Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

481–490 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#481

Post by marcus_cemes »

Personally, I can see only two parties benefiting from this: the plaintiff and lawyers in general.

Google will continue to be Google. Users will be faced with more annoying consent notices that they don't read. Website developers, of which I am one (bias disclosure), who are not very good lawyers will have more technical complexity in order to respect the law. Small companies who rely on services such as CDNs and font providers are now worried about having to host things themselves and the complexity that will ensue to be GDPR compliant (everyone's new least-favourite term). Hacker News gets a divisive flamewar over the subject and this will be yeeted from the front page.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#482

Post by marcus_cemes »

anfogoat wrote: post #479

This isn't at all surprising but I still got scoffed at when I suggested that serving third party fonts, css, scripts, whatever without prior consent or contracts would be a violation. Tragically, I was just robbed of my told you so and was met with a mere well, this seems ok when I sent this to the very people who couple of years ago thought this would be nuts and that I was exaggerating. Part of the pathology of th…

> why aren't we worried about the hops between a website and a user

I asked about this below, apparently it's reasonable and strictly necessary. It's what the user expects. Even though it's technically possible for the infrastructure layer to provide full packet anonymity, until then it's the web developers responsibility. I do not agree with this, but that's my opinion.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#483

Post by floatingatoll »

hdjjhhvvhga wrote: post #121
zinekeller wrote: post #78

Earlier quoted context omitted.

> For example, say I want to embed an instagram post on my website. In that case, you could: a) get a license (your suggestion), b) link but not embed Instagram pages, or c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. And indeed, some websites use c) without any problem, they even integrate it into the cooki…

> they can say that this is to preserve the context in case that the user subsequently deleted the post). And this is how it should be done, otherwise you read the article a few years latter and see a strange mess with empty holes.

Or in Instagram’s case for me, you read the article and see a strange mess with empty holes today, because your IP address hasn’t logged into any Meta properties in the past year and so Instagram won’t serve you embeds anymore.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#484

Post by smorgusofborg »

HL33tibCe7 wrote: post #94
vanviegen wrote: post #32

Earlier quoted context omitted.

Whereas in the US you don't need to worry about frivolous lawsuits at all...?

Frivolous lawsuits, maybe, but frankly that’s irrelevant to the discussion at hand, which is the legislative liability of running a website. I’ve never heard anything even close to what the GP describes happening in any other country.

Software patents are a construct of the legislature that hands out a template for privateers to create liability. I wouldn't want to do anything in the US market.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#485

Post by npteljes »

7373737373 wrote: post #227
npteljes wrote: post #178

Earlier quoted context omitted.

So code in frontend would be "asking" in this case, in your opinion? Javascript is executed by default by all major browser deployments.

Yes, definitely. Ad absurdum, browsers could be mandated to have the user opt-in to every single instruction that is executed. It's technically possible, the user has control. I think it's a slippery slope to imagine/enforce a transfer of agency between the website user and provider, where the latter will try to make the opt-in appear as simple as possible. An ideal opt-in is more than the click of a button, it's an…

Code in the frontend is absolutely not "asking". I'd bet that most of the users have no idea what's going on in their browsers and devices, and those instruments then, in turn, shouldn't prey on this ignorance. I know that this is not how the world works, but a difference is that we could have control over this one.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#486

Post by floatingatoll »

derekp7 wrote: post #452
southerntofu wrote: post #415

Earlier quoted context omitted.

Yes, but the website ordered your browser to contact Google without informing you, for no obvious purpose. That's not exactly how consent works.

The web site did no such thing -- it served up a document that contained the reference. It is the end user that CHOSE to delegate interpretation of that document to a web browser (ad a counter example, look at how RMS browses the web). Yes this is less practical. But since the decision only deals with what is "possible", then logically it should be fully consistent. Now from a practical standpoint, I'd like to see a…

GDPR specifies a different interpretation of events, that takes precedence here: the user chose to visit GDPR-bound site A, and the law requires site A not to compel the user to visit any site B that is not bound by law or treaty to honor GDPR as well.

