Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

471–480 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#471

Post by tored »

ChrisLomont wrote: post #193
amelius wrote: post #184

Earlier quoted context omitted.

> It is the the user’s browser that initiates a request to Google’s server. A request by the website itself to Google sharing the user’s IP address never actually occurs. Manipulating a system so that it gives up information that wasn't intended to be given away, is called hacking.

The system is designed to do it. If you don't want your system operating as it was designed to do don't use it. It's not hacking.

Technology changes behaviour and therefore society, "don't use it" is not an option in many cases, for instance in the old days it was common pay bills by filling out forms attached to a bill and then snail mail or walk into the bank or a postal office for a clerk to either manual or automatic process it.

With internet banking much of that old style payment system has disappeared and many banks no longer accept that style of payment or even has an office that you can visit and if it is still possible there is hefty fee attached. Not using a browser is not really an option in current society.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#472

Post by xg15 »

2ion wrote: post #456
xg15 wrote: post #335

Earlier quoted context omitted.

The user's browser is not the user. By that logic, any and all tracking pixels, javascript, iframes, etc would be regulatory no man's land, because all of those are technically just "intents" the server signals. Nevertheless, users are seldomly in a position to decide whether or not those intents are followed (and site owners can get quite mad if a user instructed their browser to "decline" such an intent e.g. throug…

Users are enabled to set policy by disabling JavaScript execution by default. If GDPR sees an issue with current default policy, it should mandate that policy is in alignment with user expectations by default, by disabling policy. For web content, after all, doing everything on the server side is not impossible.

Where does it say they see an issue? They just argue that web assets are the responsibility of the site developer, not the user - which is the exact opinion site developers have as well in pretty much every other context.

It's also the expectation of users: Most users aren't experts and don't know what javascript, web fonts or GET requests even are.

You can't have your cake and eat it too.

> Users are enabled to set policy by disabling JavaScript execution by default.

They aren't. All mainstream browsers have removed the option to disable JavaScript. You have to install 3rd-party plugins to get the option back. Those plugins frequently break sites.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#473

Post by krono »

discardable_dan wrote: post #461
krono wrote: post #340

Earlier quoted context omitted.

Technical skill is kind of a requirement if you want to achieve something that's technical by nature - such as website development or web hosting. And hosting a font file entails dumping it next to your index.html file and adding some very basic CSS. Not exactly difficult.

> And hosting a font file entails dumping it next to your index.html file and adding some very basic CSS. Not exactly difficult. If you are a 60-year-old woodworker living in Appalachia trying to set up an online store to sell hand-carved flutes, this task is essentially impossible.

So they will have outsourced their website to some external entity that does possess the required technical knowledge. This required technical knowledge should include the ability to host a simple file.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#474

Post by Puts »

Jyaif wrote: post #312
Puts wrote: post #218

Earlier quoted context omitted.

Note that GDPR talks about data minimisation - data you should not share more data then necessary. If there are no other way then linking to a third party then that would be just fine. But if there is another way to do it that don't requires you to share someone else data you should do that instead (in this case self host the fonts). Also consent may not actually help here because the principle of data minimisation a…

By that logic it sounds like you must use your own servers to host the data, otherwise you are sharing the IP with a cloud provider.

You could absolutely make that argument. That is why this particular case is so interesting. This is the first time I've seen a ruling regarding this and it may open up for more cases on where to draw the line on when processing is "necessary" and not.

Also it's worth noting that GDPR also puts other demands in place, for example that there be technical measures to protect the data from unauthorized access, or unintentional data loss. If you can argue that a cloud provider can handle those things better, then that may trump the data minimization argument.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#475

Post by charcircuit »

ratww wrote: post #451
charcircuit wrote: post #439

Earlier quoted context omitted.

Is it strictly necessary to have that many intermediate parties to handle TCP packets with the user's IP? You can instead peer with the user's ISP, or install a machine into the user's network (something like a amazon echo / google home could work too) which establishes an encrypted tunnel to your main servers. Sure it would be more expensive to do this, but so would hosting your own copy of a font instead of using a…

It is considered strictly necessary under GDPR, yes, because TCP/IP (and UPD) is how the internet works. Something being "strictly necessary" under GDPR also doesn't mean that each intermediate entity can do whatever they want with the IP address. > which establishes an encrypted tunnel to your main servers Grandparent was talking about "packets travelling through various different countries". This is just TCP/IP. Us…

>Using a tunnel won't change this

The difference is that now your IP is what all the intermediate servers see instead of a user's private data (your user's IP address).

