13 ms·

Discussion if Google Fonts is GDPR compliant

57 points by mmoez 8y ago

cobookman 8y ago
The joke is that nothing is gdpr compliant. I've not met 1 company who met all aspects of this law. I'd guess this also means that any asset in a 3rd party CDN would be non compliant with gdpr
- detaro 8y ago
  have a Data Processing Agreement with the CDN, like with any hosting provider you use, spelling out a reasonable policy for what they do with your users data. Mention them in your privacy policy. Which Google could just offer as a self-service thing for Fonts, since it doesn't need any customization. And suddenly your use of the CDN is compliant.
- Lunatic666 8y ago
  Wouldn't using cloudfront be compliant, because it's your bucket? Turn off the logs, then it's anonymous. Or did I miss anything?
  - discordianfish 8y ago
    IANAL but I think you still need to sign a data processing agreement with them and have your users confirm that they'll have access to their data.
    - Grollicus 8y ago
      Does Amazon do unreasonable things with your users' data? Because otherwise you wouldn't need consent.
      - darrenkopp 8y ago
        The terms are broad in GDPR, so you need the DPA just for Amazon to store it, as that's "processing". However, you don't need your users to confirm that, they agree to share the information with you (controller) and you'll have some sort of terms in your privacy policy allowing you to share personal information with 3rd parties you regularly interact with for legitimate purposes who will be bound by the terms set forth in your own privacy policy.
  - antsar 8y ago
    It may be your bucket, but Amazon is still a third party. Does turning off logs disable all logging on the Amazon side, or just your copy of those logs?
    - icedchai 8y ago
      You really think Amazon doesn't have logs for security and troubleshooting? What about all the networks between you and Amazon?
  - detaro 8y ago
    No, you still need a processing agreement with Amazon, but that's not a problem.
  - wooter 8y ago
    your own bucket wouldn't benefit from browser url-based caching of common assets (libraries, fonts, etc)
- testplzignore 8y ago
  Is anyone dealing with 3rd party script/image loads at all? I just loaded a bunch of different major websites while watching the network tab in Firefox, and there wasn't a single site that didn't load ads and other assets from 3rd party domains. And that's before the "do you accept cookies?" prompt, assuming they have one at all. On most sites, it seems like it would be easier to list the advertising networks that aren't used than to list the ones that are used.
- ucaetano 8y ago
  When nobody is compliant, the regulating authorities can pick whoever they want to prosecute, including favoring turning a blind eye towards local companies and targeting foreign companies. The GDPR is Working as Intended.
  - GavinMcG 8y ago
    Or, you're projecting your ideology and expectations on something that hasn't even been around long enough to see how it's working.
    - wooter 8y ago
      generally, its not smart to experiment with an entire continent at a time
  - zorkw4rg 8y ago
    There is no major european internet company worth speaking about, so I think they probably don't care if it irreparable damages their own local companies in the process of damaging the foreign ones since they are virtually non existent anyhow. Ironically the foreign big ones have enough resources to comply to the law, small local ones don't and will die/never be created in the first place. > the regulating authorities can pick whoever they want to prosecute It doesn't really work that way, at least not in germany, anyone can just sue (or threaten to sue) their competition over this (they already started) there is no such thing as this mythical benevolent authority who could stop this wanton destruction you are talking about.
    - Grollicus 8y ago
      > anyone can just sue (or threaten to sue) their competition over this This is wrong. Competitors (and only competitors) can send a cease-and-desist letter based on competition law, because ignoring GDPR gives an unfair advantage - even that only in Germany because the tool used here ("Abmahnungen") are a unique german thing. They are also a common thing between companies that don't "like" each other and if you send one you can expect to get one back. Receiving one costs ~1000 € (goes to the opposing lawyer) so they don't hurt much and the only one profiting is the lawyer.
- rectang 8y ago
