GDPR penalty for passing on of IP address to Google by using Google Fonts

https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/

by sitting_duck • 4 years ago

389 641 4 years ago

bArray2• 4 years ago

After translating - the violation here is a website included third-party fonts from Google, and the fact that Google would be able to see their IP from the request violates GDPR?

Seems as though anybody who uses a CDN or third-party to load _any_ resources will violate GDPR by this measure? Seems like a pretty wide interpretation of this law.

perlgeek5• 4 years ago

That is exactly my reading as well.

silviot• 4 years ago

IANAL, but it sounds to me like a very important part of the story is that Google was not listed to end user as entity that would treat their data. Another way to read this could be: failure to inform users that their IP addresses were sent to Google resulted in a 100 € fine.

bArray2• 4 years ago

Sure, but this also seems bad for the small web. Imagine for example some small blog embeds a Youtube video into their static page - suddenly they are getting 100 euro fines all over the place.

Also this entire case overlooks the point that this user was tech aware enough that they knew their IP was getting sent to Google, was deeply upset by this, but didn't get an ad blocker? This feels like a contrived use of GDPR.

kiallmacinnes2• 4 years ago

Honestly, it's not that big a leap to reach this interpretation.

1) Your IP address is considered personal data, as it can be used to identify you. In general, everyone can see and agree with this.

2) In the absence of additional protections and/or contract terms[1], the transfer of personal data out of the EU is an offense under the GDPR (well, technically it's not out of EU, but transfer to a country without GDPR equivalence).

So - embedding code / data from a 3rd party into your website results in a transfer of personal data.

[1] The idea of additional protections/contract terms is even questionable, but that's a whole other thing...

kleiba• 4 years ago

1) Your IP address is considered personal data, as it can be used to identify you. In general, everyone can see and agree with this.

Only if you're the sole user of that IP, which is e.g. not the case in a family.

curiousfab• 4 years ago

This is regulated in the GDPR, article 28. You may have an external "processor" of your data (which is almost always the case, because few people have full responsibility over their hosting setup), but this processor is bound to abide the rules of the GDPR, and you need some sort of contract with the processor.

Since you have no control over what Google does with the data of visitors when you embed Google Fonts, it is not compatible with the GDPR (just like Google Analytics).

https://de.wikipedia.org/wiki/Datenverarbeitung_im_Auftrag https://www.gdpr.org/regulation/article-28.html

This is a good decision by the court. Sure, web developers may not like it, but it may force them to improve on how they work.

Vespasian14• 4 years ago

The court explicitly noted that the IP was exfilled to the United States where adequate data protection measures do not exist and that Google in particular is well known for invasive data collection

The court also noted that there was an alternative in the form of embedding the fonts directly into the website.

I'm not a lawyer, but the reasoning doesn't sound like CDNs are a problem in General, but that one should be very careful before connecting to US servers (which was always one of the goals of the GDPR)

kevincox7• 4 years ago

That has interesting implications for anycast CDNs. In fact do you now need a separate DNS name for europe to be sure that the DNS query doesn't get anycasted to another country ever?

red_trumpet• 4 years ago

(IANAL)

They say that GDPR Art. 6 Par. 1, (f) (see [1]) is not applicable, so using a webfont from google is not "necessary for the purposes of the legitimate interests pursued by the controller". They explicitly say this is because you could host the font yourself.

In my interpretation, another way could be to use Art. 6 Par. 1 (a), namely ask the user for permission before loading a Google font.

[1] https://gdpr-info.eu/art-6-gdpr/

ehnto• 4 years ago

Seems like a pretty wide interpretation of this law.

That was my initial reaction, but I must admit I have since decided that was because it's an inconvenient truth to me. No one visiting mydomain.com should have to assume google.com is going to receive information about them without their prior consent, and there's usually no mechanism for consent prior to loading webfonts or CDN assets.

It is very much in the spirit of the GDPR that all knowledge sharing should have prior consent, and this follows with that.

You can see the industry flailing to compensate for the sudden increase in responsibilities it has been getting recently. It's not a wild west anymore, we should be a mature industry, and mature industries have regulations earned from previous failures to be ethical or safe. That's what I see happening, the industry is getting harder to operate in, but it's just reaping what it sowed.

the_mitsuhiko2• 4 years ago

It seems like if there were a data processing agreement with Google that they don’t process the IP for web fonts it would be fine too.

somytsu2• 4 years ago

Yes, I also think that.

From this site [0]:

"Virtually every business relies on third parties to process personal data. Whether it’s an email client, a cloud storage service, or website analytics software, you must have a data processing agreement with each of these services to achieve GDPR compliance."

[0] https://gdpr.eu/what-is-data-processing-agreement/

rndgermandude2• 4 years ago

There are some important points to mention:

* the court explicitly stated that this case was about transferring personal data (the IP) without prior consent. If the user had consented, there would have been no case.

* the court explicitly criticized using google, because google a) is known to collect user information and b) google is a US company and the European courts have found the US is lacking in privacy laws. So my reading is that the judgement would not apply if you transferred such data in certain circumstances, e.g. if you transferred such data to provide "essential services" and you have contracts with the data processor about how they can use and store the data that are in accordance with German privacy laws.

* the court further stated that it sees no reason to transfer such personal data, as the website could have easily provided the fonts itself. This seems to be a crucial part of the courts reasoning, as it is a ruling on the plaintiff's claim that this use of google was exempt because it was "necessary" to provide the service.

nightgarden2• 4 years ago

So, soon on top of all the cookie notices that are already there, we are also going to have to consent initially before anything loads to downloading the javascript from 3rd party to manage all the consents? Lol.... Just what the internet needs...

HatchedLake721• 4 years ago

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell?

Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202...

The defendant is sentenced to pay the plaintiff €100.00
The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction with Section 1004 of the German Civil Code.
It is undisputed that the plaintiff's IP address was forwarded to Google when the plaintiff visited the defendant's website.

mro_name10• 4 years ago

yes. That's a fact. A 3rd party is a 3rd party and a website leaks it's visitors to it.

Just don't do it but serve your stuff from your domain.

Vespasian14• 4 years ago

Also Google can definitely make use of That information because they know so much about the user that a single IP connect is enough to establish that a specific user visited that website.

randalluk2• 4 years ago

Doesn't this attitude overlook the "agency" of the "User-Agent"?

XCSme3• 4 years ago

from your domain

Not only from your own domain, but from your own servers. If you still server-side send the IP to Google servers, it's still sharing of personal data with a 3rd party.

I wonder how this works when you rent servers from VPS providers. If you host data on their servers, does it mean you share it with them? What if this data is behind a root password? What if it's encrypted?

mminer237• 4 years ago

Note that if you are an American, this still isn't a solution. This ruling prohibits any US citizen having EU IP addresses. So if you as an American host your own servers, you either have to remove all connection logging or ban all Germans.

brtkdotse6• 4 years ago

Running a website in Germany seems like a god damned nightmare:

https://allaboutberlin.com/guides/abmahnung-creative-commons

bruce3434342• 4 years ago

You just need to have a bit of common sense about what's good for your users and what's not good for them.

That copyright example by the way, that applies everywhere.

onli11• 4 years ago

That specific scam does not have to work anymore though. Abmahnungen in Germany are the most stupid and lawyer serving system in the world, but the CC image scam got closed by judges deciding no monetary harm was done. Possible that these lawyers are still trying, but note that the article started 2018.

vanviegen2• 4 years ago

Whereas in the US you don't need to worry about frivolous lawsuits at all...?

Aeolun3• 4 years ago

And they decided to pay? FFS… well, that was certainly educational.

It has a very chilling effect on innovation no doubt.

croes• 4 years ago

Spreading your data across the internet is the real nightmare

snickerbockers• 4 years ago

Why can't they just read the terms of the license before they use the content? By this logic, saying that you didn't cause any economic damage because the software is freely available ought to be a valid reason to violate the terms of the GNU GPL.

bitwize• 4 years ago

A smaller nightmare than the dystopian surveillance the free-market free-for-all in the USA has manifested.

The government has the absolute authority to regulate you into a corner, if need be, to protect its people from predation by powerful interests. That's what governments are for.

Kim_Bruning4• 4 years ago

This is called copyleft trolling, and is a problem outside Germany as well. It's a known bug in early CC licenses, and has been fixed as of CC 4.0 .

https://doctorow.medium.com/a-bug-in-early-creative-commons-...

(action still required: authors need to update to CC 4.0 or later)

onli11• 4 years ago

Why "what the hell"? This is exactly what happened, and a logical consequence the moment IP addresses are classified as private data. Which it is in a system where it can be used to find the civil identity of the user, which is the case in Germany via Vorratsdatenspeicherung and the rampant misuse of the legal system.

Note how the decision contains the question of whether leaking the IP was necessary. They noted it is not necessary to serve the fonts via Google, it can happen without leaking the IP (I assume they mean self-hosting):

Google Fonts kann durch die Beklagte auch genutzt werden, ohne dass beim Aufruf der Webseite eine Verbindung zu einem Google-Server hergestellt wird und eine Übertragung der IP-Adresse der Webseitennutzer an Google stattfindet.

translated:

Google fonts can be used by the defendant in a different way, so that a connection to the website does not make a connection to the Google server, thus without transmitting the IP address of the website visitor to Google.

