Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

591–600 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#591

Post by j-pb »

Vespasian wrote: post #584
j-pb wrote: post #522

Earlier quoted context omitted.

I don't understand where you get this whole "service" idea from, but it clearly shows that you've never actually interacted with google fonts in any way. Any different "service", would have the EXACT SAME ISSUE: Hot-linking leaks user IP-Data to whoever hosts the hot-linked content. If you use the google fonts home page _as designed by google_ it already makes you download the fonts to self-host them along with your…

No hotlinking fonts is okay if you have a valid data processing agreement with the service.

Given the ruling that's doubtful, as there is no reason why it should be outsourced. "Datensparsamkeit"/Data-frugality is also part of GDRP, and completely besides the point of google fonts not being a service, nor conspiracy.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#592

Post by jeltz »

dorfsmay wrote: post #398
krono wrote: post #340

Earlier quoted context omitted.

Technical skill is kind of a requirement if you want to achieve something that's technical by nature - such as website development or web hosting. And hosting a font file entails dumping it next to your index.html file and adding some very basic CSS. Not exactly difficult.

And then EVERY site needs to serve the same font? The browser can no longer cache it across sites?

I don't think they can right now anyway since the cache is segrgated by origin to prevent leaking cache timings.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#593

Post by jeltz »

goodpoint wrote: post #589
leobg wrote: post #354

Earlier quoted context omitted.

Exactly! You’ll soon have to fill out a form as if undergoing surgery just to visit a website. (And, of course, were all gonna click “Accept all”, just as we do with cookie warnings and Apple TOS.) These judges do not know what they do. They only care about getting the case off their desk, clinging to the first semi plausible argument that allows them to do so. If you look for vision, guidance or responsibility for s…

> You’ll soon have to fill out a form as if undergoing surgery just to visit a website This is entirely a fault of the site owners. > These judges do not know what they do They proved again and again that they know what they are doing.

Yeah, the GDPR has done a lot of good already. The lawmakers clearly knew what they were doing.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#594

Post by jeltz »

xunn0026 wrote: post #383
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

So if I put a really giant mirror and burn your house at 3PM it's the Sun's fault? The ruling is actually quite logical. The (convoluted) outcome is that the IP is leaked and it should take any tech person about 5 minutes to realise this.

No, it is his house's fault for deciding to catch fire.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#595

Post by still_grokking »

yayr wrote: post #553
bushbaba wrote: post #532

Earlier quoted context omitted.

Sounds like ipv8 is needed to address this. :D

:-D something like zkIP (zero knowledge internet protocol)

You mean we should all switch to Tor?

When everybody would use it, and ISPs would sell access, that could help the users to regain control over their data, and make privacy on the internet finally first class.

I welcome this idea.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#596

Post by still_grokking »

marcus_cemes wrote: post #469
Xylakant wrote: post #443

Earlier quoted context omitted.

I see quite a few web pages in Germany that do not load JavaScript or any other content from YouTube,Twitter, Facebook until you explicitly opt in. Basically, the content is replaced by a placeholder saying “click here to load external content from.” - it’s technically not very hard to do so, and I quite like it. I don’t need to be tracked by any of those entities everywhere I go. Tracking and creating profiles is on…

> it’s technically not very hard to do so, and I quite like it For the average user, it's yet another thing to click without thinking, just to be able to visit a page. > Consent is required before exposing the IP address and is must be explicitly given There's the crux of the problem, it's difficult to know what to consent for without first displaying the website, so you implicitly give consent for "just the bare min…

The web isn't "the internet"!

Also the late web was designed by guess who: Yes, the ad-spyware companies…

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#597

Post by smokey_circles »

If this is specifically referencing that technically you could have served those google fonts without making the user go to Google (a proxy of your own and not a hyperlink) then yeah I'm all for it. Big if though, but to roll with it

1) finally webmasters can feel the absurd amount of data they push on us for goddamned shiny JS that barely runs on my phone. Maybe they'll cut back a little

2) Hopefully this incentivises a bit more clear border segregation. More technical effort? Yes. Better for my privacy? Hopefully.

I don't like the language here though, specifically the lack of anything directly supporting my stance. But I prefer optimism and then realism

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#598

Post by infamia »

npteljes wrote: post #566
dsego wrote: post #385

Earlier quoted context omitted.

Almost like delivery services industry that are entitled to know your residential address.

This is exactly the entitlement your comment parent was on about. A third party should not have active insight into the first party's business like that - or their customers'. GDPR is a very welcome step forward in this regard, and I hope that more of such will come.

The sort of logic imputed by the GPDR would put an end to mailing parcels too. You could drive across town to deliver the package, you didn't need it delivered via the post. After all, every package shipped in the mail involves a third party who knows the sender and recipient's address and name. Best get to banning that sort of potential skulduggery ASAP!

This is really an idiotic law in that it punishes the symptom (a third-party web request), but ignores the underlying problem (data strip mining by Google, Facebook, Twitter, etc.). Punishing the data strip mining, but leave the third-party web requests (which is an intrinsic feature of the web) would at least make some logical sense.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#599

Post by bArray »

silviot wrote: post #8
bArray wrote: post #2

After translating - the violation here is a website included third-party fonts from Google, and the fact that Google would be able to see their IP from the request violates GDPR? Seems as though anybody who uses a CDN or third-party to load _any_ resources will violate GDPR by this measure? Seems like a pretty wide interpretation of this law.

IANAL, but it sounds to me like a very important part of the story is that Google was not listed to end user as entity that would treat their data. Another way to read this could be: failure to inform users that their IP addresses were sent to Google resulted in a 100 € fine.

Sure, but this also seems bad for the small web. Imagine for example some small blog embeds a Youtube video into their static page - suddenly they are getting 100 euro fines all over the place.

Also this entire case overlooks the point that this user was tech aware enough that they knew their IP was getting sent to Google, was deeply upset by this, but didn't get an ad blocker? This feels like a contrived use of GDPR.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#600

Post by ozim »

IgorPartola wrote: post #505
ozim wrote: post #490

Earlier quoted context omitted.

No, defendant made website in a way that request to Google is part of the required requests when you visit their website. It does not ask person browsing for permission to do the request to Google. Probably there was also no mention anywhere that code of website will be connecting to a 3rd party server to pull fonts.

Your point was that Chrome sends additional tracking data specifically to Google. That is all Google’s doing. But also let’s break down the many many things wrong with this case: 1. Your IP address is shared with many different infrastructure providers none of whom you know about: the CDN that is serving content, the server hosting providers, the TLS certificate revocation log where your browser checks if they given…

That was not my point but of other user. Even though I can continue argument.

People that made website could make a website without linking to Google fonts.

All the other things you list like hosting providers are technically necessary to deliver website content or like request to TLS revocation log are implemented by browser and not by the defendant.

Yes complicated consent forms should get even more fucking annoying so companies should loose traffic if they don't think twice about using some 3rd party service.

If I have to click through 5 consent forms, I leave and company is not getting business. Other company that is caring about people data will have no need for such consent form and will be getting more business.

KEEP in mind that if you have your own cookies for your page to work like session cookies that are technically needed to login or use page, there is no consent form needed at all. People should just stop visiting pages that require consent.

Post reply on HN