Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

61–70 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#61

Post by TotempaaltJ »

ChrisKnott wrote: post #50
noja wrote: post #33

Earlier quoted context omitted.

Seems pretty simple to me. I visit not-google.com, then don't load anything from elsewhere without being asked first. It's not too dissimilar to app-level permissions.

The counterargument to this is that you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML. This ruling could easily get overturned.

The vast majority of people don't know what the last half of your message means. They cannot, and should not, be expected to make fully informed decisions. Industry (as always) has demonstrated they're not interested in educating or helping the user in any way about this. So they need to be regulated.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#62

Post by rndgermandude »

kleiba wrote: post #25
kiallmacinnes wrote: post #13

Earlier quoted context omitted.

Honestly, it's not that big a leap to reach this interpretation. 1) Your IP address is considered personal data, as it can be used to identify you. In general, everyone can see and agree with this. 2) In the absence of additional protections and/or contract terms[1], the transfer of personal data out of the EU is an offense under the GDPR (well, technically it's not out of EU, but transfer to a country without GDPR e…

1) Your IP address is considered personal data, as it can be used to identify you. In general, everyone can see and agree with this. Only if you're the sole user of that IP, which is e.g. not the case in a family.

It is enough to identify whoever is paying for the internet access, which is enough, in itself. And it might be enough to identify the actual user with "reasonable" certainty, e.g. if the user was home alone at the time the IP was used.

Courts found that it doesn't have to be demonstrated that a user can be identified, the abstract reasonable risk that a user could be identified is enough to turn an IP address into PII (and this ruling explicitly mentions this).

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#63

Post by valzam »

miohtama wrote: post #12
perlgeek wrote: post #4

The reasoning behind this judgement is: The services (here: web fonts) could be supplied another way, so exposing the user's IP to google is not strictly necessary, from a technical POV. The user's IP is PII, and exposing it unnecessarily to third party is a GDPR violation. The way this is phrased, the reasoning applies to basically every static resource loaded from a CDN or other third-party website.

> The services (here: web fonts) could be supplied another way, so exposing the user's IP to google is not strictly necessary, from a technical POV. Because an IP address needed to receive a download. This kind of decision means that any hot linking of static media assets is now in hot waters. A sensible judge would say IP address is not PII but a prerequisite to use Internet in the first place. Like a license plate…

The problem of course is that IP addresses can totally be used by Google to build up a profile of your browsing behaviour across the whole web. Even if typical end User ip4 addresses change quite a lot due to ISP NATs I imagine it's still very valuable information. Obv with ipV6 and static IPs for everyone it becomes a privacy nightmare

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#64

Post by maratc »

7373737373 wrote: post #51
randalluk wrote: post #41

Earlier quoted context omitted.

Doesn't this attitude overlook the "agency" of the "User-Agent"?

Yeah, the plaintiff's browser made the request after all, no?

The plaintiff's browser did what the defendant's code ordered it to do.

If the defendant's code violated GPDR (which seems to be the court's conclusion) by sending the plaintiff's browser somewhere, it's a defendant's problem, not plaintiff's.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#66

Post by vanviegen »

miohtama wrote: post #12
perlgeek wrote: post #4

The reasoning behind this judgement is: The services (here: web fonts) could be supplied another way, so exposing the user's IP to google is not strictly necessary, from a technical POV. The user's IP is PII, and exposing it unnecessarily to third party is a GDPR violation. The way this is phrased, the reasoning applies to basically every static resource loaded from a CDN or other third-party website.

> The services (here: web fonts) could be supplied another way, so exposing the user's IP to google is not strictly necessary, from a technical POV. Because an IP address needed to receive a download. This kind of decision means that any hot linking of static media assets is now in hot waters. A sensible judge would say IP address is not PII but a prerequisite to use Internet in the first place. Like a license plate…

I agree that license plates make an apt comparison. How would you feel if private companies set up plate readers at just about every parking area everywhere?

Like with IPs, they wouldn't be able to identify unique individuals with 100% certainty (as both IPs and cars may be shared), but they'd get pretty close. Certainly when it can be combined with other data.

So yeah, to me it makes sense that IPs are personal data.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#67

Post by ZeroGravitas »

iqanq wrote: post #53
randalluk wrote: post #41

Earlier quoted context omitted.

Doesn't this attitude overlook the "agency" of the "User-Agent"?

Isn't regulation precisely the act of acting in behalf of the citizens because they are seen as "too stupid" to know what they are doing?

When talking about UX, there's this bad habit of using people's mothers or grandmothers as examples, because they are 'too stupid' to understand the UI that was built. Aside from the obvious problems, this also implicitly removes blame from the designer/implementor of the interface.

I always prefer to reframe it as someone with a very important, intelligence requiring job, say vaccine reasearcher, who doesn't have time to deal with your shitty UI when they want to print a document.

I feel the same applies here.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#68

Post by questiondev »

brtkdotse wrote: post #36
ianpurton wrote: post #19

Hopefully we won't see popups like "This site will forward your IP address to Google is that OK?", because I'm already beyond bored with "This site uses cookies do you accept?".

I too was pissed about the popups until I realized it the companies throwing up the popups that are to blame. Hosting all your assets by yourself, on your own servers and doing analytics without sending data to a third party is not a terribly tall order.

that is true but it increases the barrier to entry for those who use google fonts for system resource issues, a lot of people offload because they don’t have the space or money to self host everything

one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of servers

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#69

Post by AndrewDucker »

rokizero wrote: post #38

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make se…

Yes. If it's not technically necessary then don't do it. Host the fonts yourself rather than letting Google track people to your site.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#70

Post by randalluk »

dividedbyzero wrote: post #52
randalluk wrote: post #41

Earlier quoted context omitted.

Doesn't this attitude overlook the "agency" of the "User-Agent"?

What does the browser's user agent have to do with this?

The browser is the user-agent, ie. an agent acting on behalf of the user. The browser chose to fetch the font, based on the orinal response. It could be configured not to.
Post reply on HN