6 ms·

The joke is that nothing is gdpr compliant. I've not met 1 company who met all aspects of this law. I'd guess this also means that any asset in a 3rd party CD

The joke is that nothing is gdpr compliant. I've not met 1 company who met all aspects of this law. I'd guess this also means that any asset in a 3rd party CDN would be non compliant with gdpr

detaro 8y ago
have a Data Processing Agreement with the CDN, like with any hosting provider you use, spelling out a reasonable policy for what they do with your users data. Mention them in your privacy policy. Which Google could just offer as a self-service thing for Fonts, since it doesn't need any customization. And suddenly your use of the CDN is compliant.
Lunatic666 8y ago
Wouldn't using cloudfront be compliant, because it's your bucket? Turn off the logs, then it's anonymous. Or did I miss anything?
- discordianfish 8y ago
  IANAL but I think you still need to sign a data processing agreement with them and have your users confirm that they'll have access to their data.
  - Grollicus 8y ago
    Does Amazon do unreasonable things with your users' data? Because otherwise you wouldn't need consent.
    - darrenkopp 8y ago
      The terms are broad in GDPR, so you need the DPA just for Amazon to store it, as that's "processing". However, you don't need your users to confirm that, they agree to share the information with you (controller) and you'll have some sort of terms in your privacy policy allowing you to share personal information with 3rd parties you regularly interact with for legitimate purposes who will be bound by the terms set forth in your own privacy policy.
- antsar 8y ago
  It may be your bucket, but Amazon is still a third party. Does turning off logs disable all logging on the Amazon side, or just your copy of those logs?
  - icedchai 8y ago
    You really think Amazon doesn't have logs for security and troubleshooting? What about all the networks between you and Amazon?
- detaro 8y ago
  No, you still need a processing agreement with Amazon, but that's not a problem.
- wooter 8y ago
  your own bucket wouldn't benefit from browser url-based caching of common assets (libraries, fonts, etc)
testplzignore 8y ago
Is anyone dealing with 3rd party script/image loads at all? I just loaded a bunch of different major websites while watching the network tab in Firefox, and there wasn't a single site that didn't load ads and other assets from 3rd party domains. And that's before the "do you accept cookies?" prompt, assuming they have one at all. On most sites, it seems like it would be easier to list the advertising networks that aren't used than to list the ones that are used.
ucaetano 8y ago
When nobody is compliant, the regulating authorities can pick whoever they want to prosecute, including favoring turning a blind eye towards local companies and targeting foreign companies. The GDPR is Working as Intended.
- GavinMcG 8y ago
  Or, you're projecting your ideology and expectations on something that hasn't even been around long enough to see how it's working.
  - wooter 8y ago
    generally, its not smart to experiment with an entire continent at a time
- zorkw4rg 8y ago
  There is no major european internet company worth speaking about, so I think they probably don't care if it irreparable damages their own local companies in the process of damaging the foreign ones since they are virtually non existent anyhow. Ironically the foreign big ones have enough resources to comply to the law, small local ones don't and will die/never be created in the first place. > the regulating authorities can pick whoever they want to prosecute It doesn't really work that way, at least not in germany, anyone can just sue (or threaten to sue) their competition over this (they already started) there is no such thing as this mythical benevolent authority who could stop this wanton destruction you are talking about.
  - Grollicus 8y ago
    > anyone can just sue (or threaten to sue) their competition over this This is wrong. Competitors (and only competitors) can send a cease-and-desist letter based on competition law, because ignoring GDPR gives an unfair advantage - even that only in Germany because the tool used here ("Abmahnungen") are a unique german thing. They are also a common thing between companies that don't "like" each other and if you send one you can expect to get one back. Receiving one costs ~1000 € (goes to the opposing lawyer) so they don't hurt much and the only one profiting is the lawyer.
rectang 8y ago
The alternative to the GDPR was endless and increasing harm to users. The "invisible hand of the market" couldn't find a solution. So now we have regulation. This is the world we live in. When the market fails to protect users, eventually there might actually be consequences. So constructively, how do we solve this CDN problem while causing the least harm to both businesses and users? Perhaps identify assets by cryptographic signature rather than URL?
- icedchai 8y ago
  Can you explain what harm is being caused to users by accessing fonts off a CDN?
  - TheCoelacanth 8y ago
    It potentially opens them up to tracking by whoever operates the CDN.
    - icedchai 8y ago
      Sounds like FUD. You can say this about any web server. Also, "tracking" doesn't imply actual harm or abuse.