You’re not wrong that one could logically evolve your interpretation from circumstances, but GDPR’s authors chose not to accept your interpretation as sufficient, and went further than that.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#487

Post by npteljes »

Andrew_nenakhov wrote: post #201
npteljes wrote: post #178

Earlier quoted context omitted.

So code in frontend would be "asking" in this case, in your opinion? Javascript is executed by default by all major browser deployments.

If you are that caring about your privacy, you absolutely should use a browser that is configured in such a way that it doesn't leak your IP to anyone you didn't consent to.

I'm running systems that I'm modifying to the extent that satisfies me, but that's not the concern here. Right now I'm caring about everyone's default privacy level, not just my own. And in this ideal world, third party sharing is not opt-out.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#488

Post by Vespasian »

j-pb wrote: post #470
eps wrote: post #460

Finally. Took them long enough. There is literally no other business reason for Google to maintain Google Fonts, but to augment its tracking insights. None. That's the sole purpose of the very existence of Google Fonts.

If you've ever had the pleasure of dealing with the licensing nightmare of foundries, it's quite easy to see that a small group within google had enough and started the project. We've literally spend tens of thousands of dollars on our font archive, but decided that we can't continue to use these fonts on projects anymore, due to "we can change the licence at any time" clauses and rent seeking behaviour, that is eeri…

But there is nothing that prevents anybody to build a similar product but charging a fee for it.

The payment being "user data" is the problem. Not the product in and of itself.

If you are in the EU such a platform would probably need to be GDPR compliant.

I'm sure there is a opportunity for a font market that fulfills your needs. It might not be easy but eventually studios like you will probably have to charge clients an ongoing fee for "premium assets".

The end user is paying for it and while you and your clients are probably fine with it, the lawmakers are obviously not.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#489

Post by Kim_Bruning »

yayr wrote: post #262
brtkdotse wrote: post #56

Earlier quoted context omitted.

Look and learn from Yubico, they don’t show any YouTube embedded videos until you agree to functional cookies: https://www.yubico.com/?lang=sv

This case is about IP address exposure, not cookies. This would still happen. So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure… this could probably be avoided by extending the sites terms.

I think these are the wrong solutions. What they're trying to do is to desperately hold on to doing "business as usual". Just now with a CYA fig leaf, and do I detect a hint of possibly a dash of malicious compliance?

What the EU actually wants to accomplish is to set a standard where people do business in a different (safer/higher quality/more ethical) way[1]; which many believe is both better for consumers and for business.

I wouldn't be surprised if a next round of regulations were to explicitly target (actual or perceived) malicious compliance.

My recommendation would be to find other ways of achieving your technical/advertising objectives that minimize the touching of peoples PII.

[1] This is not unusual, the EU originated as the European Economic [Community/Union], and the regulating of safety, quality and ethics standards between businesses and trading countries has been in their bailiwick for a long time (as behooves a trade treaty organization). Not all kinds of regulation are bad for commerce. This kind promotes fair competition and interoperability, while preventing races to the bottom and tragedies of the commons.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#490

Post by ozim »

IgorPartola wrote: post #395
arrenme wrote: post #384

Earlier quoted context omitted.

This isn't "just" initiating a request to a random third party server. Chrome sends a unique ID when accessing (only!) google servers, in the form of X-client-data HTTP header, uniquely identifying the user, and the site he is browsing (via referrer). It's a goldmine. X-client-data: CIS2yQEIprbJAZjBtskBCKmdygEI8J/KAQjLrsoBCL2wygEI97TKAQiVtcoBCO21ygEYq6TKARjWscoB

So the fault is with Google and Chrome and not the defendant?

No, defendant made website in a way that request to Google is part of the required requests when you visit their website.

It does not ask person browsing for permission to do the request to Google. Probably there was also no mention anywhere that code of website will be connecting to a 3rd party server to pull fonts.

Post reply on HN