Which is good news! It is a totally consistent decision with the current privacy rules and best practices: Do not save or leak private data if not necessary, always minimize data exposure as much as possible. The as much as possible part is very important - if there is no way to embed Youtube videos without leaking the address, then that's still possible to do. Sounds fair to me.

brtkdotse6• 4 years ago

Look and learn from Yubico, they don’t show any YouTube embedded videos until you agree to functional cookies:

https://www.yubico.com/?lang=sv

remus• 4 years ago

The part I find hard to understand is how you decide whether it is a necessity to load external content.

For example, say I want to embed an instagram post on my website. You could argue that I should talk to the person who took the picture and get a license for the image so that I can host i on my own domain rather than loading the content for instagram. In practice this is obviously much, much more cumbersome than embedding the IG post and so would result in huge changes how websites work (by vastly reducing any externally loaded content).

In a similar vein, you could argue that serving cached content from another host is not strictly necessary. Why not just run your own caching servers? It's probably worse in most ways (my cache server << cloudflare's cache server), but if minimising the amount of content loaded from external hosts is your aim then it is feasible.

Blikkentrekker2• 4 years ago

I have to say that this is such an example of new technology being scary but the problems with old technology being ignored.

I'm still waiting for the ability to have mail received from someone or a company without giving such parties my name and physical address. This could very easily be implemented in many ways, but somehow does not exist.

There is no reason for a mail order company to know my full name and physical address to deliver anything to do, and I feel this sis far more compromising than an i.p. address.

Aeolun3• 4 years ago

if there is no way to embed Youtube videos without leaking the address

But there is. Where does it stop being reasonable? When you have to host your own video delivery infrastructure?

martincmartin• 4 years ago

(I assume they mean self-hosting)

Or proxying. Or proxying with caching, which is kind of part way between self-hosting and proxying. :)

jstummbillig6• 4 years ago

Sounds fair to me.

The part that is tricky, is where we offload additional burden of knowledge and responsibility to the website providers.

When it is on the user to figure out whether they are allowed to use a product – and that means in fact any product – that one of the biggest companies in the world is allowed to offer in my country legally, we are in trouble.

Law is complex. Tech is complicated. Most people are not law or tech experts. Getting sound advice on both is expensive, and the trend to increasingly need more of both is worrisome.

This seems neither fair nor reasonable to me. Or particularly democratic.

phkahler3• 4 years ago

> This is exactly what happened...

Not quite? Wouldn't the users browser have sent its own IP address to Google? That's different that "forwarding" it, and it may not even be enough for Google to connect the user to that site.

baxtr• 4 years ago

This is not good news. This indeed very bad news. Especially for entrepreneurs in Germany who must constantly fear to be convicted for something as ridiculous as this.

ab_testing• 4 years ago

Does that also imply that do not use a cdn to serve any of your assets as that will also leak the up address to third parties.

asiachick2• 4 years ago

Hundreds of thousands if not millions of mom and pop blogs are linking to images, fonts, scripts, etc from various sites. Are you really going to fine them all? You're basically arguing any link to an image on imgur or flickr or wikimedia is should be fined.

noja• 4 years ago

Seems pretty simple to me. I visit not-google.com, then don't load anything from elsewhere without being asked first. It's not too dissimilar to app-level permissions.

ChrisKnott• 4 years ago

The counterargument to this is that you are knowingly using a piece of software that has, and has always had, the default behaviour of autoloading remote resource links it finds in HTML.

This ruling could easily get overturned.

xtracto2• 4 years ago

Not only that... I visit foo.com , the browser will query 3rd parties for DNS, moreover when retrieving data from foo.com several shops will need to be done (see traceroute foo.com) . All of those should be disclosed and explicitly approved by the indefensive user!! And then, is foo.com hosted in servers that are not property of the website provider? (AWS, GCS)? oh shit, that's sharing without consent!! Another prompt for the user. Oh wait but that prompt should come before sharing the data!!

GDPR is going to manage to make the internet unusable. Who would've thought it was going to be bureaucrats the ones to kill the web!

mola• 4 years ago

Why do you think google fonts exist? For google to Get visitor IP all over the web without any form of user consent, this is exactly what the gdpr tries to kill.

oblio5• 4 years ago

Nah, it's charity, come on. /s

HL33tibCe77• 4 years ago

What value exactly is there in Google seeing that IP X requested font Y, assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?

laurent92• 4 years ago

The whole strategy with Google providing “services for everyone out of pure gratitude” is:

- With Google Fonts, to track the identity of users AND the real popularity of websites,

- With Google DNS 8.8.8.8, to track everyone’s DNS resolutions,

- With Google Analytics, to track who sees what, even if they only display masked IPs to the owner of the GA profile,

- Etc with Google Maps, emails, they don’t provide those services for free, they can track everyone’s profile, down to their obedience to Covid rules.

I wouldn’t be surprised if Germany bans more aspects of using Google’s free services.

Hnrobert424• 4 years ago

I agree, but the court did not ban Google fonts. It required consent before using it.

benmmurphy• 4 years ago

The plaintiff’s IP address was also leaked to every intermediate router and potentially to the DNS server(s) that resolved the IP address.

dathinab3• 4 years ago

Yes, but there is one small difference:

The sharing with ruters etc. is required to operate the service (website). Using a Google CDN for fonts isn't (required for operating a website).

The ruling explicitly points that out.

Furthermore DNS is handled by the contract you signed with you ISP or you explicitly changing it. Same for some other parts.

perlgeek5• 4 years ago

The reasoning behind this judgement is:

The services (here: web fonts) could be supplied another way, so exposing the user's IP to google is not strictly necessary, from a technical POV.

The user's IP is PII, and exposing it unnecessarily to third party is a GDPR violation.

The way this is phrased, the reasoning applies to basically every static resource loaded from a CDN or other third-party website.

lucian1900• 4 years ago

It’s “personal data” in GDPR. PII is the US concept and much narrower.

kevincox7• 4 years ago

The services (here: web fonts) could be supplied another way

The problem here is that every service could be provided another way. It seems that the only actual hosting option that doesn't leak a user's IP to a thrird-party is first-party only over Tor. Do we demand that every website is built that way? It turns out that outsourcing actually has a lot of value.

So where do we draw the line? Google Fonts apparently needs to be reimplemented first-party. What about Google Cloud CDN? What about an ISP that sees the user's IP in the packets?

miohtama2• 4 years ago

The services (here: web fonts) could be supplied another way, so exposing the user's IP to google is not strictly necessary, from a technical POV.

Because an IP address needed to receive a download. This kind of decision means that any hot linking of static media assets is now in hot waters.

A sensible judge would say IP address is not PII but a prerequisite to use Internet in the first place. Like a license plate on car e.g. other broken analogue of tracking. Like a power socket. However the definition of PII in Europe is overly capturing (saying this as an European.)

valzam• 4 years ago

The problem of course is that IP addresses can totally be used by Google to build up a profile of your browsing behaviour across the whole web. Even if typical end User ip4 addresses change quite a lot due to ISP NATs I imagine it's still very valuable information. Obv with ipV6 and static IPs for everyone it becomes a privacy nightmare

vanviegen2• 4 years ago

I agree that license plates make an apt comparison. How would you feel if private companies set up plate readers at just about every parking area everywhere?

Like with IPs, they wouldn't be able to identify unique individuals with 100% certainty (as both IPs and cars may be shared), but they'd get pretty close. Certainly when it can be combined with other data.

So yeah, to me it makes sense that IPs are personal data.

ZeroGravitas4• 4 years ago

This seems logical and reasonable to me, though it seems others are surprised/appalled.

What would a technical solution that respects privacy look like? The website making the call to Google in the background (minus user details) and forwarding the response onward? Why isn't it done that way, it feels like it's the more obvious solution if you're not trying to track users.

Early internet was very wary of 'hotlinking' because it costs money to serve things, people used to try to offload hosting costs to others. Now it seems people take that on willing with the expectation to make enough money to cover it.

Is it just scale, or is it the user info that makes these services viable?

Early Google used to use the argument that them making the web better was profitable, because more people using the web meant more money for them. Does that still apply? Would they still provide Google Fonts if they were legally bound to not use any user information they recieved?

tgv• 4 years ago

What would a technical solution that respects privacy look like?

In case of fonts: hosting it on your domain.

Scarblac2• 4 years ago

A main selling point of using CDNs for commonly used assets (like Google fonts) is that lots of websites use the same URL, so the browser is likely to have the asset in cache already from a previous use on another site. Makes the site faster and uses less bandwidth.

I don't think there is a solution right now. Maybe browsers can stop sending these headers to well known CDN domains by default.

daanlo• 4 years ago

I think one of the main reasons it is done via hotlinking is that it is easier for the „webmaster“ to copy a JS snippet than to do something server side or self host. Most of these webmasters aren‘t developers.

This is particularly true for anything that comes as a „module“, like GDPR cookie notices (that are very frequently included via a JS snippet loaded from a third party site).

l0rn• 4 years ago

german law doesn't really know "precedent cases". However it looks like a whole new industry of lawyers sueing pages embedding stuff could arise...

izacus2• 4 years ago

Leaking customer data to Cloudflare is also a very interesting question here.

ar0• 4 years ago

They seem to count CDNs as "hosting providers" and yes, without the necessary legal frameworks in place, this is also a problem if that leaks user data: https://www.technologylawdispatch.com/2021/12/privacy-data-p...

greggsy• 4 years ago

If your website requires CF to reliably deliver data to customers, then it’s unlikely to cause much of a stir.

krehl2• 4 years ago

What about using e.g. Webflow? Can I leak the IP address of the customer if I don't know it myself?

blfr• 4 years ago

What about "leaking" the IP to your server provider and all the networks between your user and site?

fsloth• 4 years ago

Very good point, the courts in countries with common law work quite differently than where the courts are based on civil law. There is a quite large difference of the two systems.

https://en.m.wikipedia.org/wiki/Common_law

johnchristopher4• 4 years ago

Wait, what prevents the next court to say that the browser vendor is responsible for the leak ? Per default the browser is not asking the user if it's okay to download fonts from Google (or any resources from any another resources provider) after all.

posterboy• 4 years ago

The browser can be set to dissallow third party resources

johnchristopher4• 4 years ago

Keyword: per default. It's an opt-out, GDPR requires an opt-in.

foxfluff3• 4 years ago

Why is it not the author of your NIC driver who is responsible for the leak? Per default the driver isn't asking whether to send a packet to Google's IP address.

