Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

71–80 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#71

Post by remus »

onli wrote: post #23
HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

The part I find hard to understand is how you decide whether it is a necessity to load external content.

For example, say I want to embed an instagram post on my website. You could argue that I should talk to the person who took the picture and get a license for the image so that I can host i on my own domain rather than loading the content for instagram. In practice this is obviously much, much more cumbersome than embedding the IG post and so would result in huge changes how websites work (by vastly reducing any externally loaded content).

In a similar vein, you could argue that serving cached content from another host is not strictly necessary. Why not just run your own caching servers? It's probably worse in most ways (my cache server << cloudflare's cache server), but if minimising the amount of content loaded from external hosts is your aim then it is feasible.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#72

Post by Blikkentrekker »

onli wrote: post #23
HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

I have to say that this is such an example of new technology being scary but the problems with old technology being ignored.

I'm still waiting for the ability to have mail received from someone or a company without giving such parties my name and physical address. This could very easily be implemented in many ways, but somehow does not exist.

There is no reason for a mail order company to know my full name and physical address to deliver anything to do, and I feel this sis far more compromising than an i.p. address.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#73

Post by onli »

Vespasian wrote: post #59
onli wrote: post #31

Earlier quoted context omitted.

That specific scam does not have to work anymore though. Abmahnungen in Germany are the most stupid and lawyer serving system in the world, but the CC image scam got closed by judges deciding no monetary harm was done. Possible that these lawyers are still trying, but note that the article started 2018.

Do you have a link. I read that recently this specific scam was picking up steam in the US and was concerned about the implications here in Germany.

Yeah, I think https://www.rechtambild.de/2018/09/kein-schadensersatz-bei-c... references the decision I was remembering.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#74

Post by maratc »

randalluk wrote: post #70
dividedbyzero wrote: post #52

Earlier quoted context omitted.

What does the browser's user agent have to do with this?

The browser is the user-agent, ie. an agent acting on behalf of the user. The browser chose to fetch the font, based on the orinal response. It could be configured not to.

> It could be configured not to

That's an opt-out and GPDR requires an opt-in.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#75

Post by pwdisswordfish9 »

ChrisKnott wrote: post #50
noja wrote: post #33

Earlier quoted context omitted.

Seems pretty simple to me. I visit not-google.com, then don't load anything from elsewhere without being asked first. It's not too dissimilar to app-level permissions.

The counterargument to this is that you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML. This ruling could easily get overturned.

> you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML

Actually, most people don’t actually know that. And why would they? Why should they get bogged down in such technical minutiae? Why require users to play tedious uBlock whack-a-mole of enabling resources from external domains until the website starts working in order to have any semblance of privacy?

Just because something is common doesn’t make it right.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#76

Post by orra »

kleiba wrote: post #25
kiallmacinnes wrote: post #13

Earlier quoted context omitted.

Honestly, it's not that big a leap to reach this interpretation. 1) Your IP address is considered personal data, as it can be used to identify you. In general, everyone can see and agree with this. 2) In the absence of additional protections and/or contract terms[1], the transfer of personal data out of the EU is an offense under the GDPR (well, technically it's not out of EU, but transfer to a country without GDPR e…

1) Your IP address is considered personal data, as it can be used to identify you. In general, everyone can see and agree with this. Only if you're the sole user of that IP, which is e.g. not the case in a family.

No, that's not a criteria for “personal information” under GDPR.

Your name or your date of birth or your postal address isn't unique either, but they are still personal information.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#77

Post by iqonq »

ZeroGravitas wrote: post #67
iqanq wrote: post #53

Earlier quoted context omitted.

Isn't regulation precisely the act of acting in behalf of the citizens because they are seen as "too stupid" to know what they are doing?

When talking about UX, there's this bad habit of using people's mothers or grandmothers as examples, because they are 'too stupid' to understand the UI that was built. Aside from the obvious problems, this also implicitly removes blame from the designer/implementor of the interface. I always prefer to reframe it as someone with a very important, intelligence requiring job, say vaccine reasearcher, who doesn't have ti…

No post body was provided.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#78

Post by zinekeller »

remus wrote: post #71
onli wrote: post #23

Earlier quoted context omitted.

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

The part I find hard to understand is how you decide whether it is a necessity to load external content. For example, say I want to embed an instagram post on my website. You could argue that I should talk to the person who took the picture and get a license for the image so that I can host i on my own domain rather than loading the content for instagram. In practice this is obviously much, much more cumbersome than…

> For example, say I want to embed an instagram post on my website.

In that case, you could:

a) get a license (your suggestion),

b) link but not embed Instagram pages, or

c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta.

And indeed, some websites use c) without any problem, they even integrate it into the cookie popup. BBC even steps it up: all of their Twitter citations are screencapped and linked instead of other websites just embedding Twitter (in their defense, they can say that this is to preserve the context in case that the user subsequently deleted the post).

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#79

Post by brtkdotse »

questiondev wrote: post #68
brtkdotse wrote: post #36

Earlier quoted context omitted.

I too was pissed about the popups until I realized it the companies throwing up the popups that are to blame. Hosting all your assets by yourself, on your own servers and doing analytics without sending data to a third party is not a terribly tall order.

that is true but it increases the barrier to entry for those who use google fonts for system resource issues, a lot of people offload because they don’t have the space or money to self host everything one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of servers

A Google font file is just a small file, smaller than most images. You can download it and place is along side your css files.

And seeing how most websites are 20 megs+, the eco argument seems forced.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#80

Post by Youden »

questiondev wrote: post #68
brtkdotse wrote: post #36

Earlier quoted context omitted.

I too was pissed about the popups until I realized it the companies throwing up the popups that are to blame. Hosting all your assets by yourself, on your own servers and doing analytics without sending data to a third party is not a terribly tall order.

that is true but it increases the barrier to entry for those who use google fonts for system resource issues, a lot of people offload because they don’t have the space or money to self host everything one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of servers

A $5 VPS comes with several gigabytes of storage. A standard web font (e.g. Roboto) is ~1MB. Bandwidth is essentially free through CloudFlare. Who doesn't have the space or money to self-host their fonts?
Post reply on HN