  The alternative to the GDPR was endless and increasing harm to users. The "invisible hand of the market" couldn't find a solution. So now we have regulation. This is the world we live in. When the market fails to protect users, eventually there might actually be consequences. So constructively, how do we solve this CDN problem while causing the least harm to both businesses and users? Perhaps identify assets by cryptographic signature rather than URL?
  - icedchai 8y ago
    Can you explain what harm is being caused to users by accessing fonts off a CDN?
    - TheCoelacanth 8y ago
      It potentially opens them up to tracking by whoever operates the CDN.
      - icedchai 8y ago
        Sounds like FUD. You can say this about any web server. Also, "tracking" doesn't imply actual harm or abuse.
anotheryou 8y ago
I already saw the first legal actions against users of it...
tobltobs 8y ago
Please change the title to "Discussion if Google Fonts is GDPR compliant". In the current form the title "Google Fonts not GDPR compliant" is just FUD, as the argument "Google Font is ok because Google LLC is certified under the EU-U.S. Privacy Shield frameworks" holds some water imho.
- andybak 8y ago
  This was flagged and dead so I vouched for it and it returned (I wasn't aware I had such power!) I think it's a very valuable post but I agree the title needs fixing.
  - crankylinuxuser 8y ago
    I also asked a much more encompassing question here: https://news.ycombinator.com/item?id=17196169 https://news.ycombinator.com/item?id=17196169 In a nutshell, if I buy VPN access to a European GDPR compliant provider, do I get the rights listed in the GDPR?
    - lucb1e 8y ago
      You'd probably be treated by default as such because of the IP, but afaik it only applies to citizens so you probably wouldn't be able to sue if applicable. Or if you need to show ID for requesting your data to prove your identity (if they don't have an online, automated process, then that's quite standard).
    - foepys 8y ago
      No, as you are not a EU resident. But websites might treat you as if GDPR applies to you.
- mmoez 8y ago
  Thank you for the suggestion. The original title was however not FUD: Some Web site owners in Germany have received legal warnings for their use of Google Fonts which was considered as not GDPR compliant ( https://translate.google.com/translate?hl=en&sl=de&u=https://www.datenschutz-guru.de/die-ersten-dsgvo-abmahnungen-sind-da https://translate.google.com/translate?hl=en&sl=de&u=https:/... .)
amluto 8y ago
Or website operators could stop embedding objects hosted by Google. GDPR protects users to some extent, but sites should protect themselves, too. The information available to hosts of embedded assets is quite valuable, especially when those assets are in the form of scripts, and sites should seriously consider monetizing that information themselves rather than just giving it away.
- crazygringo 8y ago
  Except that a shared CDN which everyone uses results in better performance. For the popular fonts, a user probably already has them in their browser cache from other sites, so they load instantly. Having sites redundantly host identical font files separately is a step backwards for users, who wind up waiting longer for a page to load, or experiencing the jarring FOUT (Flash Of Unstyled Text).
  - untog 8y ago
    Right, so it's a question of performance vs privacy. Which is a very legitimate debate.
  - ocdtrekkie 8y ago
    If everyone dumped their excess tracking JavaScript, but added locally-hosted fonts, the net difference would still be far superior performance to what the average user is used to. Or you could just use a selection of common system fonts, and not host any fonts at all.
  - _wmd 8y ago
    > Except that a shared CDN which everyone uses results in better performance. This is thrown around a lot, but very rarely with hard numbers to support it. A cold DNS cache costs at least one roundtrip, a cold SSL session cache costs several, a new SSL connection (presently) costs at least 2. Meanwhile, all the above is necessary to talk to an origin site anyway, and networking performance for the best part of 10 years has been dominated by latency (i.e. roundtrips) rather than throughput. Hoping the user had an idle connection to the Google CDN when measuring cold request start is wishful thinking Meanwhile self-hosted reuses all of the above and enables assets to be combined into a single transaction, which vastly improves the behaviour of TCP cold start
blattimwind 8y ago