Here's why: the driver is just doing what it's told to do. The responsible falls on the party who does the telling. If a website tells my browser to load resources from Google, it's not on my cpu or my nic or its driver or kernel or firewall or the browser.

johnchristopher4• 4 years ago

Thank you for your comment but this point has already been invalidated. See https://news.ycombinator.com/threads?id=johnchristopher#3013... and replace "browser" with "NIC".

No need to backtrack.

The website has delivered an HTML document. It's up to the user to do what he wants with it and follow links or not.

miohtama2• 4 years ago

Can you someone translate? Does this mean that hot linking any static media or asset from a third party is against the law unless explicit approval from the user is first received?

mro_name10• 4 years ago

yes.

Vespasian14• 4 years ago

If there are different means to host the asset and the hot linking would transfer data out of the EU (in particular to the US and to a giant marketing company) that might be problematic.

mro_name10• 4 years ago

Traffic inside or outside EU is marginal. It's just illegal from the start. You need prior informed consent and it must be optional.

If it is not technically necessary. And a CDN rarely is. I can show you some sites that do without.

jlokier3• 4 years ago

No. (Contrary to the sibling comment).

If you have agreements in place with third party data processors to protect user privacy, this ruling does not prevent you from hot linking third party assets under that agreement. In effect, the third party acts as part of your infrastructure - just like you may already use a third party hosting provider, cloud database provider, auth provider, logging service, etc.

The GDPR constrains how PII is stored and processed. It doesn't stop you from using third party providers, but it does make you responsible for ensuring user privacy is protected, by delegation through binding privacy agreements and sufficient diligence.

Those types of agreements are already common. For example, if you're hosting on AWS providing service to users covered by GDPR, you should already have such an agreement. It's pretty straightforward. https://aws.amazon.com/compliance/gdpr-center/

Therefore if AWS offered a generic, third party font hosting or embedded video hosting service, you could hot link to that no problem.

Same with Cloudflare, Google Cloud, etc. as long as they provide the necessary agreements with you.

The problem with Google Fonts is there is no such agreement in place, you can't trust Google to not profile users statistically via font requests, and even if Google says they won't do that, you can't trust that their servers in the US won't be tapped by US authorities to monitor request logs, etc.

jeroenhd2• 4 years ago

The data processing agreement with American companies is probably not enough because the USA doesn't sufficiently protect the users' privacy under the GDPR.

It's only possible to go this route if the country has the approval of the EU through the necessary legal frameworks. That's what Privacy Shield and its predecessor were, and both were deemed insufficient.

Your point about a data processing agreement is true, but I wouldn't rely on AWS/Cloudflare/Google until the EU and USA manage to get this stuff worked out.

844396484• 4 years ago

"Can you someone translate?" Here's my attempt at translating the first four paragraphs:

Dynamic IP addresses are a piece of PII (personally identifiable information) to the maintainer of a website. That's because the maintainer can identify the person using their IP with the suport of the ISP and the responsible authority.

The use of fonts services like Google Fonts is not protected by 'Art. 6 par. 1 S.1 GDPR' because the use of the same fonts is possible without connecting to the Google Fonts servers.

The visitor of a website is not responsible to conceal their IP (e.g. with a VPN).

The revelation of the visitor's IP to Google is a violation of visitor's rights. Given that Google is known to collect personal information to the discomfort of the user, the violation can be deemed so severe that it is justified to demand damages.

Puts7• 4 years ago

It has nothing to do with approval. This specific ruling is about the principle of data minimisation. If you process personal data you must do a risk assessment and make sure you only process no more data then strictly necessary. This applies even if you have consent. So in this case since you can host the fonts yourself to not share data (IP, time, browser agent, cookies) with Google you should.

floatingatoll10• 4 years ago

No.

This means that embedding any resource from a non-GDPR destination URL is a violation of GDPR law unless explicit opt-in approval from the user is first received.

If you are subject to GDPR law, then the above applies to all sites owned and operated by you and your subsidiaries. If you are not subject to GDPR law, then the above does not apply.

Resources could be hosted by http:, https:, ftp:, or any other protocol. Resources could be .js, .gif, .html, or any other format.

If you’re asking “can I dynamically detect the user’s country of origin and enable GDPR protections only if I determine they’re in that country?”, no: the user has a right to legal protection if they are a citizen of a GDPR-protected country and are residing in a GDPR-bound country, regardless of what their IP address is.

(I am not your lawyer, this is not legal advice.)

tzs3• 4 years ago

the user has a right to legal protection if they are a citizen of a GDPR-protected country and are residing in a GDPR-bound country, regardless of what their IP address is.

Nit pick: GDPR is written in terms of people "in the Union", not citizens.

ianpurton• 4 years ago

Hopefully we won't see popups like "This site will forward your IP address to Google is that OK?", because I'm already beyond bored with "This site uses cookies do you accept?".

brtkdotse6• 4 years ago

I too was pissed about the popups until I realized it the companies throwing up the popups that are to blame.

Hosting all your assets by yourself, on your own servers and doing analytics without sending data to a third party is not a terribly tall order.

questiondev• 4 years ago

that is true but it increases the barrier to entry for those who use google fonts for system resource issues, a lot of people offload because they don’t have the space or money to self host everything

one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of servers

losvedir• 4 years ago

Actually, your comment made me wonder how far does this go? Where does "third party" end? If I self host on Hertzner or Linode, I imagine their infrastructure logs IP addresses like Google Fonts here. But surely that doesn't require consent. Why not, what's the difference? What if you host with a much sketchier provider? I could see politicians thinking users would want to know if their requests were served by, say, China or Russia.

dgellow2• 4 years ago

You don’t even need to host yourself the asset, just setup a reverse proxy that drops personal information and redirect the request to the source (Google, or whatever). It’s a simple Nginx rule.

5e92cb50239222b• 4 years ago

Go to uBlock Origin settings and check every item in the 'annoyances' list. I haven't seen a single cookie banner for a few years now.

(This is assuming you're using uBO, because who the hell isn't these days?)

foepys3• 4 years ago

The interesting thing that a lot of services don't consider is that blocking these cookie banners is perfectly allowed and does not implicitly allow services to collect personal data.

Twitter is one of those service that just states "we collect data, deal with it when using this website" (which is already not legal) but the thing is, I don't even see this pop-up because uBlock is filtering it out. If Twitter now collects my personal data, it is not only breaking the opt-in component of GDPR but also doesn't even notify me about data collection.

Quite a lot of services have JS-only popups which I also don't see. Do they collect data? I think so. Do they know they are doing it illegally? I would bet quite a bit of money that they never thought about somebody getting past their cookie banner without consenting, so probably no.

smilespray• 4 years ago

People who have other priorities and interests than technology.

HL33tibCe77• 4 years ago

Non-technical users that I’ve seen interacting with these prompts literally just look for the button with the most prominent colour and click it.

Frankly, I’ve even found myself doing this without thinking on occasion. The prompts are beyond useless.

dgellow2• 4 years ago

For years I was going in the list of vendors and disabling everything. Now I became so bored by these prompts I decided to instead just accept everything and clean my cookies every week. I’m less frustrated this way, and still feel I have control over my privacy.

jeroenhd2• 4 years ago

There's no difference between that popup and IP sharing consent. It's not about cookies, it's about tracking and tracking risk.

Smart websites would just host the font files on their own domains but I guess the dumber ones will just add Google Fonts and similar to their consent list, yes.

2ion3• 4 years ago

You'll just see HTTP451 more.

eps3• 4 years ago

On the other hand, there was a post on the front page recently that said that showing opt-in 3rd party cookie prompts resulted in over 90% refusal rate.

Ignorance is a bliss, but if given a choice to not share extra info with random companies, many will in fact take that opportunity.

So a popup warning that your visit to this website will be recorded by Google may be just what the doctored ordered to shake people of their nirvana and make them look at things a bit more closely.

ealexhudson• 4 years ago

This is a good judgment and less onerous than people are worried about here: there's not going to be a need for a raft of pop-ups.

GDPR is clear about processing personal data. If you're a website, you're a data controller, and you are responsible for the security/confidentiality/etc. of that data. If you want to use external services that's cool, but you need a formal data processor agreement in place that maintains your control of the data, and you need to list that in your privacy policy.

So, can you embed fonts? Yes, it's not a problem: either they should have directly embedded self-hosted stuff and not used the supplier, or ensured a proper data processor agreement was in place. Post-Schrems II, the latter becomes more difficult if the supplier you're contracting with cannot promise the level of control over privacy/etc. that you need as a data controller, however.

The alternative position is to say that it's OK to embed resources that basically allow large corporates like Google to track your activity across the web without an agreement in place. That's obviously not OK under GDPR.

rokizero• 4 years ago

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make sense?

AndrewDucker• 4 years ago

Yes. If it's not technically necessary then don't do it. Host the fonts yourself rather than letting Google track people to your site.

maxwell86• 4 years ago

As a German citizen, this isn’t nuts.

