7 ms·

The browser is the user-agent, ie. an agent acting on behalf of the user. The browser chose to fetch the font, based on the orinal response. It could be configu

The browser is the user-agent, ie. an agent acting on behalf of the user. The browser chose to fetch the font, based on the orinal response. It could be configured not to.

maratc 5y ago
> It could be configured not to That's an opt-out and GPDR requires an opt-in.
- bondarchuk 5y ago
  You could also say that the user is opting in to loading a font from google when he actively sends the request to google. You could also say the user is opting in to storing cookies by accepting the file and writing it to his own disk, and sending the file back when the site asks for it. I think it is too late for these kinds of arguments in the EU though, and maybe with good reason, if it turns out the average citizen is not actually able to configure these kinds of decisions.
  - maratc 5y ago
    It hardly matters in the court of law what you "could also say". The law is clear: you don't have to send your users' data to third parties, but if you decide to do it, you have to receive their informed consent first. In this case, the defendant chose to send personal data to a third party without receiving their informed consent. The option of conforming with the law by not sending that data anywhere still stands, as does the option of receiving informed consent beforehand.
    - bondarchuk 5y ago
      But technically, the user itself is sending his own data to the third party, and the original website is merely requesting the user to do so. You could interpret it like this: "To use this website, it's best if you have this font. You can get it from here: https://google.com/fonts/blah https://google.com/fonts/blah". It's not exactly the same case as a more obvious GDPR violation, where the website would collect information from the user, and then send it to a third party (e.g. selling user data to a data broker). >It hardly matters in the court of law what you "could also say". On the contrary, it's exactly what the court is there for.
      - ratww 5y ago
        Technicalities don't matter. The user never consented to this data being shared with third parties, and there is no simple mechanism for the user to block them that is available to all website users. As other mentioned, GDPR also requires opt-in. There is a case for third-party requests, and considering that some websites make tens and sometimes hundreds (eg Yahoo) of third-party requests, passing the burden of filtering those requests to the customer doesn't really scale. The burden is fully on the website operator here. They wrote the software, and it's most certainly closed-source. Just as the burden of keeping my data safe on their backend is on them, the burden of keeping my data safe on my frontend is also on them.
        7373737373 5y ago
        > passing the burden of filtering those requests to the customer doesn't really scale I think it scales better than forcing millions of website providers to engage in the legal fiction that they are an intermediary between the user and all external content providers that are embedded on their page
        ratww 5y ago
        > all external content providers that are embedded on their page All the embedding is being done by the people building the websites, so yes, they do have full control and therefore full responsibility. Just because I don't perform a crime or violation myself, it doesn't automatically absolve me when I pay or ask someone to commit it. > forcing millions of website providers Millions? There are billions of website visitors, and most of those don't have any control or deep knowledge over their tools. There are only 3 significant browser technology suppliers at the moment, and none of them provides the hypothetical tools to users, only third parties, and those tools often break websites. Website builders, however are significantly more technical and able to control their tech stack. If anything just hire another company. The burden should definitely be on them.
        7373737373 5y ago
  - kawsper 5y ago
    GDPR requires informed consent.
    - bondarchuk 5y ago
      I know, which is why I said: "and maybe with good reason, if it turns out the average citizen is not actually able to configure these kinds of decisions."
  - Fargren 5y ago
    > You could also say that the user is opting in to loading a font from google when he actively sends the request to google. Consent is not consent unless it's informed consent. If the user was not made aware of the request in a clear way before the request happened, he did not have a choice. If the person (and by person we mean the human being, not their browser) did not make the choice, then he did not consent. There's no "technically" about it, the question is only if the person knew what was happening and was given an opportunity to opt in.
    - bondarchuk 5y ago
      So it is the responsibility of the website owner, to make sure that the user is informed about how his own browser works. Couldn't you make a case for shifting this responsibility to e.g. the browser vendor or the regulating bodies who decide on web standards?
      - maratc 5y ago
        No. The responsibility of the website owner is not to send users' personal data to third parties, OR to receive their users' informed consent to such sending BEFORE that sending occurs. That's the law. It's enforced by courts. Web standards aren't law. They aren't enforced. You can't sue anyone in W3C court for using non-standard CSS or forgetting to close a `<b>` with a `</b>`.
        bondarchuk 5y ago
        >not to send users' personal data to third parties >receive their users' informed consent to such sending BEFORE that sending occurs. Neither of these are what's actually happening in this case. According to this court's decision, the responsibility of the website owner is not to send instructions to the user's machine that might expose their personal data to third parties after the user's machine follows these instructions, OR receive informed consent before such instructions are sent. I'm not saying the GDPR doesn't apply here, but at least it's clearly a different situation.
ratww 5y ago
> It could be configured not to. Not in practice. It requires configuration that is non-trivial for most users and might not be available for them in all cases (eg: using a computer in a library). In fact, I can't think of a solution that doesn't require third-party software/hardware/product and some computer expertise (AdBlock? Pi-Hole? VPN? Little Snitch? Hosts File?).
- piaste 5y ago
  Ublock Origin in advanced mode can be set to block all third-party requests by default. I browse the internet that way, but it's definitely not for everyone.
  - ratww 5y ago
    I also browse the internet this way, but yeah. This solution is not available to people not using their own computers, people using certain browsers that don't have it, or just people that haven't heard of it.

