4 ms·

One reason you may want to self host your fonts vs Google Fonts is to respect your users privacy. Google Fonts downloads are used for fingerprinting and browse

One reason you may want to self host your fonts vs Google Fonts is to respect your users privacy. Google Fonts downloads are used for fingerprinting and browser identification: https://www.brycewray.com/posts/2020/08/google-fonts-privacy/ https://www.brycewray.com/posts/2020/08/google-fonts-privacy...

gruez 5y ago
> Google Fonts downloads are used for fingerprinting and browser identification: https://www.brycewray.com/posts/2020/08/google-fonts-privacy https://www.brycewray.com/posts/2020/08/google-fonts-privacy... ctrl-F for "fingerpr": 0 matches I skimmed the article and it looks like the only thing that's logged is your IP? Calling that "browser identification" seems like a stretch.
- brycewray 5y ago
  Best source of truth on this (one way or the other), IMHO, is the issue I referenced in that article: https://github.com/google/fonts/issues/1495 https://github.com/google/fonts/issues/1495
  - gruez 5y ago
    Can you link to the relevant comment? I skimmed the thread and only found mentions of IP being logged (something I already mentioned last comment) and GDPR related lawyering.
    - brycewray 5y ago
      https://github.com/google/fonts/issues/1495#issuecomment-374253423 https://github.com/google/fonts/issues/1495#issuecomment-374...
      - gruez 5y ago
        So basically, IP is being logged? The rest of the comment is just GDPR-related discussion about whether consent was obtained.
        brycewray 5y ago
        That's correct. Perhaps candiddevmike's comment about "browser identification" goes back to where I said, "When you load them off Google Fonts, they come with 'secret sauce' to optimize them for each visitor’s individual browser and device." Perhaps the assumption was that this requires browser identification which, then, somehow is linked to the harvested IP address. I didn't say that specifically, nor do I have the knowledge to say so in any event.
ephimetheus 5y ago
Excellent point, by the way. Under GDPR, embedding something like a Google font is only legal after user consent, simply because they can see your IP address when you connect. This was confirmed again on Monday by a German court [1] (German link) for the case where they loaded something from Akamai on a university library website. This was specifically deemed problematic since the implicit connection was into the US. Basically, this means if you operate in Europe you can’t use US cloud providers at all before user consent. [1] https://verwaltungsgerichtsbarkeit.hessen.de/pressemitteilungen/cookie-dienst https://verwaltungsgerichtsbarkeit.hessen.de/pressemitteilun...

gruez 5y ago

> Google Fonts downloads are used for fingerprinting and browser identification: https://www.brycewray.com/posts/2020/08/google-fonts-privacy https://www.brycewray.com/posts/2020/08/google-fonts-privacy... ctrl-F for "fingerpr": 0 matches I skimmed the article and it looks like the only thing that's logged is your IP? Calling that "browser identification" seems like a stretch.

brycewray 5y ago
Best source of truth on this (one way or the other), IMHO, is the issue I referenced in that article: https://github.com/google/fonts/issues/1495 https://github.com/google/fonts/issues/1495
- gruez 5y ago
  Can you link to the relevant comment? I skimmed the thread and only found mentions of IP being logged (something I already mentioned last comment) and GDPR related lawyering.
  - brycewray 5y ago
    https://github.com/google/fonts/issues/1495#issuecomment-374253423 https://github.com/google/fonts/issues/1495#issuecomment-374...
    - gruez 5y ago
      So basically, IP is being logged? The rest of the comment is just GDPR-related discussion about whether consent was obtained.
      - brycewray 5y ago
        That's correct. Perhaps candiddevmike's comment about "browser identification" goes back to where I said, "When you load them off Google Fonts, they come with 'secret sauce' to optimize them for each visitor’s individual browser and device." Perhaps the assumption was that this requires browser identification which, then, somehow is linked to the harvested IP address. I didn't say that specifically, nor do I have the knowledge to say so in any event.

ephimetheus 5y ago

Excellent point, by the way. Under GDPR, embedding something like a Google font is only legal after user consent, simply because they can see your IP address when you connect. This was confirmed again on Monday by a German court [1] (German link) for the case where they loaded something from Akamai on a university library website. This was specifically deemed problematic since the implicit connection was into the US. Basically, this means if you operate in Europe you can’t use US cloud providers at all before user consent. [1] https://verwaltungsgerichtsbarkeit.hessen.de/pressemitteilungen/cookie-dienst https://verwaltungsgerichtsbarkeit.hessen.de/pressemitteilun...