Leaking extremely sensitive user data, like their IP addresses, to third parties, enable them to finger print users.

Leaking those to third parties outside the EU, and in particular to companies whose revenue depends on this finger printing, like Google, just to serve a font, it’s the dumbest thing I’ve heard all week.

The whole purpose of the GDPR is to discourage this behavior, requiring websites to inform users of all their crappy unnecessary things they want to do before they do it.

The only reason Google gives you hot loading for free is to get your users data. Trading your users personal data to serve a font is brain dead.

IMO this fine of 100€ is too small. They should have made it 10% of their revenue to send the clear message that this is not ok.

izacus2• 4 years ago

IP Address is far from "extremely sensitive user data". Really.

Vespasian14• 4 years ago

I agree with everything you said except the last paragraph.

100€ was fine in my opinion, because a) it isn't that big of an infraction b) it probably was their first offense and c) this legal ruling is indeed setting some kind of precedence and therefore was unexpected given industry practices. If the ruling stands and other courts follow a similar reasoning I would expect higher fines in the future.

dgb232• 4 years ago

You have a point and I as a dev will ensure to follow this principle. The issue is that serving fonts and other assets from an external service is pretty much normal practice. This is new ground. The understanding so far was explicit tracking being the issue and not serving static assets. This ruling makes sense but goes way beyond what the consensus was so far.

mawadev2• 4 years ago

Exactly. Why would you serve your own copy of the fonts if a previous request to that cdn may have cached them in your browser already? Opt-In goes against the architecture of websites. What's next? A popup for each third party request? It is not feasible and just another stumbling block - like Impressum for private persons and third party cookie consent to host websites in Germany. It makes more sense to fix the issue at the fundamental browser level by the vendor (natively, without the need for plugins) and explain the dangers to the users. Educated users block requests anyway for example.

I think hosting it by yourself is the solution here, but it's getting difficult to keep up with all the rules, especially when the fundamental design of the web moves in the opposite direction.

youngtaff• 4 years ago

a previous request to that cdn may have cached them in your browser already? Opt-In goes against the architecture of websites

Browsers partition their caches by origin and third-party origin (it's a bit more complex than that in reality) so common third-party resource e.g. fonts, used on one site won't be reused on another

Instead a fresh version of the font will will be fetched

Safari's done this since 2013 (?), and Chromium & Firefox adopting the same behaviour in 2020 (?)

isbvhodnvemrwvn9• 4 years ago

The browsers don't share third-party caches across domains, because it made it easier to leak information about which sites the user has visited.

fooblat2• 4 years ago

It seems pretty reasonable to me.

1. In Germany an IP address is considered PI under GDPR because it is easily associated to a natural person.

2. Google is open about the fact that they log IP address with Google Font request activity, which includes the page you are on.

3. GDPR requires justification by necessity to collect and/or send PI to a 3rd party without consent.

4. No consent was given.

5. It is not necessary in this case because it is possible to use Google Fonts in other ways that don't send PI to Google, without significant burden.

I'm not a lawyer but I am responsible for GDPR compliance at a German startup.

edit: typo

Jyaif4• 4 years ago

By that logic you must self-host any landing page, otherwise you are leaking IP addresses to whoever is hosting your website.

akvadrako• 4 years ago

Informing them is probably not enough – you would need explicit consent and a fallback option. The only reasonable option is not to do it or maybe it's possible to get a contract with google regarding processing of personal data.

Mystlix• 4 years ago

This decision is incredibly coherent with the fact that tracking can be done in many ways other than with cookies. Your residential IP doesn't change that much and Google keeps track of it. Google can track your navigation through websites and associate it to your google account or shadow account just by seeing if you downloaded one of their fonts through said websites. So bravo to the Munich court for actually upholding rules against opt-out third party tracking

ddmma• 4 years ago

This could be extended to any API request, if involves IP tracking

perlgeek5• 4 years ago

I'd say for requests that return dynamic data, a case could be made that there is technical merit for the client doing the request instead of the server proxying the request.

leobg17• 4 years ago

District courts are notoriously terrible. Judges are overworked. They are incentivized for dealing with cases as quickly as possible. As a judge, you actually get penalized for handling cases diligently. Many judges can’t even touch type, so even when they do go through the motions of doing legal research, they type in a few crude keywords, skim the first results presented by the algorithm, and then call it a day.

HL33tibCe77• 4 years ago

Unfortunately, GDPR is an insane web of laws and regulations that any non-lawyer has absolutely no hope of understanding.

mawadev2• 4 years ago

This is exactly what stops me from hosting websites. I simply have given up trying to keep up with the rules. It is a massive burden if you are not a corporation trying to extract information and just want to host a simple blog from a german server. At some point, private persons and maybe small businesses won't be able to keep up and the web becomes even more centralized.

somytsu2• 4 years ago

It is possible to host a blog wihout third party services.

Maybe small businesses should focus on minimal websites and build from that. As you grow, you can more easily affort the costs for lawyers to check if the features you want to build are GDPR compliant.

oblio5• 4 years ago

https://gdpr.eu/compliance/

The whole thing, including guides, is much shorter than the spec for HTML: https://html.spec.whatwg.org/multipage/

Probably clearer, too.

And just like for specs there are even better third party doc sites you can use: https://gdpr-info.eu/

Dry reads, but it's not like RFCs are heart wrenching novels either :-D

anilakar• 4 years ago

It always puzzles me how people making six figures a year for translating real-life requirements to technical ones suddenly throw a tantrum when said requirements involve law.

chrischapman2• 4 years ago

Disagree. The key information is no longer than an average privacy policy (and frankly, less complex) and whereas there are millions of privacy policies (which no one ever reads), there is only one GDPR. Give it one hour of close reading and you'll see just how important and useful it is. It's worth the effort because you only need to do it once.

leobg17• 4 years ago

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the website itself to Google sharing the user’s IP address never actually occurs.

isbvhodnvemrwvn9• 4 years ago

Using this logic I can send full fingerprinting data as long as I do it from the front-end?

I mean courts are not that dumb, it's still the website owner which decides what is done.

Already__Taken• 4 years ago

The website owner decides what's asked to be done. The browser is still owned by the end-user can choose to make the request. This is why ad-blocking is fundamentally required.

Andrew_nenakhov6• 4 years ago

Browser can be configured not to send this data.

If I ask you to jump from the bridge, and you do, how is it my fault that you chose to comply?

leobg17• 4 years ago

I can put “rm -r /user” in my HTML as long as I want. It’s the user’s browser that decides what gets executed. This is a fundamental principle in the architecture of the internet. You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those.

Luc• 4 years ago

The end result is that the fact that you visited this website is passed to Google, and this can then be used for advertising purposes.

leobg17• 4 years ago

This is true. But the request containing that information is being sent by your own computer. It’s bit a “doing” of the website owner.

jstummbillig6• 4 years ago

and this can then be used for advertising purposes.

Can it? Is this within the range what Google is allowed to do in the EU right now?

Because, if that is the case and we also wanted to stop that, wouldn't it be a lot more reasonable to just... forbid Google from doing that, instead of slapping every confused wordpress hack in the EU with a fine?

foepys3• 4 years ago

Who does make my browser request the resource? Clearly the website owner who can also decide to make the browser load a resource fully under their own control. The user could block it, certainly. But I don't want my browser to ask me for every single URL if it's okay to request a resource.

LudwigNagasena3• 4 years ago

That's just technical details. For all I care the website executes the code on my computer without my volition.

loceng2• 4 years ago

So turn that off or don't use that browser? Where's your personal responsibility here?

Mo3• 4 years ago

Absolutely not surprising. I am originally from Germany and the whole of Bavaria is excruciatingly underdeveloped when it comes to IT.

Outside Munich, it gets even worse as you venture deep into beer county where people who can reformat Windows are admired as the next Linus Torvalds and competition consists of people with varying degrees of beginner-level knowledge competing against each other.

Merkel once said that the internet is a new territory for all of us... I am surprised the court even understood half of this.

leobg17• 4 years ago

Bavaria only? If it had been up to Germany’s buerocrats, the whole internet would not exists.

(Also, no cars. For calling a Ford Model T an “automobile” if it still needs a human driver is misleading to consumers, according to, again, the Munich district court.)

Mikeb852• 4 years ago

Lol was trying to check in for a flight using Lufthansa's website today; just hangs and doesn't do anything after you enter all the forms...

amelius• 4 years ago

It is the the user’s browser that initiates a request to Google’s server. A request by the website itself to Google sharing the user’s IP address never actually occurs.

Manipulating a system so that it gives up information that wasn't intended to be given away, is called hacking.

ChrisLomont2• 4 years ago

The system is designed to do it. If you don't want your system operating as it was designed to do don't use it.

It's not hacking.

leobg17• 4 years ago

When I specify that the font used on my page can be accessed at a particular URL, I’m neither asking you to download it (the font might already be installed on your system), nor am I requesting that, if you do download it, you pass along a “referer” header. I am not only not making your browser do this - I’m not even asking it to do so.

npteljes14• 4 years ago

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events.

I wouldn't say so. By making use of the Google Fonts service, the website owner set up a scenario where the browser would then share the user's IP with Google. That's the default behavior of most browser setups. It's as good as sharing with Google directly, no? I feel like the scenario is similar to setting up a trap. Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame?

rpadovani6• 4 years ago

Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame?

Well said. Law is not a programming language, the fact that the website didn't _technically_ share the IP, but did it through the browser, is not relevant.

marcus_cemes15• 4 years ago

This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear.

