Post reply on HN