Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

571–580 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#571
post #270

I don't know why people use fonts served from Google on their websites. Just serve the fonts from the server the site is on. It's like having javascript libraries served by 3rd parties; it's less robust.

I think it allowed browsers to cache font files across websites. But that might not even work anymore as I understand many browser vendors are moving towards resource isolation.

There still is the fact that you're getting fonts that are automatically subset into partial font files per character set, so if your pages mostly only use one or two character sets (like Latin and possibly Latin-extended), the browser only needs to download the font files for those particular character sets – at the same time you still retain the flexibility of using the full range of characters supported by that font if the occasion demands it, though. (With Latin plus Greek plus Cyrillic and possibly some OpenType features like proper small caps you can get into the hundres of k range, and support for East Asian languages easily gets you into the megabyte range.)

Plus in theory fonts optimised for the respective combination of browser and OS. The former probably isn't as critical any more, as almost everything should support WOFF2 (or at the very least WOFF) these days, as for the latter – I know OSs each have their own font rendering peculiarities, but no idea how much the difference might be in practice.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#572
post #455
post #369

Earlier quoted context omitted.

Not a lawyer, but to my knowledge, GDPR does not care if something technically "can be blocked" with some effort. It cares if there was clear, voluntary consent to share a particular bit of data - which wasn't the case here.

Then GDPR should blame the browser vendors for shipping with JS execution enabled by default and demand that JS execution for all browsers be turned off by default. To repaint the stories spun by the grand parents: If I hold up a dagger and announce the fact, why would you run into the dagger anyway without protection? Put on some armor, dude. The client browser had all the information it needed to not make the reque…

>If I hold up a dagger and announce the fact, why would you run into the dagger anyway without protection? Put on some armor, dude.

Let's say I'm dumb, and I run into the dagger that you're holding. The case is then investigated by the law enforcement. Who do you think they'll blame? Would I be deemed guilty, and would my crime be not having armor on?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#573

Earlier quoted context omitted.

Does that also imply that do not use a cdn to serve any of your assets as that will also leak the up address to third parties.

If the CDN abides by GDPR laws and doesn't process user data then it is fine. But if the CDN you use process user data for its own gain rather than just serve the request then that goes against GDPR. It is your responsibility as a developer to ensure the services you use follow these laws. If you don't have a contract stating that the other part will honor GDPR then we will assume that the other part will misuse all…

Does Google CDN not abide GDPR?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#574
post #335
post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

The user's browser is not the user. By that logic, any and all tracking pixels, javascript, iframes, etc would be regulatory no man's land, because all of those are technically just "intents" the server signals. Nevertheless, users are seldomly in a position to decide whether or not those intents are followed (and site owners can get quite mad if a user instructed their browser to "decline" such an intent e.g. throug…

So the same action on the part of the website owner will be legal or illegal depending on whether or not the user has actively configured his browser?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#575
post #529

Earlier quoted context omitted.

This ruling will 100% be upheld in the higher courts. The website is arguing that they have a legitimate interest in downloading fonts from Google in client browser, but as the court correctly states the website can provide these fonts directly. There is no reason to infringe on the user privacy, so there is no legitimate interest. And therefore use of Google fonts was without a legal basis. BTW - The website could h…

> The website is arguing that they have a legitimate interest in downloading fonts from Google in client browser, but as the court correctly states the website can provide these fonts directly. There is no reason to infringe on the user privacy, so there is no legitimate interest. And therefore use of Google fonts was without a legal basis. Would the same argument apply to using Strip or Paypal to accept credit card…

I wouldn't say so, especially because the in the shops I encountered, they explicitly state that "Payment will be handled by XY provider. You'll be redirected etc etc". That's not exactly using a resource from a third party in the background.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#576
post #23

Earlier quoted context omitted.

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

I have to say that this is such an example of new technology being scary but the problems with old technology being ignored. I'm still waiting for the ability to have mail received from someone or a company without giving such parties my name and physical address. This could very easily be implemented in many ways, but somehow does not exist. There is no reason for a mail order company to know my full name and physic…

[flagged]

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#577
post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

The technical implementation details don't matter. What matters is that the IP will be shared with Google as consequence of visiting the site as long as the user didn't take additional actions and without the user having took additional actions which made that happen.

This will also happen if I place a link on my site that does not clearly warn the user that it leads to a non EU website. User clicks it, and his IP address gets disclosed.

Really, if you participate in the World Wide Web, of course your computer’s address will be visible to others, and you can not always control it. Like driving on the Autobahn. People will be able to see you. It’s part of life.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#578
post #393

Earlier quoted context omitted.

> I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing? The IP has to be there for the return TCP packet, so under GDPR this falls under "strictly necessary" information. If someone sniffs you, they now have your PII. They can't do anything with it that is not "strictly necessary" w…

Sorry, I don't mean to play the devil's advocate, this has already gone way off-topic so take what I say with a pinch of salt. But technically, the IP is not strictly necessary? I can imagine a feasable future where it could be replaced with an anonymised IP from a larger pool generated by your ISP, with TLS for the payload. This could be solved at the internet infrastructure layer, and not required by to be solved b…

To handle resources, like a jQuery library, I'd love seeing URNs being used. A Universal Resource Name is supposed to uniquely identify a resource solely by its name, and say nothing about where to find it - which is the job of its sibling, the URL. A website could state that they need "urn:uuid:6e8bc430-9c3a-11d9-9669-0800200c9a66", and then the browser could decide where to look that up. In my local cache? The cache distributed with the browser? The ISP's repository of resources? The original first party? My VPN provider's fancy anonymized lookup service? Whatever the case, it feels like a robust way to handle shared resources, and of course to introduce a myriad new ways to break UX but hey it's progress!

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#579

Earlier quoted context omitted.

If the CDN abides by GDPR laws and doesn't process user data then it is fine. But if the CDN you use process user data for its own gain rather than just serve the request then that goes against GDPR. It is your responsibility as a developer to ensure the services you use follow these laws. If you don't have a contract stating that the other part will honor GDPR then we will assume that the other part will misuse all…

Does Google CDN not abide GDPR?

This was a static web address and not a CDN for this website, the company doesn't have a contract with Google about this and the user didn't go to Google.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#580
post #458
post #453

Earlier quoted context omitted.

> self-host the fonts Do you, as the website operator, have the right to copy and serve these fonts to your visitors? (Actual question; my guess is that you don't according to Google Fonts, but could be wrong.) > proxy the request through your own servers Isn't this worse? Assume that your visitor does not want Google contacted at all as part of their visit; isn't, then, the potential leak of an IP address simply a s…

> Do you, as the website operator, have the right to copy and serve these fonts to your visitors? Good question. I have no idea, but apparently the court thinks self-hosting is ok in this case. > Isn't this worse? Assume that your visitor does not want Google contacted at all as part of their visit; isn't, then, the potential leak of an IP address simply a side effect? The website is still leaking timing of when a vi…

> There is a specific set of data which is defined as "personally identifiable information".

I believe there isn't and that is part of the problem with GDPR in my experience.

Post reply on HN