10 ms·

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells

by leobg 5y ago

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the website itself to Google sharing the user’s IP address never actually occurs.

isbvhodnvemrwvn 5y ago
Using this logic I can send full fingerprinting data as long as I do it from the front-end? I mean courts are not that dumb, it's still the website owner which decides what is done.
- Already__Taken 5y ago
  The website owner decides what's asked to be done. The browser is still owned by the end-user can choose to make the request. This is why ad-blocking is fundamentally required.
- Andrew_nenakhov 5y ago
  Browser can be configured not to send this data. If I ask you to jump from the bridge, and you do, how is it my fault that you chose to comply?
  - npteljes 5y ago
    So code in frontend would be "asking" in this case, in your opinion? Javascript is executed by default by all major browser deployments.
    - Andrew_nenakhov 5y ago
      If you are that caring about your privacy, you absolutely should use a browser that is configured in such a way that it doesn't leak your IP to anyone you didn't consent to.
      - npteljes 5y ago
        I'm running systems that I'm modifying to the extent that satisfies me, but that's not the concern here. Right now I'm caring about everyone's default privacy level, not just my own. And in this ideal world, third party sharing is not opt-out.
    - 7373737373 5y ago
      Yes, definitely. Ad absurdum, browsers could be mandated to have the user opt-in to every single instruction that is executed. It's technically possible, the user has control. I think it's a slippery slope to imagine/enforce a transfer of agency between the website user and provider, where the latter will try to make the opt-in appear as simple as possible. An ideal opt-in is more than the click of a button, it's an understanding. A button accompanied by a wall of text isn't understanding.
      - npteljes 5y ago
        Code in the frontend is absolutely not "asking". I'd bet that most of the users have no idea what's going on in their browsers and devices, and those instruments then, in turn, shouldn't prey on this ignorance. I know that this is not how the world works, but a difference is that we could have control over this one.
    - leobg 5y ago
      The court did not even see this issue, i.e. the distinction between issuing a suggestion or directive vs. actually executing the request directly. The court, in fact, states that the was the website itself that did the sharing. The ruling suffers from unsound reasoning. It could be, however, that the website owner never brought up these arguments. The court does not have to do its own investigation. This is called the “maxim of disposition” in German law. Whatever both parties agree on what is true has be treated as true by the court. So if the claim that the website itself issued the request to Google servers was uncontested, then this ruling is sound, based on the claims brought forth by the parties in this particular case.
  - germanier 5y ago
    Depending on the circumstances, telling people to jump from the bridge can be a crime.
    - Andrew_nenakhov 5y ago
      Ok, don't jump from a bridge. Take off your clothes, and go to your neighbors, I'm asking you right now. Are you going to comply?
      - npteljes 5y ago
        Another thing came to mind. Let's say you know I'm the kind of person to easily give people money. I just got my paycheck, and you knowing this, you ask me to give you the money. I'll give you the money because that's the kind of person I am. But then I'm left with no money for the month, and all of its consequences. Who do you think would carry the blame in this situation?
      - rpadovani 5y ago
        You know that in many countries, encouraging or assisting illegal activity is a crime in itself, right? UK:https://en.wikipedia.org/wiki/Encouraging_or_assisting_a_crime_in_English_law https://en.wikipedia.org/wiki/Encouraging_or_assisting_a_cri... Germany (given we are talking about a German court): https://de.wikipedia.org/wiki/Anstiftung_(Deutschland) https://de.wikipedia.org/wiki/Anstiftung_(Deutschland)
        Andrew_nenakhov 5y ago
        Stripping and jumping from a bridge is not illegal activity.
        ceejayoz 5y ago
        Both are illegal in quite a few places. Stripping may violate public nudity laws. Jumping off bridges is often illegal, as well. For example, Florida: https://www.tcpalm.com/story/news/local/2020/07/06/bridge-jumping-illegal-but-common-summer-treasure-coast/3198620001/ https://www.tcpalm.com/story/news/local/2020/07/06/bridge-ju...
  - isbvhodnvemrwvn 5y ago
    A regular user has no idea how these mechanisms work and can't be reasonably expected to do the configuration themselves. Since it's a clearly privacy-hostile behavior to include this code in the first place, the operator of the website should be prosecuted.
- leobg 5y ago
  I can put “rm -r /user” in my HTML as long as I want. It’s the user’s browser that decides what gets executed. This is a fundamental principle in the architecture of the internet. You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those.
  - tyilo 5y ago
    Going further with this argument would all hacking also be ok?
    - parksy 5y ago
      No because hacking generally circumvents the intended system design. The architecture of the World Wide Web explicitly allows for user discretion in fetching and executing linked content. There's no slippery slope from using a system within design parameters and executing malicious instructions on other people's systems without their permission and/or knowledge.
    - leobg 5y ago
      Good point. There is a distinction to be made. For fraud, we have those distinctions. If I send you an email that looks like an invoice for a service you already ordered, but is really, at closer inspection, an order form, I am still responsible if I planfully designed the email so that the average recipient would be fooled. This also means that if I send that email to grandmas I’ll be held more accountable than if I send it to lawyers. These are all important discussions. The ruling we see here just doesn’t enter such discussions, because the court hasn’t even recognized the problem.
  - rpadovani 5y ago
    Except you cannot. If you are aware of a vulnerability that triggers the destruction of user's data from the browser just visiting a website, abusing it would be illegal.
  - Flocular 5y ago
    >>You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those. By that logic malware doesn't exist. That's the wildest west version of the internet that we gladly left behind.
Luc 5y ago
The end result is that the fact that you visited this website is passed to Google, and this can then be used for advertising purposes.
- leobg 5y ago
  This is true. But the request containing that information is being sent by your own computer. It’s bit a “doing” of the website owner.
  - brazzy 5y ago
    It really depends. If the website links to a URL that is the same for everyone on every website which uses that font, then without a referrer header (which is up to the browser to send) there is not much tracking info. But if the website uses a URL that is unique for that site, or even for each user, that is absolutely something I'd hold the website owner responsible for.
    - leobg 5y ago
