5 ms·

Why do you think google fonts exist? For google to Get visitor IP all over the web without any form of user consent, this is exactly what the gdpr tries to kill

by mola 5y ago

Why do you think google fonts exist? For google to Get visitor IP all over the web without any form of user consent, this is exactly what the gdpr tries to kill.

oblio 5y ago
Nah, it's charity, come on. /s
HL33tibCe7 5y ago
What value exactly is there in Google seeing that IP X requested font Y, assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?
- arlcode 5y ago
  If you are logged in to Google and visited YouTube earlier that day they already know that you are behind IP X with device Z and use that information later on by connecting it with the font API key of mydomain.de Remember that your user agent is sent as well.
  - Jyaif 5y ago
    What API key?
  - bryan_w 5y ago
    Pretty sure the font URL is a static link that doesn't require an "API key"
- Acinyx 5y ago
  Under the GDPR, an IP address is personally identifiable data, so you can't leak it. And for someone with masses of extra data like Google it is enough to identify who is doing the browsing, so this isn't some crazy overreach.
  - codethief 5y ago
    But GP has a point: An IP address (together with a timestamp) may be used to identify you a person but if it's not connected to actual personal data (e.g. what website you visited), "leaking" it to Google doesn't provide Google with any data about you. I mean, IP address ranges are publicly known. If I now run a `for` loop over all IPv4 addresses and write them to my HDD, am I suddenly illegally storing personal data of all the people behind those IP addresses? Obviously no. An identifier by itself is not worth anything, unless it's connected to actual personal data. EDIT: Never mind. GP's assumption that "there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?" does not seem to hold in my browser. So Google does not only receive the IP address but also the HTTP REFERER.
    - latk 5y ago
      The court judgement addresses this exact point. There are previous judgements (Breyer v Bundesrepublik Deutschland) that establish that dynamic IP addresses are personal data. There are reasonable means to identify the data subject with the help of third parties, such as the ISP. “For this it is sufficient that the defendant has the abstract means for identification of the person behind the IP address. Whether the defendant or Google have the concrete means for linking the IP address with the plaintiff is irrelevant.” That there is correlating information like timestamps, useragent strings, or referer headers increases the likelihood of actual identification, but the mere reasonable possibility of identification is sufficient for IP addresses to be personal data.
      - codethief 5y ago
        You're missing the point (and mischaracterizing the court decisions): An IP address by itself (without any additional information, e.g. the URL of the website requested by that IP address) cannot possibly be personal data, as was illustrated by my "for loop" example. The present court case and also the one you're referring to (Breuer v. Bundesrepublik Deutschland[0]) do not say anything to the contrary. They were concerned with situations where there is additional data that could be used e.g. to build a user profile. For instance, the Bundlesgerichtshof judgment addressed the question of "whether dynamic IP addresses of website visitors constitute personal data for website operators" [0] (which clearly know which website the visitor visited and therefore possess additional data about the visitor). [0]: https://medium.com/golden-data/breyer-are-dynamic-ip-addresses-personal-data-under-eu-data-protection-law-well-it-depends-fd60a72dbc90 https://medium.com/golden-data/breyer-are-dynamic-ip-address...
- codethief 5y ago
  > assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)? In Firefox 96 network requests to 3rd parties (in this case Google) still seem to include the 1st-party hostname as REFERER header.
  - account42 5y ago
    Which is really shitty behavior from a browser that wants to claim to care about privacy. But even without a referer it gives Google some information, even if its just that this user (ip, useragent, other identifying bits) is currently exists.

by mola 5y ago

Why do you think google fonts exist? For google to Get visitor IP all over the web without any form of user consent, this is exactly what the gdpr tries to kill.

oblio 5y ago

Nah, it's charity, come on. /s

HL33tibCe7 5y ago

What value exactly is there in Google seeing that IP X requested font Y, assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?

arlcode 5y ago
If you are logged in to Google and visited YouTube earlier that day they already know that you are behind IP X with device Z and use that information later on by connecting it with the font API key of mydomain.de Remember that your user agent is sent as well.
- Jyaif 5y ago
  What API key?
- bryan_w 5y ago
  Pretty sure the font URL is a static link that doesn't require an "API key"
Acinyx 5y ago
Under the GDPR, an IP address is personally identifiable data, so you can't leak it. And for someone with masses of extra data like Google it is enough to identify who is doing the browsing, so this isn't some crazy overreach.
- codethief 5y ago
  But GP has a point: An IP address (together with a timestamp) may be used to identify you a person but if it's not connected to actual personal data (e.g. what website you visited), "leaking" it to Google doesn't provide Google with any data about you. I mean, IP address ranges are publicly known. If I now run a `for` loop over all IPv4 addresses and write them to my HDD, am I suddenly illegally storing personal data of all the people behind those IP addresses? Obviously no. An identifier by itself is not worth anything, unless it's connected to actual personal data. EDIT: Never mind. GP's assumption that "there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)?" does not seem to hold in my browser. So Google does not only receive the IP address but also the HTTP REFERER.
  - latk 5y ago
    The court judgement addresses this exact point. There are previous judgements (Breyer v Bundesrepublik Deutschland) that establish that dynamic IP addresses are personal data. There are reasonable means to identify the data subject with the help of third parties, such as the ISP. “For this it is sufficient that the defendant has the abstract means for identification of the person behind the IP address. Whether the defendant or Google have the concrete means for linking the IP address with the plaintiff is irrelevant.” That there is correlating information like timestamps, useragent strings, or referer headers increases the likelihood of actual identification, but the mere reasonable possibility of identification is sufficient for IP addresses to be personal data.
    - codethief 5y ago
      You're missing the point (and mischaracterizing the court decisions): An IP address by itself (without any additional information, e.g. the URL of the website requested by that IP address) cannot possibly be personal data, as was illustrated by my "for loop" example. The present court case and also the one you're referring to (Breuer v. Bundesrepublik Deutschland[0]) do not say anything to the contrary. They were concerned with situations where there is additional data that could be used e.g. to build a user profile. For instance, the Bundlesgerichtshof judgment addressed the question of "whether dynamic IP addresses of website visitors constitute personal data for website operators" [0] (which clearly know which website the visitor visited and therefore possess additional data about the visitor). [0]: https://medium.com/golden-data/breyer-are-dynamic-ip-addresses-personal-data-under-eu-data-protection-law-well-it-depends-fd60a72dbc90 https://medium.com/golden-data/breyer-are-dynamic-ip-address...
codethief 5y ago
> assuming there’s no Referer header - which there won’t be, assuming Referer-Policy is set sanely (which by default it is in all browsers)? In Firefox 96 network requests to 3rd parties (in this case Google) still seem to include the 1st-party hostname as REFERER header.
- account42 5y ago
  Which is really shitty behavior from a browser that wants to claim to care about privacy. But even without a referer it gives Google some information, even if its just that this user (ip, useragent, other identifying bits) is currently exists.