Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

451–460 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#451

Post by ratww »

charcircuit wrote: post #439
ratww wrote: post #393

Earlier quoted context omitted.

> I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing? The IP has to be there for the return TCP packet, so under GDPR this falls under "strictly necessary" information. If someone sniffs you, they now have your PII. They can't do anything with it that is not "strictly necessary" w…

Is it strictly necessary to have that many intermediate parties to handle TCP packets with the user's IP? You can instead peer with the user's ISP, or install a machine into the user's network (something like a amazon echo / google home could work too) which establishes an encrypted tunnel to your main servers. Sure it would be more expensive to do this, but so would hosting your own copy of a font instead of using a…

It is considered strictly necessary under GDPR, yes, because TCP/IP (and UPD) is how the internet works.

Something being "strictly necessary" under GDPR also doesn't mean that each intermediate entity can do whatever they want with the IP address.

> which establishes an encrypted tunnel to your main servers

Grandparent was talking about "packets travelling through various different countries". This is just TCP/IP. Using a tunnel won't change this, intermediate routers will still see your IP. Your idea is no different from HTTPS.

If you don't want intermediate routers seeing your IP you have to lay 100% of the infrastructure between the customer's house and your website. Again, this is not how the internet works. And GDPR already covers potential privacy issues that might arise in this case.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#452

Post by derekp7 »

southerntofu wrote: post #415
phkahler wrote: post #404

Earlier quoted context omitted.

>> This is exactly what happened... Not quite? Wouldn't the users browser have sent its own IP address to Google? That's different that "forwarding" it, and it may not even be enough for Google to connect the user to that site.

Yes, but the website ordered your browser to contact Google without informing you, for no obvious purpose. That's not exactly how consent works.

The web site did no such thing -- it served up a document that contained the reference. It is the end user that CHOSE to delegate interpretation of that document to a web browser (ad a counter example, look at how RMS browses the web). Yes this is less practical. But since the decision only deals with what is "possible", then logically it should be fully consistent.

Now from a practical standpoint, I'd like to see a privacy consent header which informs the web site of the privacy options the user has selected. Absence of that header or absence of specific selections will result in annoying popups like we have now.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#453

Post by Spoom »

xg15 wrote: post #442
Spoom wrote: post #422

Earlier quoted context omitted.

By this argument, then, should third party requests always be blocked? If the user "is in no position to decide", that means that the only way to avoid potential liability would be to load everything from the same domain, right? No CDNs, no off-site scripts, no off-site embeds, ever. Seems a bit extreme to me. Thoughts my own, not those of my employer.

To my knowledge, there are other avenues beside consent under which the GDPR allows data exchange with third parties - in particular if such an exchange is essential for fulfilling the service. The point here was though, that the data exchange was not "essential" because you could simply self-host the fonts or proxy the request through your own servers. But yes, it would seems to me that this interpretation of the la…

> self-host the fonts

Do you, as the website operator, have the right to copy and serve these fonts to your visitors? (Actual question; my guess is that you don't according to Google Fonts, but could be wrong.)

> proxy the request through your own servers

Isn't this worse? Assume that your visitor does not want Google contacted at all as part of their visit; isn't, then, the potential leak of an IP address simply a side effect? The website is still leaking timing of when a visitor accessed the site, potentially their usage patterns...

Personally, I think this is a bit of an absurd argument... I think, at most, consent should be enough for third party requests. I was mostly responding to GP's claim that the user can't reasonably consent to such use.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#454

Post by xg15 »

marcus_cemes wrote: post #450
xg15 wrote: post #369

Earlier quoted context omitted.

Not a lawyer, but to my knowledge, GDPR does not care if something technically "can be blocked" with some effort. It cares if there was clear, voluntary consent to share a particular bit of data - which wasn't the case here.

I'm not either, and neither are most developers. My takeaway from this is GDPR doesn't care, leaked data is leaked data. I'm just worried about this implications this will have for non-malicious intent that the internet has evolved to use over time. Perhaps this is for the better, but I fail to see that future at the moment.

But we have enough evidence that there is a lot of malicious usage taking place - so I think this is sort of justified.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#455

Post by 2ion »

xg15 wrote: post #369
marcus_cemes wrote: post #344

Earlier quoted context omitted.

I agree, but the definition of the law can also be interpreted many different ways, until it's clarified, I guess. This seems to me like a very grey area. There was no trap, in my opinion, document clearly specifies that an additional resource, here a font, will help the website look as intended by the designer. It's visible and its effects are well known (it's part of a well understood specification) and can be bloc…

Not a lawyer, but to my knowledge, GDPR does not care if something technically "can be blocked" with some effort. It cares if there was clear, voluntary consent to share a particular bit of data - which wasn't the case here.

