Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

91–100 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#91

Post by onli »

remus wrote: post #71
onli wrote: post #23

Earlier quoted context omitted.

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

The part I find hard to understand is how you decide whether it is a necessity to load external content. For example, say I want to embed an instagram post on my website. You could argue that I should talk to the person who took the picture and get a license for the image so that I can host i on my own domain rather than loading the content for instagram. In practice this is obviously much, much more cumbersome than…

I agree that this is a big danger. When this thinking is taken too far you have an easy weapon in hand to destroy websites of your competition, the result would be having no websites in Germany anymore. But so far I've only seen clear-cut cases as this - that Google Fonts is not a valid option has been obvious since the DSGVO, maybe longer. So I refuse to be concerned and trust in a honest best effort approach (I host websites in Germany, there is always risk in that).

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#92

Post by foepys »

zinekeller wrote: post #78
remus wrote: post #71

Earlier quoted context omitted.

The part I find hard to understand is how you decide whether it is a necessity to load external content. For example, say I want to embed an instagram post on my website. You could argue that I should talk to the person who took the picture and get a license for the image so that I can host i on my own domain rather than loading the content for instagram. In practice this is obviously much, much more cumbersome than…

> For example, say I want to embed an instagram post on my website. In that case, you could: a) get a license (your suggestion), b) link but not embed Instagram pages, or c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. And indeed, some websites use c) without any problem, they even integrate it into the cooki…

c) is very popular among various German websites I frequent. Instead of the embedded content there is a blank area and you can consent with one click to send your data to $service which will then load the embedded content. Sometimes it also includes a direct link so you can open the embedded content in whichever way you like. I don't find this to intrusive or annoying, especially since the website can save your choice for later and can choose to never ask you again.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#93

Post by 844396484 »

miohtama wrote: post #10

Can you someone translate? Does this mean that hot linking any static media or asset from a third party is against the law unless explicit approval from the user is first received?

"Can you someone translate?" Here's my attempt at translating the first four paragraphs:

Dynamic IP addresses are a piece of PII (personally identifiable information) to the maintainer of a website. That's because the maintainer can identify the person using their IP with the suport of the ISP and the responsible authority.

The use of fonts services like Google Fonts is not protected by 'Art. 6 par. 1 S.1 GDPR' because the use of the same fonts is possible without connecting to the Google Fonts servers.

The visitor of a website is not responsible to conceal their IP (e.g. with a VPN).

The revelation of the visitor's IP to Google is a violation of visitor's rights. Given that Google is known to collect personal information to the discomfort of the user, the violation can be deemed so severe that it is justified to demand damages.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#94

Post by HL33tibCe7 »

vanviegen wrote: post #32
brtkdotse wrote: post #17

Earlier quoted context omitted.

Running a website in Germany seems like a god damned nightmare: https://allaboutberlin.com/guides/abmahnung-creative-commons

Whereas in the US you don't need to worry about frivolous lawsuits at all...?

Frivolous lawsuits, maybe, but frankly that’s irrelevant to the discussion at hand, which is the legislative liability of running a website. I’ve never heard anything even close to what the GP describes happening in any other country.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#95

Post by onli »

Aeolun wrote: post #90
onli wrote: post #23

Earlier quoted context omitted.

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system. Note how the decision contains the question of whether leaking the IP was necessary. They noted it i…

> if there is no way to embed Youtube videos without leaking the address But there is. Where does it stop being reasonable? When you have to host your own video delivery infrastructure?

I think there is not. You are not allowed to download the video and host it yourself, that would be a copyright violation. Am I missing a legally valid way?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#96

Post by maxwell86 »

rokizero wrote: post #38

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make se…

As a German citizen, this isn’t nuts.

Leaking extremely sensitive user data, like their IP addresses, to third parties, enable them to finger print users.

Leaking those to third parties outside the EU, and in particular to companies whose revenue depends on this finger printing, like Google, just to serve a font, it’s the dumbest thing I’ve heard all week.

The whole purpose of the GDPR is to discourage this behavior, requiring websites to inform users of all their crappy unnecessary things they want to do before they do it.

The only reason Google gives you hot loading for free is to get your users data. Trading your users personal data to serve a font is brain dead.

IMO this fine of 100€ is too small. They should have made it 10% of their revenue to send the clear message that this is not ok.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#97

Post by mro_name »

randalluk wrote: post #41
mro_name wrote: post #14

Earlier quoted context omitted.

yes. That's a fact. A 3rd party is a 3rd party and a website leaks it's visitors to it. Just don't do it but serve your stuff from your domain.

Doesn't this attitude overlook the "agency" of the "User-Agent"?

no, if external resources are pulled in prior informed consent then there is no agency. Such consent is a hard requirement.

If I visit example.com I am not to guess what 3rd parties it uses.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#98

Post by mola »

HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

Why do you think google fonts exist? For google to Get visitor IP all over the web without any form of user consent, this is exactly what the gdpr tries to kill.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#99

Post by bondarchuk »

maratc wrote: post #74
randalluk wrote: post #70

Earlier quoted context omitted.

The browser is the user-agent, ie. an agent acting on behalf of the user. The browser chose to fetch the font, based on the orinal response. It could be configured not to.

> It could be configured not to That's an opt-out and GPDR requires an opt-in.

You could also say that the user is opting in to loading a font from google when he actively sends the request to google. You could also say the user is opting in to storing cookies by accepting the file and writing it to his own disk, and sending the file back when the site asks for it. I think it is too late for these kinds of arguments in the EU though, and maybe with good reason, if it turns out the average citizen is not actually able to configure these kinds of decisions.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#100

Post by burntoutfire »

zinekeller wrote: post #78
remus wrote: post #71

Earlier quoted context omitted.

The part I find hard to understand is how you decide whether it is a necessity to load external content. For example, say I want to embed an instagram post on my website. You could argue that I should talk to the person who took the picture and get a license for the image so that I can host i on my own domain rather than loading the content for instagram. In practice this is obviously much, much more cumbersome than…

> For example, say I want to embed an instagram post on my website. In that case, you could: a) get a license (your suggestion), b) link but not embed Instagram pages, or c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta. And indeed, some websites use c) without any problem, they even integrate it into the cooki…

> c) embed in such a way that it shows a user-controlled notification that opening the embed will connect to Instagram and as a consequence sends data to Meta.

This is how we arrive at cookie popups and annoying "you're leaving our website" notifications. I posit that perhaps both of these could be a feature of HTTP protocol and the browsers - i.e. a browser could just display a small standard icon in its UI notifying user that he's consenting to cookies, and another one notifying him that he's being redirected outside of the domain he's in, The user could then configure the browser to auto-accept or auto-deny such attempts, review all the consents he's given earlier etc. - all in all, it would result in much better UX.

Google has probably not proposed and implemented something like this in Chrome already only because it would actually improve privacy and that's obviously not in their interest. Which proves that de facto giving up Web standards to the commercial entity was never a good idea. If the EU was better at execution, they would mandate something like this as the law, instead of the current requirements which can be met by just spamming users with popups no one reads.

Post reply on HN