The real question is why you used Google Fonts in the first place. You're telling me downloading another megabyte (or more) of stock fonts — no actual corporate branding — is worth both your and my time? Yeah, no. Stick to core fonts which actually work and render well within the UA, or bring your own custom branded fonts, but don't bother me with half-baked stock fonts. The same question for using random-js-library from googleapis.com: You're trying to tell me that giving Google (and anyone who somewhere between me and them takes control of that domain) full arbitrary code execution privileges within your origin is worth saving a one-off download of some JS library? I don't think so.
- Klathmon 8y ago
  Using subresource integrity "random-js-library" hosted on a 3rd party isn't "arbitrary code execution", as the useragent will refuse to run the script if it's hash changes in any way from what you provided. The same can be used with all other "subresources" like stylesheets and fonts! However Google specifically makes this hard as they have been known to update the served font from time to time, which if you are using SRI will break the font entirely.
  - blattimwind 8y ago
    > Using subresource integrity "random-js-library" hosted on a 3rd party isn't "arbitrary code execution", as the useragent will refuse to run the script if it's hash changes in any way from what you provided. That's true, but SRI is still rarely deployed; and no surprise there: the official Google docs don't use SRI in their "paste this into your code" examples: https://developers.google.com/speed/libraries/ https://developers.google.com/speed/libraries/ Also, Edge still doesn't support SRI. So, yes, for some UAs this specific problem (resource integrity) is a solved problem, but like I said, it's far from the default. The other issues - lack of necessity, load time, degraded visual quality, giving user data away for free to an advertiser etc. - remain untouched.
    - Klathmon 8y ago
      I completely agree that it needs to be more widely used, and I absolutely think that google could go a long way toward making it more common. But to be completely honest, lack of user agent support shouldn't be a reason to not use a feature. Edge doesn't support it, so Edge users are less secure. There are also user agents that have CORS restrictions disabled or don't support HSTS, but i'm still going to use and rely on both of those for security. And it sounds like you and I disagree completely on the usefulness of fonts. For me a font isn't "unnecessary" any more than paint isn't necessary on a house. Sure, you could live in a house without paint, but I want paint on my house. As for longer load times, and degraded visual quality. The previous is being dealt with via new font-display css descriptor, and in browsers that don't support that they have timeouts of normally 3 seconds at most, and the former is an opinion that I absolutely don't share.
Rjevski 8y ago
Just based on the fact that Google's business model is inherently incompatible with privacy, I'd stay away. It is in Google's best interest to sneakily track people despite claiming not doing so, and they can be very good at it and do in a way that's undetectable from the outside. In fact, I would be surprised if they're not doing this already.
- qop 8y ago
  Elaborate on this. Are you saying Google has crossed the line into social intelligence territory like china has? Is there evidence for this, beyond "google is bad!!1!" ?
  - crankylinuxuser 8y ago
    (Notes wifi is "off") (Notes GPS is "off") (Notes Location sharing somehow got turned on) Hey, we need your help! How was $eatery_you_ate_at_last_night ? Can you give us direction how busy the $Business_you_parked_nearby is? And, this https://www.google.com/maps/timeline?hl=en&authuser=0&pb https://www.google.com/maps/timeline?hl=en&authuser=0&pb Google shouldn't even be collecting this. But they are. We know not how they use it. But if you have the data, of course you're using it!
    - kevinslashslash 8y ago
      https://support.google.com/accounts/answer/3118687?visit_id=1-636633858417735392-1191870611&p=location_history&hl=en&rd=1 https://support.google.com/accounts/answer/3118687?visit_id=...
simion314 8y ago
Why is Google not answering that they do not track IPs ? it is likely they are tracking them, so are they tracking the IPs for security reasons or they mining the traffic. Someone that knows more on how this work can you answer if Google can see more then your IP? like user agent or cookies ?
- lucb1e 8y ago