The joke is that nothing is gdpr compliant. I've not met 1 company who met all aspects of this law. I'd guess this also means that any asset in a 3rd party CDN would be non compliant with gdpr

detaro 8y ago

have a Data Processing Agreement with the CDN, like with any hosting provider you use, spelling out a reasonable policy for what they do with your users data. Mention them in your privacy policy. Which Google could just offer as a self-service thing for Fonts, since it doesn't need any customization. And suddenly your use of the CDN is compliant.

Lunatic666 8y ago

Wouldn't using cloudfront be compliant, because it's your bucket? Turn off the logs, then it's anonymous. Or did I miss anything?

discordianfish 8y ago
IANAL but I think you still need to sign a data processing agreement with them and have your users confirm that they'll have access to their data.
- Grollicus 8y ago
  Does Amazon do unreasonable things with your users' data? Because otherwise you wouldn't need consent.
  - darrenkopp 8y ago
    The terms are broad in GDPR, so you need the DPA just for Amazon to store it, as that's "processing". However, you don't need your users to confirm that, they agree to share the information with you (controller) and you'll have some sort of terms in your privacy policy allowing you to share personal information with 3rd parties you regularly interact with for legitimate purposes who will be bound by the terms set forth in your own privacy policy.
antsar 8y ago
It may be your bucket, but Amazon is still a third party. Does turning off logs disable all logging on the Amazon side, or just your copy of those logs?
- icedchai 8y ago
  You really think Amazon doesn't have logs for security and troubleshooting? What about all the networks between you and Amazon?
detaro 8y ago
No, you still need a processing agreement with Amazon, but that's not a problem.
wooter 8y ago
your own bucket wouldn't benefit from browser url-based caching of common assets (libraries, fonts, etc)

testplzignore 8y ago

Is anyone dealing with 3rd party script/image loads at all? I just loaded a bunch of different major websites while watching the network tab in Firefox, and there wasn't a single site that didn't load ads and other assets from 3rd party domains. And that's before the "do you accept cookies?" prompt, assuming they have one at all. On most sites, it seems like it would be easier to list the advertising networks that aren't used than to list the ones that are used.

ucaetano 8y ago

When nobody is compliant, the regulating authorities can pick whoever they want to prosecute, including favoring turning a blind eye towards local companies and targeting foreign companies. The GDPR is Working as Intended.

GavinMcG 8y ago
Or, you're projecting your ideology and expectations on something that hasn't even been around long enough to see how it's working.
- wooter 8y ago
  generally, its not smart to experiment with an entire continent at a time
zorkw4rg 8y ago
There is no major european internet company worth speaking about, so I think they probably don't care if it irreparable damages their own local companies in the process of damaging the foreign ones since they are virtually non existent anyhow. Ironically the foreign big ones have enough resources to comply to the law, small local ones don't and will die/never be created in the first place. > the regulating authorities can pick whoever they want to prosecute It doesn't really work that way, at least not in germany, anyone can just sue (or threaten to sue) their competition over this (they already started) there is no such thing as this mythical benevolent authority who could stop this wanton destruction you are talking about.
- Grollicus 8y ago
  > anyone can just sue (or threaten to sue) their competition over this This is wrong. Competitors (and only competitors) can send a cease-and-desist letter based on competition law, because ignoring GDPR gives an unfair advantage - even that only in Germany because the tool used here ("Abmahnungen") are a unique german thing. They are also a common thing between companies that don't "like" each other and if you send one you can expect to get one back. Receiving one costs ~1000 € (goes to the opposing lawyer) so they don't hurt much and the only one profiting is the lawyer.

rectang 8y ago

The alternative to the GDPR was endless and increasing harm to users. The "invisible hand of the market" couldn't find a solution. So now we have regulation. This is the world we live in. When the market fails to protect users, eventually there might actually be consequences. So constructively, how do we solve this CDN problem while causing the least harm to both businesses and users? Perhaps identify assets by cryptographic signature rather than URL?

icedchai 8y ago
Can you explain what harm is being caused to users by accessing fonts off a CDN?
- TheCoelacanth 8y ago
  It potentially opens them up to tracking by whoever operates the CDN.
  - icedchai 8y ago
    Sounds like FUD. You can say this about any web server. Also, "tracking" doesn't imply actual harm or abuse.