4 ms·

No. (Contrary to the sibling comment). If you have agreements in place with third party data processors to protect user privacy, this ruling does not prevent

No. (Contrary to the sibling comment). If you have agreements in place with third party data processors to protect user privacy, this ruling does not prevent you from hot linking third party assets under that agreement. In effect, the third party acts as part of your infrastructure - just like you may already use a third party hosting provider, cloud database provider, auth provider, logging service, etc. The GDPR constrains how PII is stored and processed. It doesn't stop you from using third party providers, but it does make you responsible for ensuring user privacy is protected, by delegation through binding privacy agreements and sufficient diligence. Those types of agreements are already common. For example, if you're hosting on AWS providing service to users covered by GDPR, you should already have such an agreement. It's pretty straightforward. https://aws.amazon.com/compliance/gdpr-center/ https://aws.amazon.com/compliance/gdpr-center/ Therefore if AWS offered a generic, third party font hosting or embedded video hosting service, you could hot link to that no problem. Same with Cloudflare, Google Cloud, etc. as long as they provide the necessary agreements with you. The problem with Google Fonts is there is no such agreement in place, you can't trust Google to not profile users statistically via font requests, and even if Google says they won't do that, you can't trust that their servers in the US won't be tapped by US authorities to monitor request logs, etc.

jeroenhd 5y ago
The data processing agreement with American companies is probably not enough because the USA doesn't sufficiently protect the users' privacy under the GDPR. It's only possible to go this route if the country has the approval of the EU through the necessary legal frameworks. That's what Privacy Shield and its predecessor were, and both were deemed insufficient. Your point about a data processing agreement is true, but I wouldn't rely on AWS/Cloudflare/Google until the EU and USA manage to get this stuff worked out.
- jlokier 5y ago
  I should have said adequate data processing agreements which comply with the GDPR. In practice the simplest way to do this would have third parties handling EU requests within EU boundaries, and not shipping analytics that contain PII outside controlled boundaries. Some service providers appear to at least be addressing the issue, e.g. see the AWS link. Hetzner in Germany offers similar data processing agreements. It would not be difficult for Cloudflare and Google to do the same. If you operate a CDN, almost by definition you have no problem hosting within the EU when sending content to users in the EU.

jeroenhd 5y ago

The data processing agreement with American companies is probably not enough because the USA doesn't sufficiently protect the users' privacy under the GDPR. It's only possible to go this route if the country has the approval of the EU through the necessary legal frameworks. That's what Privacy Shield and its predecessor were, and both were deemed insufficient. Your point about a data processing agreement is true, but I wouldn't rely on AWS/Cloudflare/Google until the EU and USA manage to get this stuff worked out.

jlokier 5y ago
I should have said adequate data processing agreements which comply with the GDPR. In practice the simplest way to do this would have third parties handling EU requests within EU boundaries, and not shipping analytics that contain PII outside controlled boundaries. Some service providers appear to at least be addressing the issue, e.g. see the AWS link. Hetzner in Germany offers similar data processing agreements. It would not be difficult for Cloudflare and Google to do the same. If you operate a CDN, almost by definition you have no problem hosting within the EU when sending content to users in the EU.