Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

561–570 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#561

Post by floatingatoll »

tzs wrote: post #540
floatingatoll wrote: post #512

Earlier quoted context omitted.

No. This means that embedding any resource from a non-GDPR destination URL is a violation of GDPR law unless explicit opt-in approval from the user is first received. If you are subject to GDPR law, then the above applies to all sites owned and operated by you and your subsidiaries. If you are not subject to GDPR law, then the above does not apply. Resources could be hosted by http:, https:, ftp:, or any other protoc…

> the user has a right to legal protection if they are a citizen of a GDPR-protected country and are residing in a GDPR-bound country, regardless of what their IP address is. Nit pick: GDPR is written in terms of people "in the Union", not citizens.

Noted!

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#562

Post by maratc »

latk wrote: post #560
maratc wrote: post #519

Earlier quoted context omitted.

> I don't think you get the agency argument. I do get that argument; I just don't think it holds any water. If one hires a hitman to kill someone, that one may still be held accountable to manslaughter, even if that specific person didn't kill anyone themselves. It may also not matter how many degrees of separation are there between that person and the hitman: as much as putting a (Bitcoin) bounty on someone's head (…

I discussed that argument over here: https://news.ycombinator.com/item?id=30139489 Summary: A company did try the “it was the browser, not us” argument in the “Fashion ID” case. The court did not fall for it. Data controller and thus responsible for compliance is whoever determines the purposes and means of processing. Being able to control what the website does seems to be good evidence for being a data controller.…

Thanks, that's very relevant and on-point (as opposed to my examples).

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#563

Post by bufferoverflow »

mro_name wrote: post #559
bufferoverflow wrote: post #544

Earlier quoted context omitted.

Host on where though? You leak user's IP to your web host, to your CDN.

no, because that's where to visitor want to go by explicit free will. Not so a hidden 3rd party.

The CDN is a hidden 3rd party, no?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#564

Post by npteljes »

marcus_cemes wrote: post #319
npteljes wrote: post #196

Earlier quoted context omitted.

>The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. I wouldn't say so. By making use of the Google Fonts service, the website owner set up a scenario where the browser would then share the user's IP with Google. That's the default behavior of most browser setups. It's as good as sharing with Google directly, no? I feel like the scenar…

This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear. I'm curious to know whether DNS and your IP being in the the header…

"Can be sniffed", and "Provider is making a third party sniff" are two different things. Legally and ethically too.

Right now you're right, the internet works this way. But that doesn't make it right, or fair, or anything, it just is. And it's also no reason it couldn't work in a different way.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#565

Post by latk »

codethief wrote: post #365
Acinyx wrote: post #307

Earlier quoted context omitted.

Under the GDPR, an IP address is personally identifiable data, so you can't leak it. And for someone with masses of extra data like Google it is enough to identify who is doing the browsing, so this isn't some crazy overreach.

But GP has a point: An IP address (together with a timestamp) may be used to identify you a person but if it's not connected to actual personal data (e.g. what website you visited), "leaking" it to Google doesn't provide Google with any data about you. I mean, IP address ranges are publicly known. If I now run a `for` loop over all IPv4 addresses and write them to my HDD, am I suddenly illegally storing personal data…

The court judgement addresses this exact point. There are previous judgements (Breyer v Bundesrepublik Deutschland) that establish that dynamic IP addresses are personal data. There are reasonable means to identify the data subject with the help of third parties, such as the ISP. “For this it is sufficient that the defendant has the abstract means for identification of the person behind the IP address. Whether the defendant or Google have the concrete means for linking the IP address with the plaintiff is irrelevant.”

That there is correlating information like timestamps, useragent strings, or referer headers increases the likelihood of actual identification, but the mere reasonable possibility of identification is sufficient for IP addresses to be personal data.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#566

Post by npteljes »

dsego wrote: post #385
verytrivial wrote: post #236

Earlier quoted context omitted.

I find it hilarious that the entire internet tracking and surveylance industry simply thinks it is entitled to this level of information now.

Almost like delivery services industry that are entitled to know your residential address.

This is exactly the entitlement your comment parent was on about. A third party should not have active insight into the first party's business like that - or their customers'. GDPR is a very welcome step forward in this regard, and I hope that more of such will come.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#567

Post by leobg »

arrenme wrote: post #384
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

This isn't "just" initiating a request to a random third party server. Chrome sends a unique ID when accessing (only!) google servers, in the form of X-client-data HTTP header, uniquely identifying the user, and the site he is browsing (via referrer). It's a goldmine. X-client-data: CIS2yQEIprbJAZjBtskBCKmdygEI8J/KAQjLrsoBCL2wygEI97TKAQiVtcoBCO21ygEYq6TKARjWscoB

I did not know this. However, do note that the ruling does not talk about this. It might have been a different browser altogether.

Also, it would seem to me that the responsibility for such behavior lies with Google and Google Chrome more than it does with individual webmasters.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#568

Post by npteljes »

marcus_cemes wrote: post #344
rpadovani wrote: post #313

Earlier quoted context omitted.

> Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame? Well said. Law is not a programming language, the fact that the website didn't _technically_ share the IP, but did it through the browser, is not relevant.

I agree, but the definition of the law can also be interpreted many different ways, until it's clarified, I guess. This seems to me like a very grey area. There was no trap, in my opinion, document clearly specifies that an additional resource, here a font, will help the website look as intended by the designer. It's visible and its effects are well known (it's part of a well understood specification) and can be bloc…

The going far feeling might come from the Overton window being pushed away in a direction. Regardless of what's right, healthy, good or bad usual things feel normal, and unusual will feel like going too far. The thing that matters in this feeling is what someone is gotten used to, which is not an objective quality of the thing, but an attribute of the viewer.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#569

Post by leobg »

xunn0026 wrote: post #383
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

So if I put a really giant mirror and burn your house at 3PM it's the Sun's fault? The ruling is actually quite logical. The (convoluted) outcome is that the IP is leaked and it should take any tech person about 5 minutes to realise this.

If I place a link that says “Search”, and instead of starting a search on my site, I send you to Google.com, your browser will connect to Google’s server and thus telling them your IP address. Such a hyperlink that does not clearly warn users that clicking it will cause you to connect to someone else’s server would also have to be illegal according to this ruling.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#570

Post by latk »

Spoom wrote: post #453
xg15 wrote: post #442

Earlier quoted context omitted.

To my knowledge, there are other avenues beside consent under which the GDPR allows data exchange with third parties - in particular if such an exchange is essential for fulfilling the service. The point here was though, that the data exchange was not "essential" because you could simply self-host the fonts or proxy the request through your own servers. But yes, it would seems to me that this interpretation of the la…

> self-host the fonts Do you, as the website operator, have the right to copy and serve these fonts to your visitors? (Actual question; my guess is that you don't according to Google Fonts, but could be wrong.) > proxy the request through your own servers Isn't this worse? Assume that your visitor does not want Google contacted at all as part of their visit; isn't, then, the potential leak of an IP address simply a s…

> Do you, as the website operator, have the right to copy and serve these fonts to your visitors?

All the fonts on Google Fonts are open source. When GDPR came into force in 2018 I downloaded all the fonts I needed, checked their licenses, and uploaded them on my servers along with necessary notices as required by the licenses.

The matter could also be sidestepped if the CDN were to offer a GDPR data processing agreement (DPA) and would make guarantees about the locations of servers. The free public CDNs understandably don't do this, and it seems Google Fonts is not covered by the Google Cloud DPA.

Post reply on HN