      Of course. Good point. If an individualized URL would be used, it would be another story. Though I don’t think that Google Fonts URLs contain individualized parameters by default that disclose either the user’s IP address or the site visited. The ruling also does not mention that this is what happened here. All the site user did, from what I can see, is embed a Google Font. Had the site owner put an automatic JavaScript redirect to Google on his page, he’d be just as liable, according to the logic of this ruling.
  - yonixw 5y ago
    The initiator as seen in F12 is the site HTML\CSS... not the browser.
- jstummbillig 5y ago
  > and this can then be used for advertising purposes. Can it? Is this within the range what Google is allowed to do in the EU right now? Because, if that is the case and we also wanted to stop that, wouldn't it be a lot more reasonable to just... forbid Google from doing that, instead of slapping every confused wordpress hack in the EU with a fine?
foepys 5y ago
Who does make my browser request the resource? Clearly the website owner who can also decide to make the browser load a resource fully under their own control. The user could block it, certainly. But I don't want my browser to ask me for every single URL if it's okay to request a resource.
LudwigNagasena 5y ago
That's just technical details. For all I care the website executes the code on my computer without my volition.
- loceng 5y ago
  So turn that off or don't use that browser? Where's your personal responsibility here?
  - isbvhodnvemrwvn 5y ago
    The law puts the responsibility on that on the website owner. A user can't be reasonably expected to know these mechanisms in depth.
  - LudwigNagasena 5y ago
    Where is my personal responsibility in making sure that the food I buy isn't poisoned and that the producer doesn't use slave labor? Where is my personal responsibility in making sure that my friend will return me a loan I made to him? Of course it is sensible to make basic precautions, but it is also sensible to expect social institutions like the legal system to help. Our society is immensely complex; it is quite naive to assume that everyone has enough time and power to watch out for things like that and fix them. It is also quite dystopian to think that people should by default treat every stranger and company as adversary. TL;DR separation of concerns is good
  - xg15 5y ago
    Cue the next post where people complain that using an ad blocker is theft.
Mo3 5y ago
Absolutely not surprising. I am originally from Germany and the whole of Bavaria is excruciatingly underdeveloped when it comes to IT. Outside Munich, it gets even worse as you venture deep into beer county where people who can reformat Windows are admired as the next Linus Torvalds and competition consists of people with varying degrees of beginner-level knowledge competing against each other. Merkel once said that the internet is a new territory for all of us... I am surprised the court even understood half of this.
- leobg 5y ago
  Bavaria only? If it had been up to Germany’s buerocrats, the whole internet would not exists. (Also, no cars. For calling a Ford Model T an “automobile” if it still needs a human driver is misleading to consumers, according to, again, the Munich district court.)
- Mikeb85 5y ago
  Lol was trying to check in for a flight using Lufthansa's website today; just hangs and doesn't do anything after you enter all the forms...
amelius 5y ago
> It is the the user’s browser that initiates a request to Google’s server. A request by the website itself to Google sharing the user’s IP address never actually occurs. Manipulating a system so that it gives up information that wasn't intended to be given away, is called hacking.
- ChrisLomont 5y ago
  The system is designed to do it. If you don't want your system operating as it was designed to do don't use it. It's not hacking.
  - loceng 5y ago
    And in addition to not being hacking, it's called taking responsibility - probably along with getting out of a coddled, learned helplessness state.
  - LudwigNagasena 5y ago
    I doubt that WWW was designed with intention to allow that. A bunch of different people with different goals do stuff they want and the result is something that just happens without anyone's intention. And we have legal systems and regulations to clear up such situations.
    - ChrisLomont 5y ago
      It was explicitly designed to do that. HTML is explicitly designed to allow content from multiple places; it is designed to do so. Your browser is designed to read that HTML and fetch those resources to render the page. The internet is designed to cache that content. Your browser cache is designed to cache that content so future fetch requests are faster. There's so many pieces explicitely designed to do this, for exactly this reason, that there is no question as to this being the intended behavior. Font servers are decades old. CSS added support for it in 1998, replacing earlier less common methods. This is not new or unintended behavior.
  - tored 5y ago
npteljes 5y ago
>The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. I wouldn't say so. By making use of the Google Fonts service, the website owner set up a scenario where the browser would then share the user's IP with Google. That's the default behavior of most browser setups. It's as good as sharing with Google directly, no? I feel like the scenario is similar to setting up a trap. Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame?
- rpadovani 5y ago
  > Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame? Well said. Law is not a programming language, the fact that the website didn't _technically_ share the IP, but did it through the browser, is not relevant.
  - marcus_cemes 5y ago
    I agree, but the definition of the law can also be interpreted many different ways, until it's clarified, I guess. This seems to me like a very grey area. There was no trap, in my opinion, document clearly specifies that an additional resource, here a font, will help the website look as intended by the designer. It's visible and its effects are well known (it's part of a well understood specification) and can be blocked. Websites have a responsibility, absolutely, but this is just feels like going too far...
    - npteljes 5y ago
      The going far feeling might come from the Overton window being pushed away in a direction. Regardless of what's right, healthy, good or bad usual things feel normal, and unusual will feel like going too far. The thing that matters in this feeling is what someone is gotten used to, which is not an objective quality of the thing, but an attribute of the viewer.
    - xg15 5y ago
      Not a lawyer, but to my knowledge, GDPR does not care if something technically "can be blocked" with some effort. It cares if there was clear, voluntary consent to share a particular bit of data - which wasn't the case here.
hnarn 5y ago
If you ask me, this argument is what we in Sweden call "satan reading the bible". I think you're fully aware that the practical result, i.e. what happens in reality, is that as the court puts it: > The transfer of the user's IP address in the above-mentioned manner and the associated encroachment on general personal rights Furthermore, the court is correct in stating that: > The use of font services such as Google Fonts cannot be based on Article 6 Paragraph 1 S.1 lit. f GDPR, since the use of fonts is also possible without the visitor having to connect to Google servers. Let's not be naive, we all know the purpose of Google offering these fonts for free via their CDN. As the author of a website, I think it's completely sensible that you should be responsible for the decision of embedding these fonts from Google rather than just serving them yourself: you are, in fact, "leaking" the IP addresses of your visitors to Google without their consent. This is in my mind just another one of those things that have been considered completely normal for a long time, but really shouldn't. A bit like how literally everyone used Google Analytics 15 years ago without really thinking about what that meant for the ethical processing of personal data.