I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing?

arendtio2• 4 years ago

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'.

In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs browser to share the IP address.

marcus_cemes15• 4 years ago

the w3c standards define, that browsers execute the commands they receive from the server

I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly configure to leak their data, even if spec-adhering behaviour of rendering the webpage should not), to attempt to understand the document and retrieve any other resources that may assist displaying the content correctly.

On the other hand, if one was to send CPU instructions back to the user, I guess it's also there choice to execute them...? Also, it's not possible to determine which resources are for display purposes (fonts), and which are for tracking purposes, the browser will blindly have to retrieve the resource, so websites have a certain responsibility to issue privacy-respecting "instructions".

I'm trying to argue both sides here, I still believe that the user chooses voluntarily to use the browser, visit the webpage and therefore parse the document and initiate any subsequent requests that the document proposes, on the other hand, this is beyond most people, they just want to view a frickin' website, so perhaps the lives of web developers should be made harder to make the lives of the average Joe, who is not an IT expert, a little easier? The architecture of the web is inherently not privacy-respecting, in order to save bandwidth (and for sake of simplicity), we only send fragments and let the browser choose what else it needs, which can be tracked.

It's like walking in a park. You choose to show your face to people, we've come to just accept the fact that by the laws of nature, we cannot prevent other people from seeing our face (unless you use a mask, but then you make them very uneasy), we leak data that others can remember and use to identify us later.

discardable_dan5• 4 years ago

This is the essence of CDNs, though. Every offsite CDN is subject to this same ruling, meaning any developer trying to use a third-party CDN for something as simply as loading jQuery is subject to this. For example, on load, https://evanandkatelyn.com/ grabs stuff from: twitch.tv (embedded player), youtube.com (embedded player), facebook.com (likely just a like button), and what I assume are several wordpress CDNs (c0.wp.com, i0.wp.com, s.w.org, ssl.p.jwpcdn.com).

If this ruling is upheld, either (a) browsers need to immediately stop interpreting these commands, instead providing user prompts for _each offsite load event_, or (b) a very large swath of websites are all open to the same legal issue. As a small example, the Aesop wine company site (https://www.aesopwines.com/), made with Squarespace, uses typekit, squarespace, and google CDN loads. They're subject to the same ruling, right? And so on, and so on...

cryptime2• 4 years ago

This is called plausible deniability- the site owner knows what he is doing, but does not care. He could have downloaded the font or used a analytic service which does not collect IP address. Great ruling.

jannes• 4 years ago

[...], if not installed on the user’s computer, [...]

This is incorrect. The font is downloaded regardless of whether a font with the same name is installed on the system.

The only exception is when you specify a local() function in @font-face [0], but almost nobody does that.

[0] https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face#...

hnarn• 4 years ago

If you ask me, this argument is what we in Sweden call "satan reading the bible". I think you're fully aware that the practical result, i.e. what happens in reality, is that as the court puts it:

The transfer of the user's IP address in the above-mentioned manner and the associated encroachment on general personal rights

Furthermore, the court is correct in stating that:

The use of font services such as Google Fonts cannot be based on Article 6 Paragraph 1 S.1 lit. f GDPR, since the use of fonts is also possible without the visitor having to connect to Google servers.

Let's not be naive, we all know the purpose of Google offering these fonts for free via their CDN. As the author of a website, I think it's completely sensible that you should be responsible for the decision of embedding these fonts from Google rather than just serving them yourself: you are, in fact, "leaking" the IP addresses of your visitors to Google without their consent.

This is in my mind just another one of those things that have been considered completely normal for a long time, but really shouldn't. A bit like how literally everyone used Google Analytics 15 years ago without really thinking about what that meant for the ethical processing of personal data.

leobg17• 4 years ago

You’re making a good argument here. And you might just be right. You’re saying that website owners should be legal-politically responsible for typical privacy risks incurred by users if they are using popular browsers. And perhaps that is the right way to go.

However, what strikes me is that the court hasn’t even seen this problem at all. Your train of thought - that the request was issued from the user’s browser, but that the site owner was essentially in control because he essentially tricked the user into sharing his information with Google without being asked - is just not being discussed at all.

It might be very well that the end result is just. But then it would be a case of the blind chicken finding a grain.

exegete• 4 years ago

Would that logic also work for loading images from other sites and services? I never sent the info to the server myself but told the browser to load the image from that server. Is you argument that it’s client-side code so doesn’t count?

skinkestek• 4 years ago

It might sound weird and even sounded weird to me at first but I think it reduces to setting a trap for the user:

1. we accept that Google knowing we visit certain websites can hurt a user

2. one can get punished for not fencing of a construction website because someone could get hurt

then in my mind this is a very obvious digital equivalent.

Mikeb852• 4 years ago

So does this mean assets hosted by CDNs are illegal now? Since it doesn't ask the user's permission to direct the browser to another site to download said assets? And what if they're already cached in the browser. Distinction?

Seems like laws don't understand how tech works...

huijzer• 4 years ago

And what if they're already cached in the browser.

It is a common misconception that CDN objects are cached. They are not: https://httptoolkit.tech/blog/public-cdn-risks/

janoc3• 4 years ago

Seems like laws don't understand how tech works...

That's pretty much the definition of a law. Laws are written for people, by people. Not for computers.

This is sadly an unintended consequence of a very broad interpretation of GDPR, where an IP address is deemed as personally identifiable information.

If someone wanted to take this to absurd levels, similar argument, as has been made by this court, could be used to make the entire Internet illegal under GDPR - sending a packet exposes personal information of the sender to various third parties (routers of various ISPs) that the sender didn't consent to. And given that the recipient (service provider, website, whatever) could have arranged for having the data transferred on a floppy disk or by a pigeon instead ...

It is not only GDPR that suffers from this - e.g. in Austria it is illegal to drive with a dashcam because their court has ruled that a dashcam amounts to recording someone without their consent - and if you do so, it exposes you to a 20k€ fine!

leobg17• 4 years ago

Exactly!

You’ll soon have to fill out a form as if undergoing surgery just to visit a website. (And, of course, were all gonna click “Accept all”, just as we do with cookie warnings and Apple TOS.)

These judges do not know what they do. They only care about getting the case off their desk, clinging to the first semi plausible argument that allows them to do so. If you look for vision, guidance or responsibility for shaping the future I which we want to live, look elsewhere.

gatgeagent• 4 years ago

Which is the same thing with cookies, you just set some string in a HTTP header, if the browser actually honors that is up to user (in the way what browser he installs and how the user configures it).

leobg17• 4 years ago

Exactly. Your browser preferences are your cookie settings.

The whole business of littering the web with cookie consent forms is as far from a sensible technical solution to the problem as can be imagined. The people who invented the web and who designed browsers have had at least the aspiration to build a system that’s going to work as a whole. Courts and lawmakers, in the other hand, have no such vision.

zuzun• 4 years ago

The ruling explicitly says the right owner does not need to take precautions, because such an obligation would restrict the right holder in the exercise of their rights worthy of protection.

dathinab3• 4 years ago

The technical implementation details don't matter.

What matters is that the IP will be shared with Google as consequence of visiting the site as long as the user didn't take additional actions and without the user having took additional actions which made that happen.

leobg17• 4 years ago

This will also happen if I place a link on my site that does not clearly warn the user that it leads to a non EU website. User clicks it, and his IP address gets disclosed.

Really, if you participate in the World Wide Web, of course your computer’s address will be visible to others, and you can not always control it. Like driving on the Autobahn. People will be able to see you. It’s part of life.

xg159• 4 years ago

The user's browser is not the user.

By that logic, any and all tracking pixels, javascript, iframes, etc would be regulatory no man's land, because all of those are technically just "intents" the server signals.

Nevertheless, users are seldomly in a position to decide whether or not those intents are followed (and site owners can get quite mad if a user instructed their browser to "decline" such an intent e.g. through an ad blocker). All of that makes it reasonable to treat those intents as commands.

2ion3• 4 years ago

Users are enabled to set policy by disabling JavaScript execution by default. If GDPR sees an issue with current default policy, it should mandate that policy is in alignment with user expectations by default, by disabling policy. For web content, after all, doing everything on the server side is not impossible.

leobg17• 4 years ago

So the same action on the part of the website owner will be legal or illegal depending on whether or not the user has actively configured his browser?

no_time2• 4 years ago

The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server.

"Your honor, I merely told the gun to strike the firing pin. Without a round chambered in, the gun wouldn't have done anything."

dsego3• 4 years ago

Your honor, I instructed my browser to point a gun at me and it shot me. Surprised Pikachu face.

xunn0026• 4 years ago

So if I put a really giant mirror and burn your house at 3PM it's the Sun's fault?

The ruling is actually quite logical. The (convoluted) outcome is that the IP is leaked and it should take any tech person about 5 minutes to realise this.

leobg17• 4 years ago

If I place a link that says “Search”, and instead of starting a search on my site, I send you to Google.com, your browser will connect to Google’s server and thus telling them your IP address. Such a hyperlink that does not clearly warn users that clicking it will cause you to connect to someone else’s server would also have to be illegal according to this ruling.

jeltz6• 4 years ago

No, it is his house's fault for deciding to catch fire.

arrenme• 4 years ago

This isn't "just" initiating a request to a random third party server.

Chrome sends a unique ID when accessing (only!) google servers, in the form of X-client-data HTTP header, uniquely identifying the user, and the site he is browsing (via referrer). It's a goldmine.

