Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

501–510 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#501

Post by asadkn »

arendtio wrote: post #254
asadkn wrote: post #116

Curious how useful is an IP address with a simple HTTP get request? As long as a sane Referer-Policy is set, the Referer won't be sent. Sure there's a lot more to browser fingerprinting but with just an HTTP request, all the data that would be known from it is the language and the user agent. Both of which are not unique data points and shared by thousands of other users. No cookies either in this case of Google Font…

So how valuable would it be to you if I would share with you that I spent $20 yesterday on shopping groceries. Probably not so much. But if I would share with you 90% of my spending, you might be able to infer a lot more information about me. So the question isn't how useful the single request is, but rather what can be done with a lot of these requests. And Google and Facebook are specialists in generating lots of s…

I understand what you're saying but it doesn't exactly address my curiosity of this specific case of HTTP GET requests for font files (no JS, no iframe, and no cookies either in this case).

Your thoughts about a like button widget, or even Google Analytics are perfectly valid. But I am talking about this specific topic under discussion, Google Fonts.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#502

Post by aloe_falsa »

bryarsdj wrote: post #435
discardable_dan wrote: post #269

Earlier quoted context omitted.

This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c…

But shouldn't the site owner pay for a CDN and host the resources themselves? In which case the CDN wouldn't own the IP information. I think the problem here is that the website author is getting free bandwidth in exchange for their user's IP address, which in the example Google can then use for tracking and other things in exchange.

> But shouldn't the site owner pay for a CDN and host the resources themselves?

Not sure I understand this. Whether you pay for a CDN or not, you'll still be guilty of sending the user's browser to an external domain without consent (because it happens before the page is fully loaded). The only GDPR-compliant solution seems to be self-hosting everything.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#503

Post by Andrew_nenakhov »

ceejayoz wrote: post #351
Andrew_nenakhov wrote: post #189

Earlier quoted context omitted.

Ok, don't jump from a bridge. Take off your clothes, and go to your neighbors, I'm asking you right now. Are you going to comply?

Yes, that might be a crime. https://en.wikipedia.org/wiki/Strip_search_phone_call_scam#T...

But I didn't identify myself as a policeman. Just a request from some random person on the internet. The person I asked to do it didn't comply, because he knows better what instructions to obey. So should his browser.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#504

Post by floatingatoll »

kall wrote: post #427

Treating IP addresses as PII continues go be incredibly tedious and as far as I can tell, they are PII because providers are forced by law to keep those records. Is that correct? It would be so much better to just reduce and safeguard that information instead of handing it out to any rando with a court order.

Sadly, the United States used to have a treaty law in place that delivered the easy solution you describe. In mid-2020, the treaty was found not to provide the necessary protections, and invalidated by EU courts; no replacement treaty was negotiated or signed by the US, and so here we are.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#505

Post by IgorPartola »

ozim wrote: post #490
IgorPartola wrote: post #395

Earlier quoted context omitted.

So the fault is with Google and Chrome and not the defendant?

No, defendant made website in a way that request to Google is part of the required requests when you visit their website. It does not ask person browsing for permission to do the request to Google. Probably there was also no mention anywhere that code of website will be connecting to a 3rd party server to pull fonts.

Your point was that Chrome sends additional tracking data specifically to Google. That is all Google’s doing.

But also let’s break down the many many things wrong with this case:

1. Your IP address is shared with many different infrastructure providers none of whom you know about: the CDN that is serving content, the server hosting providers, the TLS certificate revocation log where your browser checks if they given domain’s certificate has been revoked, the DNS server you used. It is a given that your user agent will tell half the Internet that you IP is trying to access a given website. Unless everyone hosts their own infrastructure entirely (no CDN, no external APIs, no external DNS servers, no leasing servers let alone AWS or similar), we will never not leak IP addresses. Your only solution to this is to use something like Tor.

2. Asking each and every website to create an increasingly more complicated consent form for every service they use is going to create a huge anti pattern. The cookie consent forms already suck harder than a Dyson. Why would anyone want more of that?

The correct solution is for Google to be punished for doing evil shit and to also build all the privacy controls into the user agent. This would still lead to some consent forms but at least the UI would be uniform and easy to understand. The current situation sucks bad and this case will make it worse.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#506

Post by Kim_Bruning »

brtkdotse wrote: post #17
HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Running a website in Germany seems like a god damned nightmare: https://allaboutberlin.com/guides/abmahnung-creative-commons

This is called copyleft trolling, and is a problem outside Germany as well. It's a known bug in early CC licenses, and has been fixed as of CC 4.0 .

https://doctorow.medium.com/a-bug-in-early-creative-commons-...

(action still required: authors need to update to CC 4.0 or later)

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#507

Post by baxtr »

onli wrote: post #23
HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

This is not good news. This indeed very bad news. Especially for entrepreneurs in Germany who must constantly fear to be convicted for something as ridiculous as this.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#508

Post by floatingatoll »

gnud wrote: post #331
discardable_dan wrote: post #296

Earlier quoted context omitted.

On its face, this appears to be death of the third-party CDN. The largest issue is this means companies will no longer be able to use third-party hosting services like Squarespace which rely on shared (technically third-party) CDNs. A secondary, but similar, issue, is that now all embeds are opt-in: streams, videos, everything must first be clicked on to even load the thumbnail. A third, and less-important, issue is…

Using a third party is not illegal in itself. But you need an agreement with the third party as to how they will store/process any user data they collect. This is fairly fundamental under GDPR. It's the 'data controller'/'data processor' split. I suspect (but IANAL of course) that most CDNs would fail here, because the blanket agreements they offer are basically worthless. But it's easy to imagine a CDN that has a di…

CDNs under the auspices of a non-GDPR government cannot offer any legally-binding assurances that they will comply with GDPR. Their government can legally compel them to lie about honoring the GDPR and secretly act otherwise. Since US courts and authorities are no longer bound by law to honor the GDPR, no service owned by, operated by, hosted within, or subsidiary to a United States entity can guarantee compliance with GDPR.

Any CDN that is owned/operated/subsidiary in full within countries that have legal GDPR protections in place, such as member states of the EU, would be fine to use — but that rules out Cloudflare, Akamai, etc.

(I am not your lawyer, this is not legal advice.)

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#509

Post by VonGallifrey »

marcus_cemes wrote: post #359
arka2147483647 wrote: post #326

Earlier quoted context omitted.

I think you confuse user, the Human, and user, the Programming Idiom. User, the Human, is not going to be asked weather or not the browser should open every one of the possibly hundreds of references in a web page!! Now, user, the Programming Idiom, might be configured, programed, etc.. to behave differently, but the reality is that is that's not how the modern web works. If the browser is not configured to behave th…

> User, the Human, is not going to be asked weather or not the browser should open every one of the possibly hundreds of references in a web page Exactly, because we strive for a balance of convienience with complexity. Most people wouldn't mind downloading a font from Google, they already use it directly anyway. This isn't how law works, as an engineer, I'm just trying to find some sanity in what to me seems like an…

Just host the font yourself. What is the problem?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#510

Post by mro_name »

baxtr wrote: post #507
onli wrote: post #23

Earlier quoted context omitted.

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

This is not good news. This indeed very bad news. Especially for entrepreneurs in Germany who must constantly fear to be convicted for something as ridiculous as this.

those entrepreneurs unable to host their fonts.
Post reply on HN