- leobg 5y ago
  You’re making a good argument here. And you might just be right. You’re saying that website owners should be legal-politically responsible for typical privacy risks incurred by users if they are using popular browsers. And perhaps that is the right way to go. However, what strikes me is that the court hasn’t even seen this problem at all. Your train of thought - that the request was issued from the user’s browser, but that the site owner was essentially in control because he essentially tricked the user into sharing his information with Google without being asked - is just not being discussed at all. It might be very well that the end result is just. But then it would be a case of the blind chicken finding a grain.
arendtio 5y ago
While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs browser to share the IP address.
- marcus_cemes 5y ago
  > the w3c standards define, that browsers execute the commands they receive from the server I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly configure to leak their data, even if spec-adhering behaviour of rendering the webpage should not), to attempt to understand the document and retrieve any other resources that may assist displaying the content correctly. On the other hand, if one was to send CPU instructions back to the user, I guess it's also there choice to execute them...? Also, it's not possible to determine which resources are for display purposes (fonts), and which are for tracking purposes, the browser will blindly have to retrieve the resource, so websites have a certain responsibility to issue privacy-respecting "instructions". I'm trying to argue both sides here, I still believe that the user chooses voluntarily to use the browser, visit the webpage and therefore parse the document and initiate any subsequent requests that the document proposes, on the other hand, this is beyond most people, they just want to view a frickin' website, so perhaps the lives of web developers should be made harder to make the lives of the average Joe, who is not an IT expert, a little easier? The architecture of the web is inherently not privacy-respecting, in order to save bandwidth (and for sake of simplicity), we only send fragments and let the browser choose what else it needs, which can be tracked. It's like walking in a park. You choose to show your face to people, we've come to just accept the fact that by the laws of nature, we cannot prevent other people from seeing our face (unless you use a mask, but then you make them very uneasy), we leak data that others can remember and use to identify us later.
  - 5y ago
jannes 5y ago
> [...], if not installed on the user’s computer, [...] This is incorrect. The font is downloaded regardless of whether a font with the same name is installed on the system. The only exception is when you specify a local() function in @font-face [0], but almost nobody does that. [0]: https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face#description https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face#...
exegete 5y ago
Would that logic also work for loading images from other sites and services? I never sent the info to the server myself but told the browser to load the image from that server. Is you argument that it’s client-side code so doesn’t count?
skinkestek 5y ago
It might sound weird and even sounded weird to me at first but I think it reduces to setting a trap for the user: If 1. we accept that Google knowing we visit certain websites can hurt a user 2. one can get punished for not fencing of a construction website because someone could get hurt then in my mind this is a very obvious digital equivalent.
Mikeb85 5y ago
So does this mean assets hosted by CDNs are illegal now? Since it doesn't ask the user's permission to direct the browser to another site to download said assets? And what if they're already cached in the browser. Distinction? Seems like laws don't understand how tech works...
- huijzer 5y ago
  > And what if they're already cached in the browser. It is a common misconception that CDN objects are cached. They are not: https://httptoolkit.tech/blog/public-cdn-risks/ https://httptoolkit.tech/blog/public-cdn-risks/
- janoc 5y ago
  >Seems like laws don't understand how tech works... That's pretty much the definition of a law. Laws are written for people, by people. Not for computers. This is sadly an unintended consequence of a very broad interpretation of GDPR, where an IP address is deemed as personally identifiable information. If someone wanted to take this to absurd levels, similar argument, as has been made by this court, could be used to make the entire Internet illegal under GDPR - sending a packet exposes personal information of the sender to various third parties (routers of various ISPs) that the sender didn't consent to. And given that the recipient (service provider, website, whatever) could have arranged for having the data transferred on a floppy disk or by a pigeon instead ... It is not only GDPR that suffers from this - e.g. in Austria it is illegal to drive with a dashcam because their court has ruled that a dashcam amounts to recording someone without their consent - and if you do so, it exposes you to a 20k€ fine!
- leobg 5y ago
  Exactly! You’ll soon have to fill out a form as if undergoing surgery just to visit a website. (And, of course, were all gonna click “Accept all”, just as we do with cookie warnings and Apple TOS.) These judges do not know what they do. They only care about getting the case off their desk, clinging to the first semi plausible argument that allows them to do so. If you look for vision, guidance or responsibility for shaping the future I which we want to live, look elsewhere.
gatgeagent 5y ago
Which is the same thing with cookies, you just set some string in a HTTP header, if the browser actually honors that is up to user (in the way what browser he installs and how the user configures it).
- leobg 5y ago
  Exactly. Your browser preferences are your cookie settings. The whole business of littering the web with cookie consent forms is as far from a sensible technical solution to the problem as can be imagined. The people who invented the web and who designed browsers have had at least the aspiration to build a system that’s going to work as a whole. Courts and lawmakers, in the other hand, have no such vision.
zuzun 5y ago
The ruling explicitly says the right owner does not need to take precautions, because such an obligation would restrict the right holder in the exercise of their rights worthy of protection.
dathinab 5y ago
The technical implementation details don't matter. What matters is that the IP will be shared with Google as consequence of visiting the site as long as the user didn't take additional actions and without the user having took additional actions which made that happen.
- leobg 5y ago