X-client-data: CIS2yQEIprbJAZjBtskBCKmdygEI8J/KAQjLrsoBCL2wygEI97TKAQiVtcoBCO21ygEYq6TKARjWscoB

IgorPartola2• 4 years ago

So the fault is with Google and Chrome and not the defendant?

leobg17• 4 years ago

I did not know this. However, do note that the ruling does not talk about this. It might have been a different browser altogether.

Also, it would seem to me that the responsibility for such behavior lies with Google and Google Chrome more than it does with individual webmasters.

floatingatoll10• 4 years ago

GDPR specifies otherwise than your interpretation, logical as yours may be from a technical standpoint.

The site operator chose an optional way to embed fonts in a way that divulges PII to a non-GDPR destination. As there is no legal or technical requirement to embed Google Fonts, the site operator is therefore liable.

If use of Google Fonts was mandatory for the web to function, then the site operator would not have been found liable. It is not: they can be mirrored locally, or simply not used, and the web as viewed from the user’s perspective will continue to function just fine. (IANYL, etc.)

rob_c• 4 years ago

Lol. Well just going the UK doesn't follow suit with this madness

asadkn2• 4 years ago

Curious how useful is an IP address with a simple HTTP get request?

As long as a sane Referer-Policy is set, the Referer won't be sent. Sure there's a lot more to browser fingerprinting but with just an HTTP request, all the data that would be known from it is the language and the user agent. Both of which are not unique data points and shared by thousands of other users. No cookies either in this case of Google Fonts.

Vespasian14• 4 years ago

Consider the following scenario:

You are logged in to to google and so are your family members.

You visit YouTube.com from IP X with device (user agent) Y.

Your family member visits YouTube.com from IP X with device Z.

Google Fonts gets a request via the API key of mydomain.de from IP X and device Y.

Google now knows that you visited mydomain.de

Edit: I stand corrected that Google Fonts doesn't use an API key. I suspect they still can correlate the font request with the domain, however I have no proof.

Consider this an example for other services like maps.

magicalist2• 4 years ago

Google fonts doesn't have an API key.

Jyaif4• 4 years ago

There is not "API key" needed to request a font from Google Font...

aliswe• 4 years ago

Several people and devices could be shared by the same IP though, either who are on the same network or in the vicinity of the same mobile mast (or in the same mall or restaurant)... that's why IP often isn't used as conclusive evidence that you are the same person just because you are on the same IP.

Puts7• 4 years ago

Well technically you share a lot more data. IP, browser agent, time (which in combination with IP can tell exactly who used that specific computer) and cookies set on the *.google.com domain.

So it's actually interesting that the court only focused on the IP-address although the ruling would probably have been the same even if they widened the scope.

magicalist2• 4 years ago

and cookies set on the *.google.com domain.

The request doesn't include cookies (and they're served from fonts.googleapis.com so wouldn't include google.com cookies).

arendtio2• 4 years ago

So how valuable would it be to you if I would share with you that I spent $20 yesterday on shopping groceries. Probably not so much. But if I would share with you 90% of my spending, you might be able to infer a lot more information about me.

So the question isn't how useful the single request is, but rather what can be done with a lot of these requests. And Google and Facebook are specialists in generating lots of said requests with services like google fonts and like-buttons. And once you realize that the sum of these requests is so valuable that they are considered personal information, you want to protect them with laws.

These laws, like the GDPR, are already in place and this is one of the instances where someone didn't respect such a law. So you can argue now, that this single request isn't so valuable, but isn't that true for every penny of a million dollars?

asadkn2• 4 years ago

I understand what you're saying but it doesn't exactly address my curiosity of this specific case of HTTP GET requests for font files (no JS, no iframe, and no cookies either in this case).

Your thoughts about a like button widget, or even Google Analytics are perfectly valid. But I am talking about this specific topic under discussion, Google Fonts.

HL33tibCe77• 4 years ago

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

pantulis• 4 years ago

Or linking anything, for that matter

piaste2• 4 years ago

It unquestionably leaks information, and it is why projects like Decentraleyes exist.

Whether it is "unnecessary" is the interesting question. For fonts, it's really hard to claim that you couldn't have created the website without Google's fonts CDN.

tomp• 4 years ago

A CDN that sells your data (or doesn’t otherwise protect it) is more accurately termed “spying network”

paulgb2• 4 years ago

Does this ruling distinguish between “does” and “could”, though? Because any CDN could spy if they wanted. Google fonts has a pretty reasonable privacy policy[1]. I don’t read German, so I wonder if there’s nuance here that I’m missing (like, did they find that Google actually was misusing the data?)

https://developers.google.com/fonts/faq#what_does_using_the_...

iqonq• 4 years ago

Shouldn't be the onus on the regulator's part to prove that Google is selling or not protecting the user's IP address?

DavideNL2• 4 years ago

Well, a font is not equal to "any content".

So perhaps the issue is whether it is necessary/sensible, just for providing a simple font, to contact Google/any cdn.

Spoiler, of course we all know it is not...

HL33tibCe77• 4 years ago

My reading is that nothing in the argument depends on the exact resource in question being a font, so I don’t see why it wouldn’t generalise to other resources.

hexo• 4 years ago

Yes, it would. Actually so many uses of CDN's are nonsensical. I mean, I literally block those requests and sites just work OK. (For my definition of OK. If I don't see autoloading autoplaying video it's only a big big plus)

liveoneggs2• 4 years ago

that's not what a cdn is for or does

Hnrobert424• 4 years ago

It’s not a question of what is necessary. It’s a question of transparency and consent. You must gain consent for giving Google personal data for tracking purposes.

jstummbillig6• 4 years ago

But why? Why must you do that to begin with?

ELI5: Why does the EU not just prevent Google from using personal data they receive by law in any way they see fit? Would that not be a lot more effective than requiring the millions of small businesses and small web devs to figure it out on their end?

chucktingle• 4 years ago

Yes. Fuck CIA^H^Hloudflare.

737373737310• 4 years ago

Care to elaborate?

npteljes14• 4 years ago

Well, I'd say so yes. It's the same thing that came up when hotlinking was first a major thing[0]. In my opinion, anything but communication with the first party violates expectations. If I visit Imgur, then I expect to deal with Imgur, and not with their myriad of third parties all doing something else that's not directly my business.

People of course don't mind, reality is often like this too.

[0] https://en.wikipedia.org/wiki/Inline_linking#Controversial_u...

schleck8• 4 years ago

Wrong. In this case it's illegal because Google Fonts can be served from the origin server as they are downloadable.

The same does not apply to sideside CDNs.

However, I believe NPM CDNs are the same scenario, so I'd start serving packages from the server as well.

kevincox7• 4 years ago

What if my origin server is behind Google Cloud CDN anyways? I mean it is possible for me to run my own datacenter with a direct connection to the users IP but that is obviously unreasonable. As soon as I outsource anything it can now see the users IP.

I guess this particular case seems somewhat reasonable, but where is the line.

Also note that Google Fonts is a lot more that just hosting a download. It has different font files for different browsers for max compatibility as well as font splitting so that you aren't downloading too many glyphs and weights that you don't need for this page. Reimplementing Google Fonts isn't trivial.

kevincox7• 4 years ago

How does this not reduce to hitting any server not owned by you is leaking your IP address?

If I host my website behind Google Cloud CDN they have logs of the visitors IP. If I host my site on S3 they log the IP.

Does this mean that a visitor must insteract only with services that I own until I can get concent to use "unnecessary" third party services?

I think it is pretty significant if "necessary" is reduced to "could have don't it without". Because sure I could avoid Google Fonts, but now I need to do splitting and per-browser detection myself. Ok sure, browser font support is pretty consistent these days and I know my site just uses English and emoji in some pages. But now I can't throw that site in cloud storage. I also can't use a VPS because there are traffic logs. So I buy a server in a datacenter. But what if they have some form of traffic logs? I guess my question is where does this definition of "unnecessary" stop.

kall4• 4 years ago

That‘s what it reduces to, yes, and german courts seem set on actually creating precedents [0] for that dreadful situation.

[0] https://www.taylorwessing.com/en/insights-and-events/insight...

quyse2• 4 years ago

What if I host my website on Google Cloud Platform? I guess it should be OK then to use Google Fonts CDN on the website, because it's the same entity, and visitor's IP was already leaked to Google when the HTML page was served. Can't really ask user for consent before loading the HTML page!

kall4• 4 years ago

You may not serve a website to german visitors from GCP at all, certainly not without getting consent first.

floatingatoll10• 4 years ago

Using a CDN service operated by a non-GDPR business such as Cloudflare, Google, Amazon, or Akamai could potentially be confirmed to be a violation of GDPR, yes, if the CDN-hosted resources are used without opt-in. I’m eagerly awaiting the first complaint on these grounds to be reviewed and judged, now that the GDPR treaty with the United States has lapsed. It doesn’t matter where the CDN’s servers are; without the US having signed a treaty into law, each of their businesses are subject to compulsion by various US authorities to dishonor their commitments to the GDPR.

hammyhavoc4• 4 years ago

Is CloudFlare really non-GDPR? https://www.cloudflare.com/en-gb/trust-hub/gdpr/

everdrive• 4 years ago

I try to block web fonts using Pihole. This makes me want to add an overly-broad rule blocking any occurrence of the word “font” in a domain. It’s yet another web technology that really has no need to exist. My computer already has multiple fonts. There’s way that I benefit by downloading them from a remote site.

chrischapman2• 4 years ago

This kind of 'leakage' is key to personal profiling. If this ruling becomes widespread, profiling may prove much harder to do (which is a good thing).

