Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

521–530 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#521

Post by zinekeller »

Kim_Bruning wrote: post #497
jokethrowaway wrote: post #402

Earlier quoted context omitted.

Have you browsed the internet recently? We were better off 15 years ago

We were not better off 15 years ago. We were just blissfully unaware of the problem of large-scale PII collection that was already metastasizing in the shadows. Imagine a kind of decision square. Rows are "consciously" and "unconsciously", Columns are PII collection, and privacy (no PII collection) . This gives us a list of 4 possible scenarios (from least to most desirable). 1. unconscious privacy, 2. unconscious PI…

> Early 21st century, people started collecting PII at an ever increasing (and frankly alarming) rate. You may have encountered tall tales where people got sent baby advertisements before they themselves even knew they were pregnant.

What's disheartening is that in physical stores, this already started happening in the '90s, mainly for analysis of loyalty programs' data.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#522

Post by j-pb »

Vespasian wrote: post #518
j-pb wrote: post #499

Earlier quoted context omitted.

With all due respect, your response doesn't make much sense. Google fonts is primarily a github repo with specifically licenced fonts. Google paid a lot of the artists and foundries behind these fonts for an open licence. Therefor there is no need to build a "similar product", when the existing one is alrady free as in free beer, without any hidden data-/ad-funding. We are are primarily a PRINT-MEDIA shop. Non of GDP…

Perfect than you can just continue to use Google Fonts as is. I suppose Google does not pay artists and foundries out of the goodness of their hearts. They pay them to earn money through user data. If this is illegal a different service will turn up eventually.

I don't understand where you get this whole "service" idea from, but it clearly shows that you've never actually interacted with google fonts in any way.

Any different "service", would have the EXACT SAME ISSUE: Hot-linking leaks user IP-Data to whoever hosts the hot-linked content.

If you use the google fonts home page _as designed by google_ it already makes you download the fonts to self-host them along with your own sources.

And as for their motivation, google fonts originated from android, because again licensing fonts plain sucks, and google has an incentive to make developing apps and websites as easy as possible in order to strengthen their ecosystems.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#524

Post by perlgeek »

lixtra wrote: post #523

In other news: ip packages hop from one host to another and a dozen hosts see the private ip and the websites IP. Certainly the website should have asked the user before exposing their ip on the route.

The difference here is that there's a technical necessity for the routers to see the IP.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#525

Post by esyir »

Kim_Bruning wrote: post #489
yayr wrote: post #262

Earlier quoted context omitted.

This case is about IP address exposure, not cookies. This would still happen. So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure… this could probably be avoided by extending the sites terms.

I think these are the wrong solutions. What they're trying to do is to desperately hold on to doing "business as usual". Just now with a CYA fig leaf, and do I detect a hint of possibly a dash of malicious compliance? What the EU actually wants to accomplish is to set a standard where people do business in a different (safer/higher quality/more ethical) way[1]; which many believe is both better for consumers and for…

Strong disagree. This is more to me like Germany having jack all of a tech sector and trying their hardest to drag the rest of the world to their level.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#526

Post by perlgeek »

kall wrote: post #421
quyse wrote: post #377

Earlier quoted context omitted.

What if I host my website on Google Cloud Platform? I guess it should be OK then to use Google Fonts CDN on the website, because it's the same entity, and visitor's IP was already leaked to Google when the HTML page was served. Can't really ask user for consent before loading the HTML page!

You may not serve a website to german visitors from GCP at all, certainly not without getting consent first.

I'm pretty sure this is not correct.

There is a technical necessity for your hosting provider to see the user's IP.

The GDPR does not require consent for passing on private information when there is a technical or legal necessity, as well as a number of other preconditions.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#527

Post by lixtra »

perlgeek wrote: post #524
lixtra wrote: post #523

In other news: ip packages hop from one host to another and a dozen hosts see the private ip and the websites IP. Certainly the website should have asked the user before exposing their ip on the route.

The difference here is that there's a technical necessity for the routers to see the IP.

No, there are many ways around it (i.e. tor, vpn). The internet provider (or user) is just too lazy to provide proper privacy. Just like the website owner is too lazy to self-host the fonts.

Edit: in fact PII should not pass unencrypted, so if you don’t protect the IP (classified as PII) then you‘re not compliant.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#528

Post by notreallyserio »

rpadovani wrote: post #228
leobg wrote: post #217

Earlier quoted context omitted.

When I specify that the font used on my page can be accessed at a particular URL, I’m neither asking you to download it (the font might already be installed on your system), nor am I requesting that, if you do download it, you pass along a “referer” header. I am not only not making your browser do this - I’m not even asking it to do so.

> When I specify that the font used on my page can be accessed at a particular URL But this is not what you are specifying with Google Fonts (usually). You are saying: "To properly see this page, download this instruction file (CSS) from this other host". It doesn't matter if I have the font already installed, I still ask the CSS file to Google.

"We recommend using the font provided at this link, however your browser may fall back to a suitable built-in font if you choose."

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#529

Post by tzs »

Isinlor wrote: post #347
marcus_cemes wrote: post #319

Earlier quoted context omitted.

This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear. I'm curious to know whether DNS and your IP being in the the header…

This ruling will 100% be upheld in the higher courts. The website is arguing that they have a legitimate interest in downloading fonts from Google in client browser, but as the court correctly states the website can provide these fonts directly. There is no reason to infringe on the user privacy, so there is no legitimate interest. And therefore use of Google fonts was without a legal basis. BTW - The website could h…

> The website is arguing that they have a legitimate interest in downloading fonts from Google in client browser, but as the court correctly states the website can provide these fonts directly. There is no reason to infringe on the user privacy, so there is no legitimate interest. And therefore use of Google fonts was without a legal basis.

Would the same argument apply to using Strip or Paypal to accept credit card payments? The site could deal directly with a lower level payment processor which would reduce the number of third party entities that see the user's credit card.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#530

Post by esyir »

krono wrote: post #473
discardable_dan wrote: post #461

Earlier quoted context omitted.

> And hosting a font file entails dumping it next to your index.html file and adding some very basic CSS. Not exactly difficult. If you are a 60-year-old woodworker living in Appalachia trying to set up an online store to sell hand-carved flutes, this task is essentially impossible.

So they will have outsourced their website to some external entity that does possess the required technical knowledge. This required technical knowledge should include the ability to host a simple file.

So congratulations, you've regulated a middleman into the process. What a great day for humanity and a victory for regulatory capture.
Post reply on HN