  This will also happen if I place a link on my site that does not clearly warn the user that it leads to a non EU website. User clicks it, and his IP address gets disclosed. Really, if you participate in the World Wide Web, of course your computer’s address will be visible to others, and you can not always control it. Like driving on the Autobahn. People will be able to see you. It’s part of life.
  - dathinab 5y ago
    GDPR differentiates between functional necessary and non-functional necessary parts. And again technical nit-picking do not matter, but user intend does. Similar that side you link to would also need to be GDPR compliant (or not provide service in EU countries). The problem with google fonts is that the side which loads them agrees in your stead without your permission to google collecting your data and using it for non essential use cases. While when you navigate to an side, it must not collect data beside purely functional data until you agree to it. (and yes collecting IP address can be purely functional, depending on what you do with it and if you delete it in time. E.g. for security logs and DDoS protection it can be purely functional. (if some conditions are meet)). Be aware what counts as "neccessary"/"purely functional"(1) is not always fully clear. (1): Not necessary the wording used by the law.
    - leobg 5y ago
      Ok, good points. What about embedding a Google Map? I see those even on websites of German courts. Are those allowed because the embed is needed functionally? Or are they not, because you could instead use a cached image of the map and switch to a “live” connection to Google’s map server only when the user actually tries to move or zoom the map (and after displaying a consent pop up)?
xg15 5y ago
The user's browser is not the user. By that logic, any and all tracking pixels, javascript, iframes, etc would be regulatory no man's land, because all of those are technically just "intents" the server signals. Nevertheless, users are seldomly in a position to decide whether or not those intents are followed (and site owners can get quite mad if a user instructed their browser to "decline" such an intent e.g. through an ad blocker). All of that makes it reasonable to treat those intents as commands.
- leobg 5y ago
  So the same action on the part of the website owner will be legal or illegal depending on whether or not the user has actively configured his browser?
- 2ion 5y ago
  Users are enabled to set policy by disabling JavaScript execution by default. If GDPR sees an issue with current default policy, it should mandate that policy is in alignment with user expectations by default, by disabling policy. For web content, after all, doing everything on the server side is not impossible.
  - xg15 5y ago
    Where does it say they see an issue? They just argue that web assets are the responsibility of the site developer, not the user - which is the exact opinion site developers have as well in pretty much every other context. It's also the expectation of users: Most users aren't experts and don't know what javascript, web fonts or GET requests even are. You can't have your cake and eat it too. > Users are enabled to set policy by disabling JavaScript execution by default. They aren't. All mainstream browsers have removed the option to disable JavaScript. You have to install 3rd-party plugins to get the option back. Those plugins frequently break sites.
no_time 5y ago
>The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. "Your honor, I merely told the gun to strike the firing pin. Without a round chambered in, the gun wouldn't have done anything."
- dsego 5y ago
  Your honor, I instructed my browser to point a gun at me and it shot me. Surprised Pikachu face.
  - no_time 5y ago
    I sure wish the average person could instruct their browser to avoid this happening without their knowledge.
xunn0026 5y ago
So if I put a really giant mirror and burn your house at 3PM it's the Sun's fault? The ruling is actually quite logical. The (convoluted) outcome is that the IP is leaked and it should take any tech person about 5 minutes to realise this.
- leobg 5y ago
  If I place a link that says “Search”, and instead of starting a search on my site, I send you to Google.com, your browser will connect to Google’s server and thus telling them your IP address. Such a hyperlink that does not clearly warn users that clicking it will cause you to connect to someone else’s server would also have to be illegal according to this ruling.
- jeltz 5y ago
  No, it is his house's fault for deciding to catch fire.
arrenme 5y ago
This isn't "just" initiating a request to a random third party server. Chrome sends a unique ID when accessing (only!) google servers, in the form of X-client-data HTTP header, uniquely identifying the user, and the site he is browsing (via referrer). It's a goldmine. X-client-data: CIS2yQEIprbJAZjBtskBCKmdygEI8J/KAQjLrsoBCL2wygEI97TKAQiVtcoBCO21ygEYq6TKARjWscoB
- leobg 5y ago
  I did not know this. However, do note that the ruling does not talk about this. It might have been a different browser altogether. Also, it would seem to me that the responsibility for such behavior lies with Google and Google Chrome more than it does with individual webmasters.
- IgorPartola 5y ago
  So the fault is with Google and Chrome and not the defendant?
  - ozim 5y ago
    No, defendant made website in a way that request to Google is part of the required requests when you visit their website. It does not ask person browsing for permission to do the request to Google. Probably there was also no mention anywhere that code of website will be connecting to a 3rd party server to pull fonts.
    - IgorPartola 5y ago
      Your point was that Chrome sends additional tracking data specifically to Google. That is all Google’s doing. But also let’s break down the many many things wrong with this case: 1. Your IP address is shared with many different infrastructure providers none of whom you know about: the CDN that is serving content, the server hosting providers, the TLS certificate revocation log where your browser checks if they given domain’s certificate has been revoked, the DNS server you used. It is a given that your user agent will tell half the Internet that you IP is trying to access a given website. Unless everyone hosts their own infrastructure entirely (no CDN, no external APIs, no external DNS servers, no leasing servers let alone AWS or similar), we will never not leak IP addresses. Your only solution to this is to use something like Tor. 2. Asking each and every website to create an increasingly more complicated consent form for every service they use is going to create a huge anti pattern. The cookie consent forms already suck harder than a Dyson. Why would anyone want more of that? The correct solution is for Google to be punished for doing evil shit and to also build all the privacy controls into the user agent. This would still lead to some consent forms but at least the UI would be uniform and easy to understand. The current situation sucks bad and this case will make it worse.
floatingatoll 5y ago
GDPR specifies otherwise than your interpretation, logical as yours may be from a technical standpoint. The site operator chose an optional way to embed fonts in a way that divulges PII to a non-GDPR destination. As there is no legal or technical requirement to embed Google Fonts, the site operator is therefore liable. If use of Google Fonts was mandatory for the web to function, then the site operator would not have been found liable. It is not: they can be mirrored locally, or simply not used, and the web as viewed from the user’s perspective will continue to function just fine. (IANYL, etc.)