Then GDPR should blame the browser vendors for shipping with JS execution enabled by default and demand that JS execution for all browsers be turned off by default. To repaint the stories spun by the grand parents: If I hold up a dagger and announce the fact, why would you run into the dagger anyway without protection? Put on some armor, dude. The client browser had all the information it needed to not make the request (geolocation, external resource, purpose of external resource) and yet it did. I know this is just shifting blame but it's also a good argument for returning HTTP 451 to EU clients and be done with it.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#456

Post by 2ion »

xg15 wrote: post #335
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

The user's browser is not the user. By that logic, any and all tracking pixels, javascript, iframes, etc would be regulatory no man's land, because all of those are technically just "intents" the server signals. Nevertheless, users are seldomly in a position to decide whether or not those intents are followed (and site owners can get quite mad if a user instructed their browser to "decline" such an intent e.g. throug…

Users are enabled to set policy by disabling JavaScript execution by default. If GDPR sees an issue with current default policy, it should mandate that policy is in alignment with user expectations by default, by disabling policy. For web content, after all, doing everything on the server side is not impossible.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#457

Post by discardable_dan »

gnud wrote: post #331
discardable_dan wrote: post #296

Earlier quoted context omitted.

On its face, this appears to be death of the third-party CDN. The largest issue is this means companies will no longer be able to use third-party hosting services like Squarespace which rely on shared (technically third-party) CDNs. A secondary, but similar, issue, is that now all embeds are opt-in: streams, videos, everything must first be clicked on to even load the thumbnail. A third, and less-important, issue is…

Using a third party is not illegal in itself. But you need an agreement with the third party as to how they will store/process any user data they collect. This is fairly fundamental under GDPR. It's the 'data controller'/'data processor' split. I suspect (but IANAL of course) that most CDNs would fail here, because the blanket agreements they offer are basically worthless. But it's easy to imagine a CDN that has a di…

How can a CDN fail to retain an IP address, at least for the purposes of knowing where to send the response? The ruling doesn't say that Google stored the IP, causing the issue, but merely that the user's IP showed up in a packet sent to Google.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#458

Post by xg15 »

Spoom wrote: post #453
xg15 wrote: post #442

Earlier quoted context omitted.

To my knowledge, there are other avenues beside consent under which the GDPR allows data exchange with third parties - in particular if such an exchange is essential for fulfilling the service. The point here was though, that the data exchange was not "essential" because you could simply self-host the fonts or proxy the request through your own servers. But yes, it would seems to me that this interpretation of the la…

> self-host the fonts Do you, as the website operator, have the right to copy and serve these fonts to your visitors? (Actual question; my guess is that you don't according to Google Fonts, but could be wrong.) > proxy the request through your own servers Isn't this worse? Assume that your visitor does not want Google contacted at all as part of their visit; isn't, then, the potential leak of an IP address simply a s…

> Do you, as the website operator, have the right to copy and serve these fonts to your visitors?

Good question. I have no idea, but apparently the court thinks self-hosting is ok in this case.

> Isn't this worse? Assume that your visitor does not want Google contacted at all as part of their visit; isn't, then, the potential leak of an IP address simply a side effect? The website is still leaking timing of when a visitor accessed the site, potentially their usage patterns...

There is a specific set of data which is defined as "personally identifiable information". IP address is part of that set, but I don't think timing information or anonymous usage data are. So the question in this case is specifically "does the request leak information defined as PII?". You can prevent that effectively with proxying: Google would only see the IP address of your proxy but not the address of the user.

> Assume that your visitor does not want Google contacted at all as part of their visit

I don't think a user can enforce this under the GDPR. They only have a right to block you from sending their PII to Google, not to block you from talking to Google at all.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#459

Post by marcus_cemes »

dsr_ wrote: post #355
ryandrake wrote: post #308

Earlier quoted context omitted.

Try making this argument with compiled code instead of HTML: "The company included the code to do $BAD_THING in the binary executable, but it was the user's choice to run it, and he could have easily modified the binary to ignore $BAD_THING, but didn't. Therefore, it was the user doing $BAD_THING, not the company." A lot of people in this discussion are splitting hairs here, trying to blame the user or the browser. T…

Correct. The question for law is: what does a reasonable person expect? This is a problem because people (in general) are not good at understanding or reasoning about what computers do... and the entire purpose of the web is to put a simplifying, abstract model in between what humans want to do and how computers work. Models are always wrong, sometimes useful. The web is very useful because it is wrong. If the web we…

From my experience, I think the average user treats the browser and the internet as a black box anyway, they don't reason about what is happening. As long as they can get to what they want, they don't really care what happens in between. Cookie notices get in the way, and therefore annoy them. Most also just accept the fact that there data gets leaked everywhere and there's not much that they can do about it. I genuinely don't believe that the average user can make sense of the TOS that they agree to when signing up for something...

This is definitely not a good thing, and should change, but I also believe that ad-driven companies will continue to find a way, we just continue to rack up operating complexity, which in turn, favours large companies. This ruling seems like a pretty weird and unhelpful way (in the grand scheme of things) of helping protect user privacy, but then again, that was not the goal of the lawsuit.

Post reply on HN