Edit: clarification

dave3332• 4 years ago

So would other Google resources like running Adsense ads also reveal IP addr or other private info? I think Google allows users to opt out of being tracked?

oblio5• 4 years ago

GDPR works the other way around.

By default it should be <<opt-in>>, not <<opt-out>>.

You don't get to track me and then force me to tell you "don't track me", you should do nothing by default and ask me "may I track you?".

Companies don't do that because opt-out is sneaky and it means they can track, say, 95% of users.

With out-in, they get to track maybe 80% of users if they're allowed to use dark patterns (where they hide stuff or lie to the user what tracking actually does) and probably less than 10% if they're not allowed to do that.

dave3332• 4 years ago

But a site owner running Adsense won't get sued like the site owner running Google fonts did?

account-5• 4 years ago

I'm torn here. I can see it from both points of view.

As a user I don't want any of my data going to third parties at all.

As a website owner trying to provide a service to my users I want the best experience for them. This might be linking to third party services that are doing a better job than I could.

I only see this going one way. The user will have to agree to the sharing of their data with third parties if they want to view third party content, or want the fonts rendered in a better was. Link NPRs text version when you don't agree.

netizen-9368242• 4 years ago

What's wrong with system fonts

This is a serious question, I personally prefer to set my own font for web browsing so why do people feel the need to force fonts on me and load them from google of all places?

kevincox7• 4 years ago

I agree! The problem is that most browsers have awful defaults. I'm not sure why this is but it does mean that people end up wanting to change them. However my browser uses beautiful fonts by default and if you specify just serif, sans-serif or monospace. I wish this would be the common case so that we can just respect users font settings instead of picking what we think is the best.

I write an article on this a while back: https://kevincox.ca/2021/06/23/respect-user-fonts/

Puts7• 4 years ago

Note that GDPR talks about data minimisation - data you should not share more data then necessary. If there are no other way then linking to a third party then that would be just fine. But if there is another way to do it that don't requires you to share someone else data you should do that instead (in this case self host the fonts).

Also consent may not actually help here because the principle of data minimisation applies no matter what legal basis for the processing you use.

Jyaif4• 4 years ago

By that logic it sounds like you must use your own servers to host the data, otherwise you are sharing the IP with a cloud provider.

Puts7• 4 years ago

I think this is actually a really interesting ruling because it's based on Article 6 and not Schrems II. The problem is that they are not taking enough steps to share as little data as possible which is a fair point, but it would also be interesting to see if Google Fonts actually is legal in the sense that personal data (IP, browser agent, timestamp) may end up in the US and used for other purposes (tracking) then just delivering a font.

zoobab• 4 years ago

Pretty good news, Google is a Spy machine that should be bannes in the EU, if you enforce the Schrems2 decision.

ksec• 4 years ago

My working theory of GDPR is that absolutely anyone on earth who has used the internet could be found to have broken the rules.

-Benedict Evans

tzs3• 4 years ago

You don't even have to use the internet. It applies to printed data too. Your Rolodex could be a GDPR nightmare.

afrcnc• 4 years ago

ok...this is just downright silly and dumb now

on the other hand, always host your fonts

verytrivial2• 4 years ago

I find it hilarious that the entire internet tracking and surveylance industry simply thinks it is entitled to this level of information now.

dsego3• 4 years ago

Almost like delivery services industry that are entitled to know your residential address.

npteljes14• 4 years ago

I agree. It's silly that people just use third party services left and right.

jgalt212• 4 years ago

I think the amount of information being leaked here is minimal. i.e. fonts are cached and thus Google only knows you visited health.com and not health.com/scarydisease. unless your landing page was health.com/scarydisease.

denton-scratch• 4 years ago

I don't know why people use fonts served from Google on their websites. Just serve the fonts from the server the site is on. It's like having javascript libraries served by 3rd parties; it's less robust.

manmal• 4 years ago

I think it allowed browsers to cache font files across websites. But that might not even work anymore as I understand many browser vendors are moving towards resource isolation.

iggldiggl• 4 years ago

There still is the fact that you're getting fonts that are automatically subset into partial font files per character set, so if your pages mostly only use one or two character sets (like Latin and possibly Latin-extended), the browser only needs to download the font files for those particular character sets – at the same time you still retain the flexibility of using the full range of characters supported by that font if the occasion demands it, though. (With Latin plus Greek plus Cyrillic and possibly some OpenType features like proper small caps you can get into the hundres of k range, and support for East Asian languages easily gets you into the megabyte range.)

Plus in theory fonts optimised for the respective combination of browser and OS. The former probably isn't as critical any more, as almost everything should support WOFF2 (or at the very least WOFF) these days, as for the latter – I know OSs each have their own font rendering peculiarities, but no idea how much the difference might be in practice.

rnestler• 4 years ago

I guess one advantage could be to better use browser caches for these things? If you visit multiple websites that include the same fonts or javascript libraries, the browser can reuse the cache for them.

rpadovani6• 4 years ago

This was the case once upon a time.

Nowadays, cache is partitioned by website (https://developers.google.com/web/updates/2020/10/http-cache...)

keewee7• 4 years ago

Germany is terribly backwards when it comes to IT. It's insane that such a backward country should have that much say on EU regulations.

I'm not kidding. Countries like Denmark and Estonia are light-years ahead of Germany in terms of eGov and mobile payments.

intunderflow• 4 years ago

It's always the Munich court making these stupid rulings. How long until they fine an ISP for forwarding my packets over a Google AS on the way to its destination.

yayr3• 4 years ago

So what happens if you include e.g. a Wikipedia image or a youtube video? Is that a GDPR violation too? These scenarios also lead to making the users IP available to a third party.

If so, how do we avoid breaking the web while keeping privacy needs in balance?

xaedes• 4 years ago

how do we avoid breaking the web while keeping privacy needs in balance?

One thing that I feel would help: Massive decentralization. Self-hosting of content and regular synching of the hosted content on the server sides; or tunneling, think duckduckgo.

Self-hosting would make knowledge storage more redundant which protects against (also partial) network blackouts.

On the other hand this knowledge is then harder to control. Removing or redacting content would have to rely on the particular sites to "pull the updates" from the upstream. Copyright will also be problematic: each site would have to make copies of content with the (probably commercial) intent of serving it to consumers.

Still I can't help to think we need more decentralization and self-hosting.

737373737310• 4 years ago

Sounds good, but a solution like Peertube would leak the user's IP to even more (and unknown) third parties

kevincox7• 4 years ago

People don't just use third-parties because it is fun. They do it because it reduces cost. If we have to build every service from the ground up as first party is that good economically. Does every website need to build its own CDN now?

Loeffelmann• 4 years ago

So your solution is to introduce a massive amount of redundancy so Google doesn't know you downloaded a font.

c01n• 4 years ago

On the one hand I don't want lawyers, government and politicians to shape cyberspace. But I also like this ruling it seems to set a precedent for users to be able to opt-in to APIs (and probably javascript the obvious next step if this goes on). Client-server interactions should be transparent, this will prevent allot of privacy related issues. It also makes the web more decentralized, getting developers back into a host your own stuff mentality.

discardable_dan5• 4 years ago

On its face, this appears to be death of the third-party CDN. The largest issue is this means companies will no longer be able to use third-party hosting services like Squarespace which rely on shared (technically third-party) CDNs.

A secondary, but similar, issue, is that now all embeds are opt-in: streams, videos, everything must first be clicked on to even load the thumbnail.

A third, and less-important, issue is that advertising providers are basically over: the website, on load, can't query the third-party ad service to figure out what ad to display. Which I'm fine with, abstractly, but it's also a very large revenue issue.

gnud2• 4 years ago

Using a third party is not illegal in itself. But you need an agreement with the third party as to how they will store/process any user data they collect.

This is fairly fundamental under GDPR. It's the 'data controller'/'data processor' split.

I suspect (but IANAL of course) that most CDNs would fail here, because the blanket agreements they offer are basically worthless.

But it's easy to imagine a CDN that has a different business model (charges a tiny amount pr. resource stored, for example), and is completely fine under the GDPR.

Puts7• 4 years ago

This ruling has nothing to do with opt-in or consent. It has to do with the concept of data minimization. According to the GDPR you should only process as much data as necessary and this applies no matter what legal basis (eg consent) you have. So basically the point with GDPR is that you as a user should not even have to care, the company that processes your data is responsible to care for you. And it's actually cool that we see this enforced now.

floatingatoll10• 4 years ago

It does not necessarily set a precedent: use of APIs hosted fully within GDPR countries would be unaffected by this Google Fonts judgment, which only concerns a GDPR site using non-GDPR resources without user consent.

csomar• 4 years ago

I don't understand German but understand HTML/HTTP. Technically, you only get HTML from the website you visited. Then, YOUR browser, requests more data based on that HTML. So technically, it is your browser who requested the font and as a result leaked the IP address.

Am I getting this correctly or not?

Puts7• 4 years ago

You would not have made that request in the first place unless that company did the request in the background for you.

yawaworht1978• 4 years ago

Kind of, the good thing is, if the user used chrome(good chance), the billing just goes to a different department.

rpadovani6• 4 years ago

Technically, yes, but legislation is not code, and many other things have to be considered.

I cannot sign that I will sell my firstborn, but _technically_ I've read, understood, and accepted a contract

drakonka• 4 years ago

Reading our layman developer interpretations of the legalities here is very interesting, but that aside this really makes me rethink my own use of Google hosted fonts in my projects. Whether it is the browser responsible for making the request or my website being responsible for asking the browser to make the request, hosting the font myself is a readily available option. From the perspective of respecting users' data, why call out to Google at all when I don't really have to, for _any_ resource where there's a straightforward alternative?