by leobg 5y ago

isbvhodnvemrwvn 5y ago

Using this logic I can send full fingerprinting data as long as I do it from the front-end? I mean courts are not that dumb, it's still the website owner which decides what is done.

Already__Taken 5y ago
The website owner decides what's asked to be done. The browser is still owned by the end-user can choose to make the request. This is why ad-blocking is fundamentally required.
Andrew_nenakhov 5y ago
Browser can be configured not to send this data. If I ask you to jump from the bridge, and you do, how is it my fault that you chose to comply?
- npteljes 5y ago
  So code in frontend would be "asking" in this case, in your opinion? Javascript is executed by default by all major browser deployments.
  - Andrew_nenakhov 5y ago
    If you are that caring about your privacy, you absolutely should use a browser that is configured in such a way that it doesn't leak your IP to anyone you didn't consent to.
    - npteljes 5y ago
      I'm running systems that I'm modifying to the extent that satisfies me, but that's not the concern here. Right now I'm caring about everyone's default privacy level, not just my own. And in this ideal world, third party sharing is not opt-out.
  - 7373737373 5y ago
    Yes, definitely. Ad absurdum, browsers could be mandated to have the user opt-in to every single instruction that is executed. It's technically possible, the user has control. I think it's a slippery slope to imagine/enforce a transfer of agency between the website user and provider, where the latter will try to make the opt-in appear as simple as possible. An ideal opt-in is more than the click of a button, it's an understanding. A button accompanied by a wall of text isn't understanding.
    - npteljes 5y ago
      Code in the frontend is absolutely not "asking". I'd bet that most of the users have no idea what's going on in their browsers and devices, and those instruments then, in turn, shouldn't prey on this ignorance. I know that this is not how the world works, but a difference is that we could have control over this one.
  - leobg 5y ago
    The court did not even see this issue, i.e. the distinction between issuing a suggestion or directive vs. actually executing the request directly. The court, in fact, states that the was the website itself that did the sharing. The ruling suffers from unsound reasoning. It could be, however, that the website owner never brought up these arguments. The court does not have to do its own investigation. This is called the “maxim of disposition” in German law. Whatever both parties agree on what is true has be treated as true by the court. So if the claim that the website itself issued the request to Google servers was uncontested, then this ruling is sound, based on the claims brought forth by the parties in this particular case.
- germanier 5y ago
  Depending on the circumstances, telling people to jump from the bridge can be a crime.
  - Andrew_nenakhov 5y ago
    Ok, don't jump from a bridge. Take off your clothes, and go to your neighbors, I'm asking you right now. Are you going to comply?
    - npteljes 5y ago
      Another thing came to mind. Let's say you know I'm the kind of person to easily give people money. I just got my paycheck, and you knowing this, you ask me to give you the money. I'll give you the money because that's the kind of person I am. But then I'm left with no money for the month, and all of its consequences. Who do you think would carry the blame in this situation?
    - rpadovani 5y ago
      You know that in many countries, encouraging or assisting illegal activity is a crime in itself, right? UK:https://en.wikipedia.org/wiki/Encouraging_or_assisting_a_crime_in_English_law https://en.wikipedia.org/wiki/Encouraging_or_assisting_a_cri... Germany (given we are talking about a German court): https://de.wikipedia.org/wiki/Anstiftung_(Deutschland) https://de.wikipedia.org/wiki/Anstiftung_(Deutschland)
      - Andrew_nenakhov 5y ago
        Stripping and jumping from a bridge is not illegal activity.
        ceejayoz 5y ago
        Both are illegal in quite a few places. Stripping may violate public nudity laws. Jumping off bridges is often illegal, as well. For example, Florida: https://www.tcpalm.com/story/news/local/2020/07/06/bridge-jumping-illegal-but-common-summer-treasure-coast/3198620001/ https://www.tcpalm.com/story/news/local/2020/07/06/bridge-ju...
- isbvhodnvemrwvn 5y ago
  A regular user has no idea how these mechanisms work and can't be reasonably expected to do the configuration themselves. Since it's a clearly privacy-hostile behavior to include this code in the first place, the operator of the website should be prosecuted.
leobg 5y ago
I can put “rm -r /user” in my HTML as long as I want. It’s the user’s browser that decides what gets executed. This is a fundamental principle in the architecture of the internet. You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those.
- tyilo 5y ago
  Going further with this argument would all hacking also be ok?
  - parksy 5y ago
    No because hacking generally circumvents the intended system design. The architecture of the World Wide Web explicitly allows for user discretion in fetching and executing linked content. There's no slippery slope from using a system within design parameters and executing malicious instructions on other people's systems without their permission and/or knowledge.
  - leobg 5y ago
    Good point. There is a distinction to be made. For fraud, we have those distinctions. If I send you an email that looks like an invoice for a service you already ordered, but is really, at closer inspection, an order form, I am still responsible if I planfully designed the email so that the average recipient would be fooled. This also means that if I send that email to grandmas I’ll be held more accountable than if I send it to lawyers. These are all important discussions. The ruling we see here just doesn’t enter such discussions, because the court hasn’t even recognized the problem.
- rpadovani 5y ago
  Except you cannot. If you are aware of a vulnerability that triggers the destruction of user's data from the browser just visiting a website, abusing it would be illegal.
- Flocular 5y ago
  >>You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those. By that logic malware doesn't exist. That's the wildest west version of the internet that we gladly left behind.

