6 ms·

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

pantulis 5y ago
Or linking anything, for that matter
piaste 5y ago
It unquestionably leaks information, and it is why projects like Decentraleyes exist. Whether it is "unnecessary" is the interesting question. For fonts, it's really hard to claim that you couldn't have created the website without Google's fonts CDN.
tomp 5y ago
A CDN that sells your data (or doesn’t otherwise protect it) is more accurately termed “spying network”
- paulgb 5y ago
  Does this ruling distinguish between “does” and “could”, though? Because any CDN could spy if they wanted. Google fonts has a pretty reasonable privacy policy[1]. I don’t read German, so I wonder if there’s nuance here that I’m missing (like, did they find that Google actually was misusing the data?) https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq#what_does_using_the_...
  - _0w8t 5y ago
    Google is a US company and the US government can and do ask companies to provide any data on the servers even if it is against the policy Google has written in that document.
    - paulgb 5y ago
      That’s no different than a CDN hosted in any other country, though, so it gets back to HL33tibCe7‘s point that this seems it would apply to CDNs.
- iqonq 5y ago
  Shouldn't be the onus on the regulator's part to prove that Google is selling or not protecting the user's IP address?
  - Acinyx 5y ago
    Google is an advertising network, they don't need to sell the IP to make money. It's on the original website to prove that they only use your data for what you asked them to, if you want to do anything else, you need to request informed consent. Using hosted Google fonts is not needed to run the website (as you can also easily embed them without having the user touch Google). And Google will not say they won't do anything with that data, as they would be lying since that's the whole reason google fonts and other free webdev resources by Google exists: to gather as much data about the user it can.
hexo 5y ago
Yes, it would. Actually so many uses of CDN's are nonsensical. I mean, I literally block those requests and sites just work OK. (For my definition of OK. If I don't see autoloading autoplaying video it's only a big big plus)
- liveoneggs 5y ago
  that's not what a cdn is for or does
DavideNL 5y ago
Well, a font is not equal to "any content". So perhaps the issue is whether it is necessary/sensible, just for providing a simple font, to contact Google/any cdn. Spoiler, of course we all know it is not...
- HL33tibCe7 5y ago
  My reading is that nothing in the argument depends on the exact resource in question being a font, so I don’t see why it wouldn’t generalise to other resources.
  - DavideNL 5y ago
    > Google Fonts kann durch die Beklagte auch genutzt werden, ohne dass beim Aufruf der Webseite eine Verbindung zu einem Google-Server hergestellt wird und eine Übertragung der IP-Adresse der Webseitennutzer an Google stattfindet. translated: > Google fonts can be used by the defendant in a different way, so that a connection to the website does not make a connection to the Google server, thus without transmitting the IP address of the website visitor to Google.
Hnrobert42 5y ago
It’s not a question of what is necessary. It’s a question of transparency and consent. You must gain consent for giving Google personal data for tracking purposes.
- jstummbillig 5y ago
  But why? Why must you do that to begin with? ELI5: Why does the EU not just prevent Google from using personal data they receive by law in any way they see fit? Would that not be a lot more effective than requiring the millions of small businesses and small web devs to figure it out on their end?
  - Hnrobert42 5y ago
    I was not arguing the sanity of the policy. I was merely correcting GP’s interpretation of the ruling. Better for the millions of small businesses to only have to post a list of sub-processors than to have to determine what would be “necessary” in the eyes of the law.
  - Acinyx 5y ago
    That's the main revenue stream of Google it would pretty much mean Google itself would be forbidden. The EU gives companies the option and only requires all this hoopla if you want to use the data for something else than the user requested. The "problem" is that Google does want that, as they are an advertising network, so they give web developers access to their tools but tell you that you have to ask the user for consent. That everyone totally forgets those warnings and somehow forgets that Google is an advertising network is on them, just like it is your responsibility what are random dependencies you download using whatever dependency tool you use.
    - jstummbillig 5y ago
      > That's the main revenue stream of Google it would pretty much mean Google itself would be forbidden. If Google was banking its business on Europeans continuing to click "Accept all" in privacy popups, that would be worrisome – but I doubt it's true.
chucktingle 5y ago
Yes. Fuck CIA^H^Hloudflare.
- 7373737373 5y ago
  Care to elaborate?
npteljes 5y ago
Well, I'd say so yes. It's the same thing that came up when hotlinking was first a major thing[0]. In my opinion, anything but communication with the first party violates expectations. If I visit Imgur, then I expect to deal with Imgur, and not with their myriad of third parties all doing something else that's not directly my business. People of course don't mind, reality is often like this too. [0] https://en.wikipedia.org/wiki/Inline_linking#Controversial_uses_of_inline_linking https://en.wikipedia.org/wiki/Inline_linking#Controversial_u...
