5 ms·

Please change the title to "Discussion if Google Fonts is GDPR compliant". In the current form the title "Google Fonts not GDPR compliant" is just FUD, as the

Please change the title to "Discussion if Google Fonts is GDPR compliant". In the current form the title "Google Fonts not GDPR compliant" is just FUD, as the argument "Google Font is ok because Google LLC is certified under the EU-U.S. Privacy Shield frameworks" holds some water imho.

andybak 8y ago
This was flagged and dead so I vouched for it and it returned (I wasn't aware I had such power!) I think it's a very valuable post but I agree the title needs fixing.
- crankylinuxuser 8y ago
  I also asked a much more encompassing question here: https://news.ycombinator.com/item?id=17196169 https://news.ycombinator.com/item?id=17196169 In a nutshell, if I buy VPN access to a European GDPR compliant provider, do I get the rights listed in the GDPR?
  - lucb1e 8y ago
    You'd probably be treated by default as such because of the IP, but afaik it only applies to citizens so you probably wouldn't be able to sue if applicable. Or if you need to show ID for requesting your data to prove your identity (if they don't have an online, automated process, then that's quite standard).
  - foepys 8y ago
    No, as you are not a EU resident. But websites might treat you as if GDPR applies to you.
mmoez 8y ago
Thank you for the suggestion. The original title was however not FUD: Some Web site owners in Germany have received legal warnings for their use of Google Fonts which was considered as not GDPR compliant ( https://translate.google.com/translate?hl=en&sl=de&u=https://www.datenschutz-guru.de/die-ersten-dsgvo-abmahnungen-sind-da https://translate.google.com/translate?hl=en&sl=de&u=https:/... .)
- tobltobs 8y ago
  The article you are linking to says that it is not clear if those German cease and desist letters are based on any facts or if they are itself just FUD.
Matticus_Rex 8y ago
> the argument "Google Font is ok because Google LLC is certified under the EU-U.S. Privacy Shield frameworks" holds some water imho. While I wish that were the case, the Privacy Shield framework only legitimizes the cross-border transfer of the data. It doesn't have any bearing at all on the need for notice to users, contractual relationship with them as a processor/sub-processor, or the compliance of Google's use of that personal data once the cross-border transfer has occurred.

andybak 8y ago

This was flagged and dead so I vouched for it and it returned (I wasn't aware I had such power!) I think it's a very valuable post but I agree the title needs fixing.

crankylinuxuser 8y ago
I also asked a much more encompassing question here: https://news.ycombinator.com/item?id=17196169 https://news.ycombinator.com/item?id=17196169 In a nutshell, if I buy VPN access to a European GDPR compliant provider, do I get the rights listed in the GDPR?
- lucb1e 8y ago
  You'd probably be treated by default as such because of the IP, but afaik it only applies to citizens so you probably wouldn't be able to sue if applicable. Or if you need to show ID for requesting your data to prove your identity (if they don't have an online, automated process, then that's quite standard).
- foepys 8y ago
  No, as you are not a EU resident. But websites might treat you as if GDPR applies to you.

mmoez 8y ago

Thank you for the suggestion. The original title was however not FUD: Some Web site owners in Germany have received legal warnings for their use of Google Fonts which was considered as not GDPR compliant ( https://translate.google.com/translate?hl=en&sl=de&u=https://www.datenschutz-guru.de/die-ersten-dsgvo-abmahnungen-sind-da https://translate.google.com/translate?hl=en&sl=de&u=https:/... .)

tobltobs 8y ago
The article you are linking to says that it is not clear if those German cease and desist letters are based on any facts or if they are itself just FUD.

Matticus_Rex 8y ago

> the argument "Google Font is ok because Google LLC is certified under the EU-U.S. Privacy Shield frameworks" holds some water imho. While I wish that were the case, the Privacy Shield framework only legitimizes the cross-border transfer of the data. It doesn't have any bearing at all on the need for notice to users, contractual relationship with them as a processor/sub-processor, or the compliance of Google's use of that personal data once the cross-border transfer has occurred.