Luc 5y ago

The end result is that the fact that you visited this website is passed to Google, and this can then be used for advertising purposes.

leobg 5y ago
This is true. But the request containing that information is being sent by your own computer. It’s bit a “doing” of the website owner.
- brazzy 5y ago
  It really depends. If the website links to a URL that is the same for everyone on every website which uses that font, then without a referrer header (which is up to the browser to send) there is not much tracking info. But if the website uses a URL that is unique for that site, or even for each user, that is absolutely something I'd hold the website owner responsible for.
  - leobg 5y ago
    Of course. Good point. If an individualized URL would be used, it would be another story. Though I don’t think that Google Fonts URLs contain individualized parameters by default that disclose either the user’s IP address or the site visited. The ruling also does not mention that this is what happened here. All the site user did, from what I can see, is embed a Google Font. Had the site owner put an automatic JavaScript redirect to Google on his page, he’d be just as liable, according to the logic of this ruling.
- yonixw 5y ago
  The initiator as seen in F12 is the site HTML\CSS... not the browser.
jstummbillig 5y ago
> and this can then be used for advertising purposes. Can it? Is this within the range what Google is allowed to do in the EU right now? Because, if that is the case and we also wanted to stop that, wouldn't it be a lot more reasonable to just... forbid Google from doing that, instead of slapping every confused wordpress hack in the EU with a fine?

foepys 5y ago

Who does make my browser request the resource? Clearly the website owner who can also decide to make the browser load a resource fully under their own control. The user could block it, certainly. But I don't want my browser to ask me for every single URL if it's okay to request a resource.

LudwigNagasena 5y ago

That's just technical details. For all I care the website executes the code on my computer without my volition.

loceng 5y ago
So turn that off or don't use that browser? Where's your personal responsibility here?
- isbvhodnvemrwvn 5y ago
  The law puts the responsibility on that on the website owner. A user can't be reasonably expected to know these mechanisms in depth.
- LudwigNagasena 5y ago
  Where is my personal responsibility in making sure that the food I buy isn't poisoned and that the producer doesn't use slave labor? Where is my personal responsibility in making sure that my friend will return me a loan I made to him? Of course it is sensible to make basic precautions, but it is also sensible to expect social institutions like the legal system to help. Our society is immensely complex; it is quite naive to assume that everyone has enough time and power to watch out for things like that and fix them. It is also quite dystopian to think that people should by default treat every stranger and company as adversary. TL;DR separation of concerns is good
- xg15 5y ago
  Cue the next post where people complain that using an ad blocker is theft.

Mo3 5y ago

Absolutely not surprising. I am originally from Germany and the whole of Bavaria is excruciatingly underdeveloped when it comes to IT. Outside Munich, it gets even worse as you venture deep into beer county where people who can reformat Windows are admired as the next Linus Torvalds and competition consists of people with varying degrees of beginner-level knowledge competing against each other. Merkel once said that the internet is a new territory for all of us... I am surprised the court even understood half of this.

leobg 5y ago
Bavaria only? If it had been up to Germany’s buerocrats, the whole internet would not exists. (Also, no cars. For calling a Ford Model T an “automobile” if it still needs a human driver is misleading to consumers, according to, again, the Munich district court.)
Mikeb85 5y ago
Lol was trying to check in for a flight using Lufthansa's website today; just hangs and doesn't do anything after you enter all the forms...

amelius 5y ago

> It is the the user’s browser that initiates a request to Google’s server. A request by the website itself to Google sharing the user’s IP address never actually occurs. Manipulating a system so that it gives up information that wasn't intended to be given away, is called hacking.

ChrisLomont 5y ago
The system is designed to do it. If you don't want your system operating as it was designed to do don't use it. It's not hacking.
- loceng 5y ago
  And in addition to not being hacking, it's called taking responsibility - probably along with getting out of a coddled, learned helplessness state.
- LudwigNagasena 5y ago
  I doubt that WWW was designed with intention to allow that. A bunch of different people with different goals do stuff they want and the result is something that just happens without anyone's intention. And we have legal systems and regulations to clear up such situations.
  - ChrisLomont 5y ago
    It was explicitly designed to do that. HTML is explicitly designed to allow content from multiple places; it is designed to do so. Your browser is designed to read that HTML and fetch those resources to render the page. The internet is designed to cache that content. Your browser cache is designed to cache that content so future fetch requests are faster. There's so many pieces explicitely designed to do this, for exactly this reason, that there is no question as to this being the intended behavior. Font servers are decades old. CSS added support for it in 1998, replacing earlier less common methods. This is not new or unintended behavior.
- tored 5y ago

npteljes 5y ago

>The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. I wouldn't say so. By making use of the Google Fonts service, the website owner set up a scenario where the browser would then share the user's IP with Google. That's the default behavior of most browser setups. It's as good as sharing with Google directly, no? I feel like the scenario is similar to setting up a trap. Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame?

rpadovani 5y ago
> Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame? Well said. Law is not a programming language, the fact that the website didn't _technically_ share the IP, but did it through the browser, is not relevant.
- marcus_cemes 5y ago
  I agree, but the definition of the law can also be interpreted many different ways, until it's clarified, I guess. This seems to me like a very grey area. There was no trap, in my opinion, document clearly specifies that an additional resource, here a font, will help the website look as intended by the designer. It's visible and its effects are well known (it's part of a well understood specification) and can be blocked. Websites have a responsibility, absolutely, but this is just feels like going too far...
  - npteljes 5y ago
    The going far feeling might come from the Overton window being pushed away in a direction. Regardless of what's right, healthy, good or bad usual things feel normal, and unusual will feel like going too far. The thing that matters in this feeling is what someone is gotten used to, which is not an objective quality of the thing, but an attribute of the viewer.
  - xg15 5y ago
    Not a lawyer, but to my knowledge, GDPR does not care if something technically "can be blocked" with some effort. It cares if there was clear, voluntary consent to share a particular bit of data - which wasn't the case here.

