Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

641–650 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#641

Earlier quoted context omitted.

IP information will still be sent to Google, and a notice would have to put up before. Easiest way to deal with this is to self-host the videos. Most people over-estimate how popular their websites are, and for the ones who don't, getting a dedicated instance with unmetered bandwidth is trivial to get and setup for video-hosting.

> Easiest way to deal with this is to self-host the videos. For most videos, this would be a copyright violation. i.e. there are now two laws which prevent reasonable technological solutions, making it harder for most people to host and produce content - favoring the already heavily advantaged big companies.

Good. It's about time we took a hard damn look at the ludicrous mockery of common sense that copyright has made of things. Maybe people will start to appreciate the freedom to create once they realize that $industry has made it nogh impossible to do anything without getting sued.

The solution to bad law is not to ignore it, it's to follow it to the letter, every time. Only then will people sit up take notice, and weigh the tradeoffs. In particular, we've let industry run away with far too much of the public's right to do things.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#642
This is great point, BTW. I always did not have time to "clean up" fonts - now I finally got it done. :-)

In my opinion, this should be _welcomed_ by WebDev community - this does improve privacy. In theory, DE court is right - your website should force user to connect only to itself.

I clearly see 2 ways of making this even simpler: use Lynx :-) or Tor Browser. The importance of Tor in today's business should increase. Yes, there are "shady" things there - but there they were in "clearnet" back in 90x ...

Makes sense.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#643
post #112
post #80

Earlier quoted context omitted.

A $5 VPS comes with several gigabytes of storage. A standard web font (e.g. Roboto) is ~1MB. Bandwidth is essentially free through CloudFlare. Who doesn't have the space or money to self-host their fonts?

This as well would "leak" the IP address to Cloudflare, wouldn't it?

https://www.cloudflare.com/en-gb/trust-hub/gdpr/

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#644
post #163
post #80

Earlier quoted context omitted.

A $5 VPS comes with several gigabytes of storage. A standard web font (e.g. Roboto) is ~1MB. Bandwidth is essentially free through CloudFlare. Who doesn't have the space or money to self-host their fonts?

I'm really starting to question why aren't we using fonts that are standard part of browsers? Just have a reasonable sub-set supported by everyone. This would be great climate action too as we would not be wasting energy to redownload them billions if not trillions of time.

Agreed. But why not update what ships with modern OS so that these fonts can be used system-wide? Open Sans, Noto Sans and Roboto for everybody.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#645
post #80

Earlier quoted context omitted.

A $5 VPS comes with several gigabytes of storage. A standard web font (e.g. Roboto) is ~1MB. Bandwidth is essentially free through CloudFlare. Who doesn't have the space or money to self-host their fonts?

I wonder if you can get penalized for sending users' IPs to CloudFlare..

https://www.cloudflare.com/en-gb/trust-hub/gdpr/

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#646

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

Using a CDN service operated by a non-GDPR business such as Cloudflare, Google, Amazon, or Akamai could potentially be confirmed to be a violation of GDPR, yes, if the CDN-hosted resources are used without opt-in. I’m eagerly awaiting the first complaint on these grounds to be reviewed and judged, now that the GDPR treaty with the United States has lapsed. It doesn’t matter where the CDN’s servers are; without the US…

Is CloudFlare really non-GDPR? https://www.cloudflare.com/en-gb/trust-hub/gdpr/

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#647
post #23

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

Hundreds of thousands if not millions of mom and pop blogs are linking to images, fonts, scripts, etc from various sites. Are you really going to fine them all? You're basically arguing any link to an image on imgur or flickr or wikimedia is should be fined.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#648
post #551

Earlier quoted context omitted.

>> This is exactly what happened... Not quite? Wouldn't the users browser have sent its own IP address to Google? That's different that "forwarding" it, and it may not even be enough for Google to connect the user to that site.

This argument was tried in the Fashion ID case. A company had inserted Facebook Like buttons on the web page, and argued that it was not responsible for the ensuing disclosure of personal data (such as IP addresses or possible tracking cookies) to Facebook. See, it was the browser and not the website operator that disclosed the data, and the website operator never had access to the data in the browser in the first pl…

That seems on the surface to be a ridiculous argument.

I can go "bash Maybe a better example. It type `npm -i somepackage`. npm then looks in somepackage and sees dependencies and downloads them. By the same logic as the judgement npm or `somepackage` is responsible for leaking PPI based on the dependencies listed. Not the user for running npm in the first place.

The same with `apt update` and `apt upgrade` etc...

The ruling would apply in tons of places that seem like they'd make it hard for things to keep working.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#649

Earlier quoted context omitted.

You don’t even need to host yourself the asset, just setup a reverse proxy that drops personal information and redirect the request to the source (Google, or whatever). It’s a simple Nginx rule.

Oh, super simple! The local bakery down the street just needs to figure out what a reverse proxy is, what a redirect is, and what Nginx is and how set rules for it, and then weigh the pros and cons vs self-hosting assets. I’m sure that’s easily doable for them, aren’t regulations fun?

They also will have regulations around financr, health codes, discrimination and hiring, etc etc.

Very few business owners are experts in all regulations when starting. You learn and adjust.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#650
post #23

Earlier quoted context omitted.

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

Hundreds of thousands if not millions of mom and pop blogs are linking to images, fonts, scripts, etc from various sites. Are you really going to fine them all? You're basically arguing any link to an image on imgur or flickr or wikimedia is should be fined.

> You're basically arguing any link to an image on imgur or flickr or wikimedia is should be fined.

Why do you think that? I would never agree that a link should carry any responsibility to the site owner, even if it linked to porn, warez or really illegal stuff.

Post reply on HN