  Open the developer tools (F12) on any website that uses it and you can see in the network tab what it sends. So yes, cookies, but the ones for the domain where the fonts are hosted, not the one you are visiting. Not sure about the referrer. User agent for sure.
- wooter 8y ago
  probably, at the very least for avoiding DOS attacks on important common assets. GDPR is one of the most shortsighted laws I've ever read
  - simion314 8y ago
    If you have read the law or this linked github page you have seen that security was considered, search for this text The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, […] by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. Did you read this and it was not enough for you, Btw is DDOS and not DOS attacks (in case it was not a typo)
icedchai 8y ago
Think of all the lost productivity wasted on stuff like this...
- wooter 8y ago
  unreal. and advocates deny any and all costs and collateral. i can't believe their spending limited political and financial capital on this rather than the multitude of real problems in the EU - without any compelling cost-benefit analysis no less.
- rectang 8y ago
  Think of all the abuse prevented. It's a tradeoff. Of course, if you're someone who profits off of abusing users, you may see the GDPR as wholly negative.
  - CryptoPunk 8y ago
    This is generally dealt with through market choice, with people choosing the trade off that they perceive as optimal for themselves. Instead we now have one standard for data handling being imposed by the EU, and precluding a vast number of potentially more optimal interactions.
    - rectang 8y ago
      Your solution didn't work for users. It was a market failure that produced huge negative externalities borne by users, for which there was no practical means of redress. Because users were faced with a raw deal, now we have regulation.
      - CryptoPunk 8y ago
        The practical means of redress was the government empowering individuals with public funding for development of anonymity technologies, public directories comparing services and their abidance to voluntary data protection standards, and possibly public service announcements educating people about what data they disclose while browsing non-anonymously, or browsing particular types of websites, and how that data can be shared and used by private data collectors. Regardless, I don't think it's clear that the benefits of the market being left to itself haven't outweighed the costs. My snap judgment (which isn't that useful when assessing massively complex topics like this) is that the benefits dwarf the costs. Much of the internet services that have emerged over the last 20 years have been paid for by personal information that users have traded away in exchange for these services. Everything from Gmail, to Google searches, to Facebook, to millions of Youtube videos, to the vast amounts of self-help content one can find about any topic, is ad-funded, which depends in large part on this exchange of personal information for web services. The problem is people are taking all of these services available on the web for granted, and recklessly assuming we would have all of them without the ability to target ads using collected PII, and with the added burden of complying with the onerous GDPR requirements.
jocoda 8y ago
Never mind Google Fonts, what about SafeBrowsing? What about Chrome?
anfogoat 8y ago
As far as I can see, the request that asks for the font is a simple GET. So does this mean that an HTTP request to third-party X, who will log the user's IP, User-Agent and possibly the origin, will now require an agreement with X and explicit consent from the user? If so, will the consent need to be established before the request?
- anotheryou 8y ago
  I'm pretty sure you need a contract for data processing at least. I'm absolutely not shure if you also need consent. (please let me know if anyone found out!). npr.org went back from WWW to what feels like WAP for those not giving consent.
darrenkopp 8y ago
You can absolutely store IP addresses (and other personal information) without consent and be GDPR compliant. You just need to explain what you are storing, for what purpose, who you share it with, how long it's stored, and comply with the "rights" put forth in the legislation. GDPR merely constrains what information Google can share without your consent and requires them to be more explicit in stating what information they gather about you.
- anotheryou 8y ago
  Indirectly you share the users IP by letting their browser sand a get request to google. The problematic is the same for any CDN you use.