The browser is the user-agent, ie. an agent acting on behalf of the user. The browser chose to fetch the font, based on the orinal response. It could be configured not to.

maratc 5y ago

> It could be configured not to That's an opt-out and GPDR requires an opt-in.

bondarchuk 5y ago
You could also say that the user is opting in to loading a font from google when he actively sends the request to google. You could also say the user is opting in to storing cookies by accepting the file and writing it to his own disk, and sending the file back when the site asks for it. I think it is too late for these kinds of arguments in the EU though, and maybe with good reason, if it turns out the average citizen is not actually able to configure these kinds of decisions.
- maratc 5y ago
  It hardly matters in the court of law what you "could also say". The law is clear: you don't have to send your users' data to third parties, but if you decide to do it, you have to receive their informed consent first. In this case, the defendant chose to send personal data to a third party without receiving their informed consent. The option of conforming with the law by not sending that data anywhere still stands, as does the option of receiving informed consent beforehand.
  - bondarchuk 5y ago
    But technically, the user itself is sending his own data to the third party, and the original website is merely requesting the user to do so. You could interpret it like this: "To use this website, it's best if you have this font. You can get it from here: https://google.com/fonts/blah https://google.com/fonts/blah". It's not exactly the same case as a more obvious GDPR violation, where the website would collect information from the user, and then send it to a third party (e.g. selling user data to a data broker). >It hardly matters in the court of law what you "could also say". On the contrary, it's exactly what the court is there for.
    - ratww 5y ago
      Technicalities don't matter. The user never consented to this data being shared with third parties, and there is no simple mechanism for the user to block them that is available to all website users. As other mentioned, GDPR also requires opt-in. There is a case for third-party requests, and considering that some websites make tens and sometimes hundreds (eg Yahoo) of third-party requests, passing the burden of filtering those requests to the customer doesn't really scale. The burden is fully on the website operator here. They wrote the software, and it's most certainly closed-source. Just as the burden of keeping my data safe on their backend is on them, the burden of keeping my data safe on my frontend is also on them.
      - 7373737373 5y ago
        > passing the burden of filtering those requests to the customer doesn't really scale I think it scales better than forcing millions of website providers to engage in the legal fiction that they are an intermediary between the user and all external content providers that are embedded on their page
        ratww 5y ago
        > all external content providers that are embedded on their page All the embedding is being done by the people building the websites, so yes, they do have full control and therefore full responsibility. Just because I don't perform a crime or violation myself, it doesn't automatically absolve me when I pay or ask someone to commit it. > forcing millions of website providers Millions? There are billions of website visitors, and most of those don't have any control or deep knowledge over their tools. There are only 3 significant browser technology suppliers at the moment, and none of them provides the hypothetical tools to users, only third parties, and those tools often break websites. Website builders, however are significantly more technical and able to control their tech stack. If anything just hire another company. The burden should definitely be on them.
        7373737373 5y ago
- kawsper 5y ago
  GDPR requires informed consent.
  - bondarchuk 5y ago
    I know, which is why I said: "and maybe with good reason, if it turns out the average citizen is not actually able to configure these kinds of decisions."
- Fargren 5y ago
  > You could also say that the user is opting in to loading a font from google when he actively sends the request to google. Consent is not consent unless it's informed consent. If the user was not made aware of the request in a clear way before the request happened, he did not have a choice. If the person (and by person we mean the human being, not their browser) did not make the choice, then he did not consent. There's no "technically" about it, the question is only if the person knew what was happening and was given an opportunity to opt in.
  - bondarchuk 5y ago
    So it is the responsibility of the website owner, to make sure that the user is informed about how his own browser works. Couldn't you make a case for shifting this responsibility to e.g. the browser vendor or the regulating bodies who decide on web standards?
    - maratc 5y ago
      No. The responsibility of the website owner is not to send users' personal data to third parties, OR to receive their users' informed consent to such sending BEFORE that sending occurs. That's the law. It's enforced by courts. Web standards aren't law. They aren't enforced. You can't sue anyone in W3C court for using non-standard CSS or forgetting to close a `<b>` with a `</b>`.
      - bondarchuk 5y ago
        >not to send users' personal data to third parties >receive their users' informed consent to such sending BEFORE that sending occurs. Neither of these are what's actually happening in this case. According to this court's decision, the responsibility of the website owner is not to send instructions to the user's machine that might expose their personal data to third parties after the user's machine follows these instructions, OR receive informed consent before such instructions are sent. I'm not saying the GDPR doesn't apply here, but at least it's clearly a different situation.

ratww 5y ago

> It could be configured not to. Not in practice. It requires configuration that is non-trivial for most users and might not be available for them in all cases (eg: using a computer in a library). In fact, I can't think of a solution that doesn't require third-party software/hardware/product and some computer expertise (AdBlock? Pi-Hole? VPN? Little Snitch? Hosts File?).

piaste 5y ago
Ublock Origin in advanced mode can be set to block all third-party requests by default. I browse the internet that way, but it's definitely not for everyone.
- ratww 5y ago
  I also browse the internet this way, but yeah. This solution is not available to people not using their own computers, people using certain browsers that don't have it, or just people that haven't heard of it.