schleck8 5y ago
Wrong. In this case it's illegal because Google Fonts can be served from the origin server as they are downloadable. The same does not apply to sideside CDNs. However, I believe NPM CDNs are the same scenario, so I'd start serving packages from the server as well.
- kevincox 5y ago
  What if my origin server is behind Google Cloud CDN anyways? I mean it is possible for me to run my own datacenter with a direct connection to the users IP but that is obviously unreasonable. As soon as I outsource anything it can now see the users IP. I guess this particular case seems somewhat reasonable, but where is the line. Also note that Google Fonts is a lot more that just hosting a download. It has different font files for different browsers for max compatibility as well as font splitting so that you aren't downloading too many glyphs and weights that you don't need for this page. Reimplementing Google Fonts isn't trivial.
kevincox 5y ago
How does this not reduce to hitting any server not owned by you is leaking your IP address? If I host my website behind Google Cloud CDN they have logs of the visitors IP. If I host my site on S3 they log the IP. Does this mean that a visitor must insteract only with services that I own until I can get concent to use "unnecessary" third party services? I think it is pretty significant if "necessary" is reduced to "could have don't it without". Because sure I could avoid Google Fonts, but now I need to do splitting and per-browser detection myself. Ok sure, browser font support is pretty consistent these days and I know my site just uses English and emoji in some pages. But now I can't throw that site in cloud storage. I also can't use a VPS because there are traffic logs. So I buy a server in a datacenter. But what if they have some form of traffic logs? I guess my question is where does this definition of "unnecessary" stop.
- kall 5y ago
  That‘s what it reduces to, yes, and german courts seem set on actually creating precedents [0] for that dreadful situation. [0] https://www.taylorwessing.com/en/insights-and-events/insights/2021/12/vg-wiesbaden-prohibits-use-of-content-delivery-networks https://www.taylorwessing.com/en/insights-and-events/insight...
  - Jon_Lowtek 5y ago
    The core issue with the linked situations is that the US Cloud Act applies, which means that US governmental agencies can request access to i.e. traffic logs, without a court order for mass surveillance.
  - deleted 5y ago
    [deleted]
quyse 5y ago
What if I host my website on Google Cloud Platform? I guess it should be OK then to use Google Fonts CDN on the website, because it's the same entity, and visitor's IP was already leaked to Google when the HTML page was served. Can't really ask user for consent before loading the HTML page!
- kall 5y ago
  You may not serve a website to german visitors from GCP at all, certainly not without getting consent first.
  - quyse 5y ago
    Does it mean Google, AWS, DigitalOcean, Cloudflare, Akamai, and everybody else (except Hetzner) are now outlawed in Germany? Because, as I said, I cannot ask for consent before serving the initial HTML, unless someone develops a magical IP-less protocol for delivering consent. I'm not sure if even Hetzner server is OK, it's still a third party even if Germany-based.
    - kall 5y ago
      If we take another ruling [0] seriously, Hetzner is dicy only because they recently added a US datacenter. For the others, yeah. You could rent colo, go with a friendly neighborhood hoster like uberspace or with something like Telekom Cloud (lol). [0] https://www.taylorwessing.com/en/insights-and-events/insights/2021/12/vg-wiesbaden-prohibits-use-of-content-delivery-networks https://www.taylorwessing.com/en/insights-and-events/insight...
  - perlgeek 5y ago
    I'm pretty sure this is not correct. There is a technical necessity for your hosting provider to see the user's IP. The GDPR does not require consent for passing on private information when there is a technical or legal necessity, as well as a number of other preconditions.
floatingatoll 5y ago
Using a CDN service operated by a non-GDPR business such as Cloudflare, Google, Amazon, or Akamai could potentially be confirmed to be a violation of GDPR, yes, if the CDN-hosted resources are used without opt-in. I’m eagerly awaiting the first complaint on these grounds to be reviewed and judged, now that the GDPR treaty with the United States has lapsed. It doesn’t matter where the CDN’s servers are; without the US having signed a treaty into law, each of their businesses are subject to compulsion by various US authorities to dishonor their commitments to the GDPR.
- hammyhavoc 5y ago
  Is CloudFlare really non-GDPR? https://www.cloudflare.com/en-gb/trust-hub/gdpr/ https://www.cloudflare.com/en-gb/trust-hub/gdpr/
  - CodeBytes 5y ago
    There was a very recent case which, at least for some types of data, found Cloudflare is not adequate: https://edpb.europa.eu/news/national-news/2021/census-2021-portuguese-dpa-cnpd-suspended-data-flows-usa_en https://edpb.europa.eu/news/national-news/2021/census-2021-p... It looks like the court decided SCCs were not sufficient as Cloudflare is subject to US surveillance laws so they wouldn't be able to provide adequate guarantees.

