Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

441–450 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#441

Post by elevader »

luplex wrote: post #390
discardable_dan wrote: post #269

Earlier quoted context omitted.

This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c…

ianal, but I think CDNs would not be affected by the ruling, since they serve an important function. Google Fonts was deemed illegal here since it's not necessary and you can easily provide a font in a privacy-preserving way.

Not a lawyer as well but I'm not sure about this. Let's use the "jQuery served by a CDN" example here: You can easily argue that using jQuery is necessary for your site to function but there is no real benefit to the user by doing this with a CDN when you could just ship jQuery from your own server. AFAIK the benefit of CDNs is largely nullified nowadays by browsers using a different cache for each primary domain anyways, so you can't even really point out a potential benefit for the user (faster load times) here.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#442

Post by xg15 »

Spoom wrote: post #422
xg15 wrote: post #350

Earlier quoted context omitted.

> browsers need to immediately stop interpreting these commands, instead providing user prompts for _each offsite load event_ No, why should they? The ruling makes the (pretty realistic) assumption that users are in no position to decide about individual load requests. Therefore, those are the responsibility of the site author. This way to interpret the events seems most consistent with real-world usage. Meanwhile pr…

By this argument, then, should third party requests always be blocked? If the user "is in no position to decide", that means that the only way to avoid potential liability would be to load everything from the same domain, right? No CDNs, no off-site scripts, no off-site embeds, ever. Seems a bit extreme to me. Thoughts my own, not those of my employer.

To my knowledge, there are other avenues beside consent under which the GDPR allows data exchange with third parties - in particular if such an exchange is essential for fulfilling the service. The point here was though, that the data exchange was not "essential" because you could simply self-host the fonts or proxy the request through your own servers.

But yes, it would seems to me that this interpretation of the law sort of communicates that third party requests should be a measure of last resort. That would definitely cause a shift in current web dev practices, but I'm not sure it's a bad thing.

> avoid potential liability

I think "potential" liability is an odd criterion. Any law is a risk of potential liability. If the effort to find out if a law actually applies to you is already too much, then I guess anything less than anarcho-capitalism would be unacceptable.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#443

Post by Xylakant »

yayr wrote: post #262
brtkdotse wrote: post #56

Earlier quoted context omitted.

Look and learn from Yubico, they don’t show any YouTube embedded videos until you agree to functional cookies: https://www.yubico.com/?lang=sv

This case is about IP address exposure, not cookies. This would still happen. So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure… this could probably be avoided by extending the sites terms.

I see quite a few web pages in Germany that do not load JavaScript or any other content from YouTube,Twitter, Facebook until you explicitly opt in. Basically, the content is replaced by a placeholder saying “click here to load external content from.” - it’s technically not very hard to do so, and I quite like it. I don’t need to be tracked by any of those entities everywhere I go. Tracking and creating profiles is one of the large problems of Facebook like buttons and similar.

> this could probably be avoided by extending the sites terms.

Reading the judgement, I don’t think so. Consent is required before exposing the IP address and is must be explicitly given. Terms can help in cases where there is a technical requirement, for example “if you want to watch this embedded video, you must consent to this”, but they won’t save you when you just embed.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#444

Post by ratww »

7373737373 wrote: post #426
ratww wrote: post #407

Earlier quoted context omitted.

> all external content providers that are embedded on their page All the embedding is being done by the people building the websites, so yes, they do have full control and therefore full responsibility. Just because I don't perform a crime or violation myself, it doesn't automatically absolve me when I pay or ask someone to commit it. > forcing millions of website providers Millions? There are billions of website vis…

How many of these billions want or are even capable of understanding what they do when they click the "i accept" button? Legal complexities seem even further removed from public understanding than technical ones. This approach seems equally ineffective for achieving what this regulation is intended to achieve, to not just to have the users sign away their rights with a click, but give them an understanding of what th…

> How many of these billions want or are even capable of understanding what they do when they click the "i accept" button?

I don't see how this is relevant, but:

Again, whether those consent forms are understandable or not depends solely on how websites implement them. The fact they are confusing is purely because website operators want them to be.

These confusing forms are not a requirement of the GDPR. How they look and feel is up to the website hosting them. They go against the spirit and some go against the letter of the law.

The goal of GDPR is letting people answer to the question such as "Can I give your data to company X?". The fact that the internet became a cesspool of privacy violations doesn't change the original intent of the law.

> This approach seems equally ineffective for achieving what this regulation is intended to achieve, to not just to have the users sign away their rights with a click, but give them an understanding of what they give away.