57 points by mmoez 8y ago

The joke is that nothing is gdpr compliant. I've not met 1 company who met all aspects of this law. I'd guess this also means that any asset in a 3rd party CDN would be non compliant with gdpr

detaro 8y ago
have a Data Processing Agreement with the CDN, like with any hosting provider you use, spelling out a reasonable policy for what they do with your users data. Mention them in your privacy policy. Which Google could just offer as a self-service thing for Fonts, since it doesn't need any customization. And suddenly your use of the CDN is compliant.
Lunatic666 8y ago
Wouldn't using cloudfront be compliant, because it's your bucket? Turn off the logs, then it's anonymous. Or did I miss anything?
- discordianfish 8y ago
  IANAL but I think you still need to sign a data processing agreement with them and have your users confirm that they'll have access to their data.
  - Grollicus 8y ago
    Does Amazon do unreasonable things with your users' data? Because otherwise you wouldn't need consent.
    - darrenkopp 8y ago
      The terms are broad in GDPR, so you need the DPA just for Amazon to store it, as that's "processing". However, you don't need your users to confirm that, they agree to share the information with you (controller) and you'll have some sort of terms in your privacy policy allowing you to share personal information with 3rd parties you regularly interact with for legitimate purposes who will be bound by the terms set forth in your own privacy policy.
- antsar 8y ago
  It may be your bucket, but Amazon is still a third party. Does turning off logs disable all logging on the Amazon side, or just your copy of those logs?
  - icedchai 8y ago
    You really think Amazon doesn't have logs for security and troubleshooting? What about all the networks between you and Amazon?
- detaro 8y ago
  No, you still need a processing agreement with Amazon, but that's not a problem.
- wooter 8y ago
  your own bucket wouldn't benefit from browser url-based caching of common assets (libraries, fonts, etc)
testplzignore 8y ago
Is anyone dealing with 3rd party script/image loads at all? I just loaded a bunch of different major websites while watching the network tab in Firefox, and there wasn't a single site that didn't load ads and other assets from 3rd party domains. And that's before the "do you accept cookies?" prompt, assuming they have one at all. On most sites, it seems like it would be easier to list the advertising networks that aren't used than to list the ones that are used.
ucaetano 8y ago
When nobody is compliant, the regulating authorities can pick whoever they want to prosecute, including favoring turning a blind eye towards local companies and targeting foreign companies. The GDPR is Working as Intended.
- GavinMcG 8y ago
  Or, you're projecting your ideology and expectations on something that hasn't even been around long enough to see how it's working.
  - wooter 8y ago
    generally, its not smart to experiment with an entire continent at a time
- zorkw4rg 8y ago
  There is no major european internet company worth speaking about, so I think they probably don't care if it irreparable damages their own local companies in the process of damaging the foreign ones since they are virtually non existent anyhow. Ironically the foreign big ones have enough resources to comply to the law, small local ones don't and will die/never be created in the first place. > the regulating authorities can pick whoever they want to prosecute It doesn't really work that way, at least not in germany, anyone can just sue (or threaten to sue) their competition over this (they already started) there is no such thing as this mythical benevolent authority who could stop this wanton destruction you are talking about.
  - Grollicus 8y ago
    > anyone can just sue (or threaten to sue) their competition over this This is wrong. Competitors (and only competitors) can send a cease-and-desist letter based on competition law, because ignoring GDPR gives an unfair advantage - even that only in Germany because the tool used here ("Abmahnungen") are a unique german thing. They are also a common thing between companies that don't "like" each other and if you send one you can expect to get one back. Receiving one costs ~1000 € (goes to the opposing lawyer) so they don't hurt much and the only one profiting is the lawyer.
rectang 8y ago
The alternative to the GDPR was endless and increasing harm to users. The "invisible hand of the market" couldn't find a solution. So now we have regulation. This is the world we live in. When the market fails to protect users, eventually there might actually be consequences. So constructively, how do we solve this CDN problem while causing the least harm to both businesses and users? Perhaps identify assets by cryptographic signature rather than URL?
- icedchai 8y ago
  Can you explain what harm is being caused to users by accessing fonts off a CDN?
  - TheCoelacanth 8y ago
    It potentially opens them up to tracking by whoever operates the CDN.
    - icedchai 8y ago
      Sounds like FUD. You can say this about any web server. Also, "tracking" doesn't imply actual harm or abuse.

anotheryou 8y ago

I already saw the first legal actions against users of it...

tobltobs 8y ago

Please change the title to "Discussion if Google Fonts is GDPR compliant". In the current form the title "Google Fonts not GDPR compliant" is just FUD, as the argument "Google Font is ok because Google LLC is certified under the EU-U.S. Privacy Shield frameworks" holds some water imho.

andybak 8y ago
This was flagged and dead so I vouched for it and it returned (I wasn't aware I had such power!) I think it's a very valuable post but I agree the title needs fixing.
- crankylinuxuser 8y ago
  I also asked a much more encompassing question here: https://news.ycombinator.com/item?id=17196169 https://news.ycombinator.com/item?id=17196169 In a nutshell, if I buy VPN access to a European GDPR compliant provider, do I get the rights listed in the GDPR?
  - lucb1e 8y ago
    You'd probably be treated by default as such because of the IP, but afaik it only applies to citizens so you probably wouldn't be able to sue if applicable. Or if you need to show ID for requesting your data to prove your identity (if they don't have an online, automated process, then that's quite standard).
  - foepys 8y ago
    No, as you are not a EU resident. But websites might treat you as if GDPR applies to you.
mmoez 8y ago
Thank you for the suggestion. The original title was however not FUD: Some Web site owners in Germany have received legal warnings for their use of Google Fonts which was considered as not GDPR compliant ( https://translate.google.com/translate?hl=en&sl=de&u=https://www.datenschutz-guru.de/die-ersten-dsgvo-abmahnungen-sind-da https://translate.google.com/translate?hl=en&sl=de&u=https:/... .)

amluto 8y ago

Or website operators could stop embedding objects hosted by Google. GDPR protects users to some extent, but sites should protect themselves, too. The information available to hosts of embedded assets is quite valuable, especially when those assets are in the form of scripts, and sites should seriously consider monetizing that information themselves rather than just giving it away.