I say this as someone who does use Google Analytics as well (which I am removing). But mostly for me it isn't a case of dropping all third party convenience services, but a case of remembering to be _mindful_ of what I'm doing.

aembleton2• 4 years ago

I wonder if this will have an impact on https://gdpr.eu/ as they use Google Fonts

dsego3• 4 years ago

Someone should sue them.

quantum_state• 4 years ago

Does this mean the network stack is illegal based on GDPR?

avereveard• 4 years ago

told you ip were personal data:

https://news.ycombinator.com/item?id=16910675

you'all buried the comment as you didn't want to listen but, as I said back then, reality doesn't care about fake internet points.

but hey, you liked gdpr right? it's going to be fun for ambulance chaser around europe: https://news.ycombinator.com/item?id=16910301

irthomasthomas• 4 years ago

250 points in 3 hours and this post is not front page? What is going on with HN today?

kall4• 4 years ago

Treating IP addresses as PII continues go be incredibly tedious and as far as I can tell, they are PII because providers are forced by law to keep those records. Is that correct?

It would be so much better to just reduce and safeguard that information instead of handing it out to any rando with a court order.

floatingatoll10• 4 years ago

Sadly, the United States used to have a treaty law in place that delivered the easy solution you describe. In mid-2020, the treaty was found not to provide the necessary protections, and invalidated by EU courts; no replacement treaty was negotiated or signed by the US, and so here we are.

Merovius2• 4 years ago

I'm confused about the text. It is not obvious, what the defendant actually did.

The assumption from most people seem to be that they used a `<script>` tag or the like, with a Google URL. But the text does not imply that. On the contrary, it repeatedly uses the word "weitergabe" and "weiterleitung" ("forwarding"), which is just not accurate for this process - it seems to imply that the defendant actively made a connection to Google and sending the IP over it.

Of course, this might just be an artifact of the legalese and non-technical phrasing of the verdict. But does anyone know what actually happened, on a technical level?

eps3• 4 years ago

Finally. Took them long enough.

There is literally no other business reason for Google to maintain Google Fonts, but to augment its tracking insights. None. That's the sole purpose of the very existence of Google Fonts.

j-pb4• 4 years ago

If you've ever had the pleasure of dealing with the licensing nightmare of foundries, it's quite easy to see that a small group within google had enough and started the project.

We've literally spend tens of thousands of dollars on our font archive, but decided that we can't continue to use these fonts on projects anymore, due to "we can change the licence at any time" clauses and rent seeking behaviour, that is eerily similar of the stock photo industry licensing (which pretty much has ruined photographers) and scientific publishers (which pretty much have ruined science).

I hate google as much as the next guy, but our small design company is in their dept for creating google fonts, and we plan on contributing to the the repository if we ever create a font as part of a project.

Vespasian14• 4 years ago

But there is nothing that prevents anybody to build a similar product but charging a fee for it.

The payment being "user data" is the problem. Not the product in and of itself.

If you are in the EU such a platform would probably need to be GDPR compliant.

I'm sure there is a opportunity for a font market that fulfills your needs. It might not be easy but eventually studios like you will probably have to charge clients an ongoing fee for "premium assets".

The end user is paying for it and while you and your clients are probably fine with it, the lawmakers are obviously not.

phreeza• 4 years ago

Everything that makes it easier to build websites is in the business interest of Google in a way, because it commoditizes their complement.

https://www.gwern.net/Complement

mbar84• 4 years ago

Oh come off it. There's a reason it's popular: it's useful. You can search for fonts and use them without having to host them yourself.

I argue for downloading fonts yourself and hosting them yourself: https://google-webfonts-helper.herokuapp.com/fonts

But let's not pretend that isn't an extra step that some people regard as unjustified.

eps3• 4 years ago

That's a strawman. I never said it was not popular.

anfogoat• 4 years ago

This isn't at all surprising but I still got scoffed at when I suggested that serving third party fonts, css, scripts, whatever without prior consent or contracts would be a violation. Tragically, I was just robbed of my told you so and was met with a mere well, this seems ok when I sent this to the very people who couple of years ago thought this would be nuts and that I was exaggerating. Part of the pathology of the kind of folk who like to cheer everything the EU does I guess.

My question is, why aren't we worried about the hops between a website and a user? There's who knows how many networks and routers in between them, and the packets might even hop outside the EU momentarily (!!!!!). Surely this needs some attention as well? Should we maybe consider an internal EU-only network? Or maybe the Commission could come up with a whole new routing scheme? I'm sure Europol would have tons of very sane ideas for one.

marcus_cemes15• 4 years ago

why aren't we worried about the hops between a website and a user

I asked about this below, apparently it's reasonable and strictly necessary. It's what the user expects. Even though it's technically possible for the infrastructure layer to provide full packet anonymity, until then it's the web developers responsibility. I do not agree with this, but that's my opinion.

marcus_cemes15• 4 years ago

Personally, I can see only two parties benefiting from this: the plaintiff and lawyers in general.

Google will continue to be Google. Users will be faced with more annoying consent notices that they don't read. Website developers, of which I am one (bias disclosure), who are not very good lawyers will have more technical complexity in order to respect the law. Small companies who rely on services such as CDNs and font providers are now worried about having to host things themselves and the complexity that will ensue to be GDPR compliant (everyone's new least-favourite term). Hacker News gets a divisive flamewar over the subject and this will be yeeted from the front page.

lixtra2• 4 years ago

In other news: ip packages hop from one host to another and a dozen hosts see the private ip and the websites IP. Certainly the website should have asked the user before exposing their ip on the route.

perlgeek5• 4 years ago

The difference here is that there's a technical necessity for the routers to see the IP.

lixtra2• 4 years ago

No, there are many ways around it (i.e. tor, vpn). The internet provider (or user) is just too lazy to provide proper privacy. Just like the website owner is too lazy to self-host the fonts.

Edit: in fact PII should not pass unencrypted, so if you don’t protect the IP (classified as PII) then you‘re not compliant.

oliv__• 4 years ago

This is getting ridiculous.

The paper-pushing world created by GDPR and these non-technical bureaucrats is just absurd and only a burden for smaller companies trying to get things done.

tmaly• 4 years ago

I think this is abusing the intent of GDPR.

smokey_circles• 4 years ago

If this is specifically referencing that technically you could have served those google fonts without making the user go to Google (a proxy of your own and not a hyperlink) then yeah I'm all for it. Big if though, but to roll with it

1) finally webmasters can feel the absurd amount of data they push on us for goddamned shiny JS that barely runs on my phone. Maybe they'll cut back a little

2) Hopefully this incentivises a bit more clear border segregation. More technical effort? Yes. Better for my privacy? Hopefully.

I don't like the language here though, specifically the lack of anything directly supporting my stance. But I prefer optimism and then realism

Jon_Lowtek5• 4 years ago

There is a serious problem with the ongoing balkanization of the internet. EU nations are almost at the point where they rule that european corporations must provide pages in a way that respects european citizen rights and follows european laws.

Outrageous!

And yes that means they can not integrate services from surveillance states like the USA or China without asking the user first, as the EU government thinks only their agencies should be allowed to run mass surveillance against their citizens without consent.

And the EU is not the only one who thinks like that. Pretty soon services controlled by foreign powers will be unacceptable in most of the world. Currently in the USA this is limited to hosting government and military secrets on foreign systems, but i bet if some chinese network would start to creep all over the civilian american web, reporting back to their ministry of national security, the rules would change quickly. For now the USA uses its position to spy on everyone, and i don't mean "nations" or "governments", i mean everyone. American patriots don't see a problem with that, but we know what you do in Utah, and it's a crime against humanity.

For the multinational corporations this whole situation of GDPR-vs-CloudAct means massive restructuring, splitting into smaller entities that service regional markets and moving the top level corporate group somewhere with minimal regulation to minimize conflicts. And such legal splits rupture their core business, at some point they can't have chinese hardware in us datacenters being administrated by indian technicians providing services to russian tourists in brazil anymore.

Maybe this is the last battle the nation states fight with the global corporations and it instead breaks nationalism in favor of streamlining compliance and getting shit done. I can only hope that the global rules emerging say no to mass surveillance and yes to data privacy, but abusing human rights has always meant power and profits, and so i fear the future is dystopian.

dusted• 4 years ago

This is idiotic. A website links to a resource somewhere on the Internet, the user decides to visit the website with their browser, and their browser fetches the linked resource.. This is literally the fucking point of the fucking Internet.

p5v• 4 years ago

What's next? Someone coming after you, because your have their IP in your server logs?

I understand the privacy sentiment, but I find this the opposite of how you beat a giant. The proper way for Germany and the rest of Europe should be the creation of a thriving environment of viable, privacy-aware FAANG competitors. Not putting barriers in every which way.

alkonaut• 4 years ago

Someone coming after you, because your have their IP in your server logs?

This is literally the day job for everyone on HN: checking so you don't accidentally log IPs.

dreamsbythelake• 4 years ago

This is great point, BTW. I always did not have time to "clean up" fonts - now I finally got it done. :-)

In my opinion, this should be _welcomed_ by WebDev community - this does improve privacy. In theory, DE court is right - your website should force user to connect only to itself.

I clearly see 2 ways of making this even simpler: use Lynx :-) or Tor Browser. The importance of Tor in today's business should increase. Yes, there are "shady" things there - but there they were in "clearnet" back in 90x ...

Makes sense.

GDPR penalty for passing on of IP address to Google by using Google Fonts

Related Stories