The law already states that rejecting should be as easy as allowing. The fact websites don't make it means they're breaking the law, and I hope they get punished by it.

> I agree that its a big problem that the big browsers do not act in the interest of their users, and that their vendors are in fact disincentivized to do so

We already have a Do-Not-Track header, but websites refused to obey it for more than 10 years, to the point they were removed from browsers.

Solutions were always there. It is websites that chose not to comply.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#445

Post by jstummbillig »

Flocular wrote: post #381
jstummbillig wrote: post #311

Earlier quoted context omitted.

If that was true, how does Google work within China?

By sharing data until public relations make change necessary https://www.theverge.com/2021/9/11/22668734/google-user-data...

If China can mandate Google to do something like that and having Google submit to it, effectively escaping US jurisdiction for this part of the world, why wouldn't it work in the EU applied to a completely different set of goals?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#446

Post by no_time »

dsego wrote: post #429
no_time wrote: post #353

Earlier quoted context omitted.

>The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. "Your honor, I merely told the gun to strike the firing pin. Without a round chambered in, the gun wouldn't have done anything."

Your honor, I instructed my browser to point a gun at me and it shot me. Surprised Pikachu face.

I sure wish the average person could instruct their browser to avoid this happening without their knowledge.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#447

Post by jlokier »

jeroenhd wrote: post #167
jlokier wrote: post #85

Earlier quoted context omitted.

No. (Contrary to the sibling comment). If you have agreements in place with third party data processors to protect user privacy, this ruling does not prevent you from hot linking third party assets under that agreement. In effect, the third party acts as part of your infrastructure - just like you may already use a third party hosting provider, cloud database provider, auth provider, logging service, etc. The GDPR co…

The data processing agreement with American companies is probably not enough because the USA doesn't sufficiently protect the users' privacy under the GDPR. It's only possible to go this route if the country has the approval of the EU through the necessary legal frameworks. That's what Privacy Shield and its predecessor were, and both were deemed insufficient. Your point about a data processing agreement is true, but…

I should have said adequate data processing agreements which comply with the GDPR. In practice the simplest way to do this would have third parties handling EU requests within EU boundaries, and not shipping analytics that contain PII outside controlled boundaries.

Some service providers appear to at least be addressing the issue, e.g. see the AWS link. Hetzner in Germany offers similar data processing agreements.

It would not be difficult for Cloudflare and Google to do the same. If you operate a CDN, almost by definition you have no problem hosting within the EU when sending content to users in the EU.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#448

Post by pembrook »

dgellow wrote: post #272
brtkdotse wrote: post #36

Earlier quoted context omitted.

I too was pissed about the popups until I realized it the companies throwing up the popups that are to blame. Hosting all your assets by yourself, on your own servers and doing analytics without sending data to a third party is not a terribly tall order.

You don’t even need to host yourself the asset, just setup a reverse proxy that drops personal information and redirect the request to the source (Google, or whatever). It’s a simple Nginx rule.

Oh, super simple!

The local bakery down the street just needs to figure out what a reverse proxy is, what a redirect is, and what Nginx is and how set rules for it, and then weigh the pros and cons vs self-hosting assets.

I’m sure that’s easily doable for them, aren’t regulations fun?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#449

Post by guipsp »

7373737373 wrote: post #51
randalluk wrote: post #41

Earlier quoted context omitted.

Doesn't this attitude overlook the "agency" of the "User-Agent"?

Yeah, the plaintiff's browser made the request after all, no?

Use this one weird trick to make all browser exploitation legal.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#450

Post by marcus_cemes »

xg15 wrote: post #369
marcus_cemes wrote: post #344

Earlier quoted context omitted.

I agree, but the definition of the law can also be interpreted many different ways, until it's clarified, I guess. This seems to me like a very grey area. There was no trap, in my opinion, document clearly specifies that an additional resource, here a font, will help the website look as intended by the designer. It's visible and its effects are well known (it's part of a well understood specification) and can be bloc…

Not a lawyer, but to my knowledge, GDPR does not care if something technically "can be blocked" with some effort. It cares if there was clear, voluntary consent to share a particular bit of data - which wasn't the case here.

I'm not either, and neither are most developers. My takeaway from this is GDPR doesn't care, leaked data is leaked data. I'm just worried about this implications this will have for non-malicious intent that the internet has evolved to use over time. Perhaps this is for the better, but I fail to see that future at the moment.
Post reply on HN