crazygringo 8y ago
Except that a shared CDN which everyone uses results in better performance. For the popular fonts, a user probably already has them in their browser cache from other sites, so they load instantly. Having sites redundantly host identical font files separately is a step backwards for users, who wind up waiting longer for a page to load, or experiencing the jarring FOUT (Flash Of Unstyled Text).
- untog 8y ago
  Right, so it's a question of performance vs privacy. Which is a very legitimate debate.
- ocdtrekkie 8y ago
  If everyone dumped their excess tracking JavaScript, but added locally-hosted fonts, the net difference would still be far superior performance to what the average user is used to. Or you could just use a selection of common system fonts, and not host any fonts at all.
- _wmd 8y ago
  > Except that a shared CDN which everyone uses results in better performance. This is thrown around a lot, but very rarely with hard numbers to support it. A cold DNS cache costs at least one roundtrip, a cold SSL session cache costs several, a new SSL connection (presently) costs at least 2. Meanwhile, all the above is necessary to talk to an origin site anyway, and networking performance for the best part of 10 years has been dominated by latency (i.e. roundtrips) rather than throughput. Hoping the user had an idle connection to the Google CDN when measuring cold request start is wishful thinking Meanwhile self-hosted reuses all of the above and enables assets to be combined into a single transaction, which vastly improves the behaviour of TCP cold start

blattimwind 8y ago

The real question is why you used Google Fonts in the first place. You're telling me downloading another megabyte (or more) of stock fonts — no actual corporate branding — is worth both your and my time? Yeah, no. Stick to core fonts which actually work and render well within the UA, or bring your own custom branded fonts, but don't bother me with half-baked stock fonts. The same question for using random-js-library from googleapis.com: You're trying to tell me that giving Google (and anyone who somewhere between me and them takes control of that domain) full arbitrary code execution privileges within your origin is worth saving a one-off download of some JS library? I don't think so.

Klathmon 8y ago
Using subresource integrity "random-js-library" hosted on a 3rd party isn't "arbitrary code execution", as the useragent will refuse to run the script if it's hash changes in any way from what you provided. The same can be used with all other "subresources" like stylesheets and fonts! However Google specifically makes this hard as they have been known to update the served font from time to time, which if you are using SRI will break the font entirely.
- blattimwind 8y ago
  > Using subresource integrity "random-js-library" hosted on a 3rd party isn't "arbitrary code execution", as the useragent will refuse to run the script if it's hash changes in any way from what you provided. That's true, but SRI is still rarely deployed; and no surprise there: the official Google docs don't use SRI in their "paste this into your code" examples: https://developers.google.com/speed/libraries/ https://developers.google.com/speed/libraries/ Also, Edge still doesn't support SRI. So, yes, for some UAs this specific problem (resource integrity) is a solved problem, but like I said, it's far from the default. The other issues - lack of necessity, load time, degraded visual quality, giving user data away for free to an advertiser etc. - remain untouched.
  - Klathmon 8y ago
    I completely agree that it needs to be more widely used, and I absolutely think that google could go a long way toward making it more common. But to be completely honest, lack of user agent support shouldn't be a reason to not use a feature. Edge doesn't support it, so Edge users are less secure. There are also user agents that have CORS restrictions disabled or don't support HSTS, but i'm still going to use and rely on both of those for security. And it sounds like you and I disagree completely on the usefulness of fonts. For me a font isn't "unnecessary" any more than paint isn't necessary on a house. Sure, you could live in a house without paint, but I want paint on my house. As for longer load times, and degraded visual quality. The previous is being dealt with via new font-display css descriptor, and in browsers that don't support that they have timeouts of normally 3 seconds at most, and the former is an opinion that I absolutely don't share.

Rjevski 8y ago

Just based on the fact that Google's business model is inherently incompatible with privacy, I'd stay away. It is in Google's best interest to sneakily track people despite claiming not doing so, and they can be very good at it and do in a way that's undetectable from the outside. In fact, I would be surprised if they're not doing this already.