hnarn 5y ago

If you ask me, this argument is what we in Sweden call "satan reading the bible". I think you're fully aware that the practical result, i.e. what happens in reality, is that as the court puts it: > The transfer of the user's IP address in the above-mentioned manner and the associated encroachment on general personal rights Furthermore, the court is correct in stating that: > The use of font services such as Google Fonts cannot be based on Article 6 Paragraph 1 S.1 lit. f GDPR, since the use of fonts is also possible without the visitor having to connect to Google servers. Let's not be naive, we all know the purpose of Google offering these fonts for free via their CDN. As the author of a website, I think it's completely sensible that you should be responsible for the decision of embedding these fonts from Google rather than just serving them yourself: you are, in fact, "leaking" the IP addresses of your visitors to Google without their consent. This is in my mind just another one of those things that have been considered completely normal for a long time, but really shouldn't. A bit like how literally everyone used Google Analytics 15 years ago without really thinking about what that meant for the ethical processing of personal data.

leobg 5y ago
You’re making a good argument here. And you might just be right. You’re saying that website owners should be legal-politically responsible for typical privacy risks incurred by users if they are using popular browsers. And perhaps that is the right way to go. However, what strikes me is that the court hasn’t even seen this problem at all. Your train of thought - that the request was issued from the user’s browser, but that the site owner was essentially in control because he essentially tricked the user into sharing his information with Google without being asked - is just not being discussed at all. It might be very well that the end result is just. But then it would be a case of the blind chicken finding a grain.

arendtio 5y ago

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs browser to share the IP address.

marcus_cemes 5y ago
> the w3c standards define, that browsers execute the commands they receive from the server I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly configure to leak their data, even if spec-adhering behaviour of rendering the webpage should not), to attempt to understand the document and retrieve any other resources that may assist displaying the content correctly. On the other hand, if one was to send CPU instructions back to the user, I guess it's also there choice to execute them...? Also, it's not possible to determine which resources are for display purposes (fonts), and which are for tracking purposes, the browser will blindly have to retrieve the resource, so websites have a certain responsibility to issue privacy-respecting "instructions". I'm trying to argue both sides here, I still believe that the user chooses voluntarily to use the browser, visit the webpage and therefore parse the document and initiate any subsequent requests that the document proposes, on the other hand, this is beyond most people, they just want to view a frickin' website, so perhaps the lives of web developers should be made harder to make the lives of the average Joe, who is not an IT expert, a little easier? The architecture of the web is inherently not privacy-respecting, in order to save bandwidth (and for sake of simplicity), we only send fragments and let the browser choose what else it needs, which can be tracked. It's like walking in a park. You choose to show your face to people, we've come to just accept the fact that by the laws of nature, we cannot prevent other people from seeing our face (unless you use a mask, but then you make them very uneasy), we leak data that others can remember and use to identify us later.
- 5y ago

jannes 5y ago

> [...], if not installed on the user’s computer, [...] This is incorrect. The font is downloaded regardless of whether a font with the same name is installed on the system. The only exception is when you specify a local() function in @font-face [0], but almost nobody does that. [0]: https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face#description https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face#...

exegete 5y ago

Would that logic also work for loading images from other sites and services? I never sent the info to the server myself but told the browser to load the image from that server. Is you argument that it’s client-side code so doesn’t count?

skinkestek 5y ago

It might sound weird and even sounded weird to me at first but I think it reduces to setting a trap for the user: If 1. we accept that Google knowing we visit certain websites can hurt a user 2. one can get punished for not fencing of a construction website because someone could get hurt then in my mind this is a very obvious digital equivalent.

Mikeb85 5y ago

So does this mean assets hosted by CDNs are illegal now? Since it doesn't ask the user's permission to direct the browser to another site to download said assets? And what if they're already cached in the browser. Distinction? Seems like laws don't understand how tech works...

huijzer 5y ago
> And what if they're already cached in the browser. It is a common misconception that CDN objects are cached. They are not: https://httptoolkit.tech/blog/public-cdn-risks/ https://httptoolkit.tech/blog/public-cdn-risks/
janoc 5y ago
>Seems like laws don't understand how tech works... That's pretty much the definition of a law. Laws are written for people, by people. Not for computers. This is sadly an unintended consequence of a very broad interpretation of GDPR, where an IP address is deemed as personally identifiable information. If someone wanted to take this to absurd levels, similar argument, as has been made by this court, could be used to make the entire Internet illegal under GDPR - sending a packet exposes personal information of the sender to various third parties (routers of various ISPs) that the sender didn't consent to. And given that the recipient (service provider, website, whatever) could have arranged for having the data transferred on a floppy disk or by a pigeon instead ... It is not only GDPR that suffers from this - e.g. in Austria it is illegal to drive with a dashcam because their court has ruled that a dashcam amounts to recording someone without their consent - and if you do so, it exposes you to a 20k€ fine!
leobg 5y ago
Exactly! You’ll soon have to fill out a form as if undergoing surgery just to visit a website. (And, of course, were all gonna click “Accept all”, just as we do with cookie warnings and Apple TOS.) These judges do not know what they do. They only care about getting the case off their desk, clinging to the first semi plausible argument that allows them to do so. If you look for vision, guidance or responsibility for shaping the future I which we want to live, look elsewhere.

gatgeagent 5y ago

Which is the same thing with cookies, you just set some string in a HTTP header, if the browser actually honors that is up to user (in the way what browser he installs and how the user configures it).

leobg 5y ago
Exactly. Your browser preferences are your cookie settings. The whole business of littering the web with cookie consent forms is as far from a sensible technical solution to the problem as can be imagined. The people who invented the web and who designed browsers have had at least the aspiration to build a system that’s going to work as a whole. Courts and lawmakers, in the other hand, have no such vision.

zuzun 5y ago

The ruling explicitly says the right owner does not need to take precautions, because such an obligation would restrict the right holder in the exercise of their rights worthy of protection.

dathinab 5y ago

The technical implementation details don't matter. What matters is that the IP will be shared with Google as consequence of visiting the site as long as the user didn't take additional actions and without the user having took additional actions which made that happen.

