Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

611–620 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#611

Post by gkbrk »

bufferoverflow wrote: post #545
phkahler wrote: post #539

Earlier quoted context omitted.

1) google won't know what site told the browser to do that. 2) this is probably more of a browser issue than a site issue. 3) the reason browsers dont complain about content coming from different domains is because the entire ad industry depends on that behavior. That may need to stop ;-)

1) wouldn't Google be able tell that through the refferrer header?

Not all browsers send Referer headers. These days it's only useful for doing log analytics and hotlink protection from the browsers that do send the header.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#612

Post by janoc »

dorfsmay wrote: post #388
janoc wrote: post #300

Earlier quoted context omitted.

That's true but the mitigation to that is that it would have been OK if the user has consented to this "data processing". The court isn't ruling this sort of technology en bloc but says in its ruling that it is a problem because the user didn't consent to his personal data (IP address) being given to a third party (Google in this case). Personally I have mixed feelings about this ruling too because this sort of techn…

A lot of websites won't serve addresses from Germany. I've seen companies doing that with just the GDPR cookie warning, it wasn't worth rewriting code and annoy non-EU people with the warning so the detect IP address and redirect to a page saying they don't serve that region. Let's be honest, what have we gain from the cookie warning?

That is a minority and mostly only US-centric sites that are otherwise chock full of advertising/tracking technology - exactly what was GDPR meant to deal with.

However, GDPR and this type of ruling has EU-wide impact because of the single market (e.g. a French website can and does server also German customers). Businesses (especially the ones from the EU) can't afford to not comply or to not serve customers within the EU.

That is where the problem is.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#613

Post by dgb23 »

cryptime wrote: post #412
dgb23 wrote: post #266

Earlier quoted context omitted.

You have a point and I as a dev will ensure to follow this principle. The issue is that serving fonts and other assets from an external service is pretty much normal practice. This is new ground. The understanding so far was explicit tracking being the issue and not serving static assets. This ruling makes sense but goes way beyond what the consensus was so far.

Whose “consensus” ? Google or ad techs. That is not acceptable. The right way is GDPR pop up listing the companies you will share user data. With. If the user approves I am sure no court can touch you.

I meant consensus among developers. Using external _static_ resources has been a normal thing for very long and generally hasn’t been discussed under the light of GDPR.

In fact I would argue that most devs don’t assume that this is a problem at first glance. The general awareness and education should be better here.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#614

Post by Xylakant »

thirdsun wrote: post #609
Xylakant wrote: post #492

Earlier quoted context omitted.

> > it’s technically not very hard to do so, and I quite like it > For the average user, it's yet another thing to click without thinking, just to be able to visit a page. And yet, they’re still protected: They’ll click on the video when they want to watch the video, load the like button when they want to like, the tweet button when they want to tweet. And all the other times when they visit a website that offers any…

> There is no need to ask for consent for every Stylesheet you load from a CDN. You’re allowed to use cloudflare, cloudfront, fastly,… - they’ll all provide the required DPA that allows you to use them without consent. And Google doesn't? (Honest questions) On first look serving a font from Google and a stylesheet from Cloudflare seem very, very similar things.

The primary difference is that you usually have a contract with cloudflare that they host and serve your data on your behalf. A DPA would usually be part of the contract. Cloudflare also doesn’t mine the IP addresses that they gather as part of their operations to build advertising profiles.

AFAIK google fonts does not require any contract. Google could certainly offer a contract, a DPA, etc., assert that they are subject to the GDPR and waive processing of the data they gather from operating google fonts as a service.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#615

Post by josefx »

derekp7 wrote: post #452
southerntofu wrote: post #415

Earlier quoted context omitted.

Yes, but the website ordered your browser to contact Google without informing you, for no obvious purpose. That's not exactly how consent works.

The web site did no such thing -- it served up a document that contained the reference. It is the end user that CHOSE to delegate interpretation of that document to a web browser (ad a counter example, look at how RMS browses the web). Yes this is less practical. But since the decision only deals with what is "possible", then logically it should be fully consistent. Now from a practical standpoint, I'd like to see a…

> it served up a document that contained the reference

A document that is expected to be executed by the receiving system. Might as well log in to your companies production server as root and send the completely meaningless string of letters "rm -rf / \n", not your fault if the receiving system actually executes it.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#616

Post by baash05 »

still_grokking wrote: post #595
yayr wrote: post #553

Earlier quoted context omitted.

:-D something like zkIP (zero knowledge internet protocol)

You mean we should all switch to Tor? When everybody would use it, and ISPs would sell access, that could help the users to regain control over their data, and make privacy on the internet finally first class. I welcome this idea.

Sadly cloud flare blocks TOR, most of the time.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#617

Post by baash05 »

southerntofu wrote: post #413
yayr wrote: post #262

Earlier quoted context omitted.

This case is about IP address exposure, not cookies. This would still happen. So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure… this could probably be avoided by extending the sites terms.

> So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure Yes, and that's a good thing! A web page should only communicate with the server i've reached, there should be zero third-party involved unless i explicitly consent. That for example tag can use an arbitrary URL is explained by the fact that back in the day storage/bandwidth was expensive. The same is true for video…

I find that hard to understand. What server have you reached? Many sites are designed to be hosted by many servers at the same time. Sites hosted on Amazon are moved around depending on load and your location. Often you'll get part of the site from server X other bits from server Y.. images and css from an asset server and api data from one of many app servers.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#619

Post by account42 »

_0w8t wrote: post #261
capableweb wrote: post #114

Earlier quoted context omitted.

IP information will still be sent to Google, and a notice would have to put up before. Easiest way to deal with this is to self-host the videos. Most people over-estimate how popular their websites are, and for the ones who don't, getting a dedicated instance with unmetered bandwidth is trivial to get and setup for video-hosting.

Unmetered is often means 1 Gbit. With 4K video that means less than 100 streams. It may work, but the moment the video is shared among friends the site can be in trouble. Plus YouTube handles all re-encoding and adjust the quality based on the speed and device. It is possible to do it with open-source components, but it requires a server farm and just not feasible using single cheap private server or VPS.

> and adjust the quality based on the speed and device.

Now if only browsers would implement native HLS and/or DASH support then every site could have this without having to package a bunch of JS with different quirks of reach site.

Of course, it is not really in Google's interest to help YouTube competitors so this is unlikely to happen for Chrome.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#620

Post by account42 »

burntoutfire wrote: post #100
zinekeller wrote: post #78

Earlier quoted context omitted.

> For example, say I want to embed an instagram post on my website. In that case, you could: a) get a license (your suggestion), b) link but not embed Instagram pages, or c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. And indeed, some websites use c) without any problem, they even integrate it into the cooki…

> c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. This is how we arrive at cookie popups and annoying "you're leaving our website" notifications. I posit that perhaps both of these could be a feature of HTTP protocol and the browsers - i.e. a browser could just display a small standard icon in its UI notifyin…

> i.e. a browser could just display a small standard icon in its UI notifying user that he's consenting to cookies

If you need to notify the user that he is "giving consent" then there is no consent.

> and another one notifying him that he's being redirected outside of the domain he's in

There is rarely a reason to redirect to other domains. The most common case is making outbound links go through a redirect for tracking purposes - and that I won't miss.

Post reply on HN