qop 8y ago
Elaborate on this. Are you saying Google has crossed the line into social intelligence territory like china has? Is there evidence for this, beyond "google is bad!!1!" ?
- crankylinuxuser 8y ago
  (Notes wifi is "off") (Notes GPS is "off") (Notes Location sharing somehow got turned on) Hey, we need your help! How was $eatery_you_ate_at_last_night ? Can you give us direction how busy the $Business_you_parked_nearby is? And, this https://www.google.com/maps/timeline?hl=en&authuser=0&pb https://www.google.com/maps/timeline?hl=en&authuser=0&pb Google shouldn't even be collecting this. But they are. We know not how they use it. But if you have the data, of course you're using it!
  - kevinslashslash 8y ago
    https://support.google.com/accounts/answer/3118687?visit_id=1-636633858417735392-1191870611&p=location_history&hl=en&rd=1 https://support.google.com/accounts/answer/3118687?visit_id=...

simion314 8y ago

Why is Google not answering that they do not track IPs ? it is likely they are tracking them, so are they tracking the IPs for security reasons or they mining the traffic. Someone that knows more on how this work can you answer if Google can see more then your IP? like user agent or cookies ?

lucb1e 8y ago
Open the developer tools (F12) on any website that uses it and you can see in the network tab what it sends. So yes, cookies, but the ones for the domain where the fonts are hosted, not the one you are visiting. Not sure about the referrer. User agent for sure.
wooter 8y ago
probably, at the very least for avoiding DOS attacks on important common assets. GDPR is one of the most shortsighted laws I've ever read
- simion314 8y ago
  If you have read the law or this linked github page you have seen that security was considered, search for this text The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, […] by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. Did you read this and it was not enough for you, Btw is DDOS and not DOS attacks (in case it was not a typo)

icedchai 8y ago

Think of all the lost productivity wasted on stuff like this...

wooter 8y ago
unreal. and advocates deny any and all costs and collateral. i can't believe their spending limited political and financial capital on this rather than the multitude of real problems in the EU - without any compelling cost-benefit analysis no less.
rectang 8y ago
Think of all the abuse prevented. It's a tradeoff. Of course, if you're someone who profits off of abusing users, you may see the GDPR as wholly negative.
- CryptoPunk 8y ago
  This is generally dealt with through market choice, with people choosing the trade off that they perceive as optimal for themselves. Instead we now have one standard for data handling being imposed by the EU, and precluding a vast number of potentially more optimal interactions.
  - rectang 8y ago
    Your solution didn't work for users. It was a market failure that produced huge negative externalities borne by users, for which there was no practical means of redress. Because users were faced with a raw deal, now we have regulation.
    - CryptoPunk 8y ago
      The practical means of redress was the government empowering individuals with public funding for development of anonymity technologies, public directories comparing services and their abidance to voluntary data protection standards, and possibly public service announcements educating people about what data they disclose while browsing non-anonymously, or browsing particular types of websites, and how that data can be shared and used by private data collectors. Regardless, I don't think it's clear that the benefits of the market being left to itself haven't outweighed the costs. My snap judgment (which isn't that useful when assessing massively complex topics like this) is that the benefits dwarf the costs. Much of the internet services that have emerged over the last 20 years have been paid for by personal information that users have traded away in exchange for these services. Everything from Gmail, to Google searches, to Facebook, to millions of Youtube videos, to the vast amounts of self-help content one can find about any topic, is ad-funded, which depends in large part on this exchange of personal information for web services. The problem is people are taking all of these services available on the web for granted, and recklessly assuming we would have all of them without the ability to target ads using collected PII, and with the added burden of complying with the onerous GDPR requirements.

jocoda 8y ago

Never mind Google Fonts, what about SafeBrowsing? What about Chrome?

anfogoat 8y ago

As far as I can see, the request that asks for the font is a simple GET. So does this mean that an HTTP request to third-party X, who will log the user's IP, User-Agent and possibly the origin, will now require an agreement with X and explicit consent from the user? If so, will the consent need to be established before the request?

anotheryou 8y ago
I'm pretty sure you need a contract for data processing at least. I'm absolutely not shure if you also need consent. (please let me know if anyone found out!). npr.org went back from WWW to what feels like WAP for those not giving consent.

darrenkopp 8y ago

You can absolutely store IP addresses (and other personal information) without consent and be GDPR compliant. You just need to explain what you are storing, for what purpose, who you share it with, how long it's stored, and comply with the "rights" put forth in the legislation. GDPR merely constrains what information Google can share without your consent and requires them to be more explicit in stating what information they gather about you.

anotheryou 8y ago
Indirectly you share the users IP by letting their browser sand a get request to google. The problematic is the same for any CDN you use.