leobg 5y ago
This will also happen if I place a link on my site that does not clearly warn the user that it leads to a non EU website. User clicks it, and his IP address gets disclosed. Really, if you participate in the World Wide Web, of course your computer’s address will be visible to others, and you can not always control it. Like driving on the Autobahn. People will be able to see you. It’s part of life.
- dathinab 5y ago
  GDPR differentiates between functional necessary and non-functional necessary parts. And again technical nit-picking do not matter, but user intend does. Similar that side you link to would also need to be GDPR compliant (or not provide service in EU countries). The problem with google fonts is that the side which loads them agrees in your stead without your permission to google collecting your data and using it for non essential use cases. While when you navigate to an side, it must not collect data beside purely functional data until you agree to it. (and yes collecting IP address can be purely functional, depending on what you do with it and if you delete it in time. E.g. for security logs and DDoS protection it can be purely functional. (if some conditions are meet)). Be aware what counts as "neccessary"/"purely functional"(1) is not always fully clear. (1): Not necessary the wording used by the law.
  - leobg 5y ago
    Ok, good points. What about embedding a Google Map? I see those even on websites of German courts. Are those allowed because the embed is needed functionally? Or are they not, because you could instead use a cached image of the map and switch to a “live” connection to Google’s map server only when the user actually tries to move or zoom the map (and after displaying a consent pop up)?

xg15 5y ago

The user's browser is not the user. By that logic, any and all tracking pixels, javascript, iframes, etc would be regulatory no man's land, because all of those are technically just "intents" the server signals. Nevertheless, users are seldomly in a position to decide whether or not those intents are followed (and site owners can get quite mad if a user instructed their browser to "decline" such an intent e.g. through an ad blocker). All of that makes it reasonable to treat those intents as commands.

leobg 5y ago
So the same action on the part of the website owner will be legal or illegal depending on whether or not the user has actively configured his browser?
2ion 5y ago
Users are enabled to set policy by disabling JavaScript execution by default. If GDPR sees an issue with current default policy, it should mandate that policy is in alignment with user expectations by default, by disabling policy. For web content, after all, doing everything on the server side is not impossible.
- xg15 5y ago
  Where does it say they see an issue? They just argue that web assets are the responsibility of the site developer, not the user - which is the exact opinion site developers have as well in pretty much every other context. It's also the expectation of users: Most users aren't experts and don't know what javascript, web fonts or GET requests even are. You can't have your cake and eat it too. > Users are enabled to set policy by disabling JavaScript execution by default. They aren't. All mainstream browsers have removed the option to disable JavaScript. You have to install 3rd-party plugins to get the option back. Those plugins frequently break sites.

no_time 5y ago

>The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. "Your honor, I merely told the gun to strike the firing pin. Without a round chambered in, the gun wouldn't have done anything."

dsego 5y ago
Your honor, I instructed my browser to point a gun at me and it shot me. Surprised Pikachu face.
- no_time 5y ago
  I sure wish the average person could instruct their browser to avoid this happening without their knowledge.

xunn0026 5y ago

So if I put a really giant mirror and burn your house at 3PM it's the Sun's fault? The ruling is actually quite logical. The (convoluted) outcome is that the IP is leaked and it should take any tech person about 5 minutes to realise this.

leobg 5y ago
If I place a link that says “Search”, and instead of starting a search on my site, I send you to Google.com, your browser will connect to Google’s server and thus telling them your IP address. Such a hyperlink that does not clearly warn users that clicking it will cause you to connect to someone else’s server would also have to be illegal according to this ruling.
jeltz 5y ago
No, it is his house's fault for deciding to catch fire.

arrenme 5y ago

This isn't "just" initiating a request to a random third party server. Chrome sends a unique ID when accessing (only!) google servers, in the form of X-client-data HTTP header, uniquely identifying the user, and the site he is browsing (via referrer). It's a goldmine. X-client-data: CIS2yQEIprbJAZjBtskBCKmdygEI8J/KAQjLrsoBCL2wygEI97TKAQiVtcoBCO21ygEYq6TKARjWscoB

leobg 5y ago
I did not know this. However, do note that the ruling does not talk about this. It might have been a different browser altogether. Also, it would seem to me that the responsibility for such behavior lies with Google and Google Chrome more than it does with individual webmasters.
IgorPartola 5y ago
So the fault is with Google and Chrome and not the defendant?
- ozim 5y ago
  No, defendant made website in a way that request to Google is part of the required requests when you visit their website. It does not ask person browsing for permission to do the request to Google. Probably there was also no mention anywhere that code of website will be connecting to a 3rd party server to pull fonts.
  - IgorPartola 5y ago
    Your point was that Chrome sends additional tracking data specifically to Google. That is all Google’s doing. But also let’s break down the many many things wrong with this case: 1. Your IP address is shared with many different infrastructure providers none of whom you know about: the CDN that is serving content, the server hosting providers, the TLS certificate revocation log where your browser checks if they given domain’s certificate has been revoked, the DNS server you used. It is a given that your user agent will tell half the Internet that you IP is trying to access a given website. Unless everyone hosts their own infrastructure entirely (no CDN, no external APIs, no external DNS servers, no leasing servers let alone AWS or similar), we will never not leak IP addresses. Your only solution to this is to use something like Tor. 2. Asking each and every website to create an increasingly more complicated consent form for every service they use is going to create a huge anti pattern. The cookie consent forms already suck harder than a Dyson. Why would anyone want more of that? The correct solution is for Google to be punished for doing evil shit and to also build all the privacy controls into the user agent. This would still lead to some consent forms but at least the UI would be uniform and easy to understand. The current situation sucks bad and this case will make it worse.

floatingatoll 5y ago

GDPR specifies otherwise than your interpretation, logical as yours may be from a technical standpoint. The site operator chose an optional way to embed fonts in a way that divulges PII to a non-GDPR destination. As there is no legal or technical requirement to embed Google Fonts, the site operator is therefore liable. If use of Google Fonts was mandatory for the web to function, then the site operator would not have been found liable. It is not: they can be mirrored locally, or simply not used, and the web as viewed from the user’s perspective will continue to function just fine. (IANYL, etc.)