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#476

Post by ratww »

charcircuit wrote: post #475
ratww wrote: post #451

Earlier quoted context omitted.

It is considered strictly necessary under GDPR, yes, because TCP/IP (and UPD) is how the internet works. Something being "strictly necessary" under GDPR also doesn't mean that each intermediate entity can do whatever they want with the IP address. > which establishes an encrypted tunnel to your main servers Grandparent was talking about "packets travelling through various different countries". This is just TCP/IP. Us…

>Using a tunnel won't change this The difference is that now your IP is what all the intermediate servers see instead of a user's private data (your user's IP address).

> The difference is that now your IP is what all the intermediate servers see instead of user's private data (your user's IP address).

Nope. Your IP is also visible by each router in-between when using such a tunnel if the machine is in the user's network (in your Amazon Echo or Google Home). You need alternative infrastructure to bypass the internet.

Installing a machine directly in the ISP building is no different from Carrier-grade NAT that is already widespread. It also leaks some data about you that can be deanonymised. It is also extremely expensive.

Edge CDNs can help a bit, though.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#477

Post by Nextgrid »

codethief wrote: post #365
Acinyx wrote: post #307

Earlier quoted context omitted.

Under the GDPR, an IP address is personally identifiable data, so you can't leak it. And for someone with masses of extra data like Google it is enough to identify who is doing the browsing, so this isn't some crazy overreach.

But GP has a point: An IP address (together with a timestamp) may be used to identify you a person but if it's not connected to actual personal data (e.g. what website you visited), "leaking" it to Google doesn't provide Google with any data about you. I mean, IP address ranges are publicly known. If I now run a `for` loop over all IPv4 addresses and write them to my HDD, am I suddenly illegally storing personal data…

You are extremely naive if you believe Google can't infer anything if the referer is missing.

An IP + user-agent combination (both of which are sent) is enough to uniquely identify a typical home user with high certainty unless they're behind a carrier-grade NAT and use a very popular browser.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#478

Post by Nextgrid »

jstummbillig wrote: post #194
Luc wrote: post #146

Earlier quoted context omitted.

The end result is that the fact that you visited this website is passed to Google, and this can then be used for advertising purposes.

> and this can then be used for advertising purposes. Can it? Is this within the range what Google is allowed to do in the EU right now? Because, if that is the case and we also wanted to stop that, wouldn't it be a lot more reasonable to just... forbid Google from doing that, instead of slapping every confused wordpress hack in the EU with a fine?

> Can it? Is this within the range what Google is allowed to do in the EU right now?

Google's current GDPR consent screen is not compliant. It provides an easy "accept" option but no easy decline option, which is against the regulation.

Given they are already breaking the law and successfully getting away with it (otherwise they'd stop), why would they not break it here?

In fact, it doesn't even have to be malicious; the data can accidentally be fed into a dataset that's used for ad targeting - maybe it was set up that way a decade ago, nobody knows about it and it isn't entirely obvious considering the entire targeting machine is a black box with thousands of parameters so it's impossible to definitely prove what data was used to target a particular ad.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#479

Post by anfogoat »

This isn't at all surprising but I still got scoffed at when I suggested that serving third party fonts, css, scripts, whatever without prior consent or contracts would be a violation. Tragically, I was just robbed of my told you so and was met with a mere well, this seems ok when I sent this to the very people who couple of years ago thought this would be nuts and that I was exaggerating. Part of the pathology of the kind of folk who like to cheer everything the EU does I guess.

My question is, why aren't we worried about the hops between a website and a user? There's who knows how many networks and routers in between them, and the packets might even hop outside the EU momentarily (!!!!!). Surely this needs some attention as well? Should we maybe consider an internal EU-only network? Or maybe the Commission could come up with a whole new routing scheme? I'm sure Europol would have tons of very sane ideas for one.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#480

Post by phreeza »

eps wrote: post #460

Finally. Took them long enough. There is literally no other business reason for Google to maintain Google Fonts, but to augment its tracking insights. None. That's the sole purpose of the very existence of Google Fonts.

Everything that makes it easier to build websites is in the business interest of Google in a way, because it commoditizes their complement.

https://www.gwern.net/Complement

Post reply on HN