pantulis 5y ago

Or linking anything, for that matter

piaste 5y ago

It unquestionably leaks information, and it is why projects like Decentraleyes exist. Whether it is "unnecessary" is the interesting question. For fonts, it's really hard to claim that you couldn't have created the website without Google's fonts CDN.

tomp 5y ago

A CDN that sells your data (or doesn’t otherwise protect it) is more accurately termed “spying network”

paulgb 5y ago
Does this ruling distinguish between “does” and “could”, though? Because any CDN could spy if they wanted. Google fonts has a pretty reasonable privacy policy[1]. I don’t read German, so I wonder if there’s nuance here that I’m missing (like, did they find that Google actually was misusing the data?) https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq#what_does_using_the_...
- _0w8t 5y ago
  Google is a US company and the US government can and do ask companies to provide any data on the servers even if it is against the policy Google has written in that document.
  - paulgb 5y ago
    That’s no different than a CDN hosted in any other country, though, so it gets back to HL33tibCe7‘s point that this seems it would apply to CDNs.
iqonq 5y ago
Shouldn't be the onus on the regulator's part to prove that Google is selling or not protecting the user's IP address?
- Acinyx 5y ago
  Google is an advertising network, they don't need to sell the IP to make money. It's on the original website to prove that they only use your data for what you asked them to, if you want to do anything else, you need to request informed consent. Using hosted Google fonts is not needed to run the website (as you can also easily embed them without having the user touch Google). And Google will not say they won't do anything with that data, as they would be lying since that's the whole reason google fonts and other free webdev resources by Google exists: to gather as much data about the user it can.

hexo 5y ago

Yes, it would. Actually so many uses of CDN's are nonsensical. I mean, I literally block those requests and sites just work OK. (For my definition of OK. If I don't see autoloading autoplaying video it's only a big big plus)

liveoneggs 5y ago
that's not what a cdn is for or does

DavideNL 5y ago

Well, a font is not equal to "any content". So perhaps the issue is whether it is necessary/sensible, just for providing a simple font, to contact Google/any cdn. Spoiler, of course we all know it is not...

HL33tibCe7 5y ago
My reading is that nothing in the argument depends on the exact resource in question being a font, so I don’t see why it wouldn’t generalise to other resources.
- DavideNL 5y ago
  > Google Fonts kann durch die Beklagte auch genutzt werden, ohne dass beim Aufruf der Webseite eine Verbindung zu einem Google-Server hergestellt wird und eine Übertragung der IP-Adresse der Webseitennutzer an Google stattfindet. translated: > Google fonts can be used by the defendant in a different way, so that a connection to the website does not make a connection to the Google server, thus without transmitting the IP address of the website visitor to Google.

Hnrobert42 5y ago

It’s not a question of what is necessary. It’s a question of transparency and consent. You must gain consent for giving Google personal data for tracking purposes.

jstummbillig 5y ago
But why? Why must you do that to begin with? ELI5: Why does the EU not just prevent Google from using personal data they receive by law in any way they see fit? Would that not be a lot more effective than requiring the millions of small businesses and small web devs to figure it out on their end?
- Hnrobert42 5y ago
  I was not arguing the sanity of the policy. I was merely correcting GP’s interpretation of the ruling. Better for the millions of small businesses to only have to post a list of sub-processors than to have to determine what would be “necessary” in the eyes of the law.
- Acinyx 5y ago
  That's the main revenue stream of Google it would pretty much mean Google itself would be forbidden. The EU gives companies the option and only requires all this hoopla if you want to use the data for something else than the user requested. The "problem" is that Google does want that, as they are an advertising network, so they give web developers access to their tools but tell you that you have to ask the user for consent. That everyone totally forgets those warnings and somehow forgets that Google is an advertising network is on them, just like it is your responsibility what are random dependencies you download using whatever dependency tool you use.
  - jstummbillig 5y ago
    > That's the main revenue stream of Google it would pretty much mean Google itself would be forbidden. If Google was banking its business on Europeans continuing to click "Accept all" in privacy popups, that would be worrisome – but I doubt it's true.

chucktingle 5y ago

Yes. Fuck CIA^H^Hloudflare.

7373737373 5y ago
Care to elaborate?

npteljes 5y ago

Well, I'd say so yes. It's the same thing that came up when hotlinking was first a major thing[0]. In my opinion, anything but communication with the first party violates expectations. If I visit Imgur, then I expect to deal with Imgur, and not with their myriad of third parties all doing something else that's not directly my business. People of course don't mind, reality is often like this too. [0] https://en.wikipedia.org/wiki/Inline_linking#Controversial_uses_of_inline_linking https://en.wikipedia.org/wiki/Inline_linking#Controversial_u...

schleck8 5y ago

Wrong. In this case it's illegal because Google Fonts can be served from the origin server as they are downloadable. The same does not apply to sideside CDNs. However, I believe NPM CDNs are the same scenario, so I'd start serving packages from the server as well.

kevincox 5y ago
What if my origin server is behind Google Cloud CDN anyways? I mean it is possible for me to run my own datacenter with a direct connection to the users IP but that is obviously unreasonable. As soon as I outsource anything it can now see the users IP. I guess this particular case seems somewhat reasonable, but where is the line. Also note that Google Fonts is a lot more that just hosting a download. It has different font files for different browsers for max compatibility as well as font splitting so that you aren't downloading too many glyphs and weights that you don't need for this page. Reimplementing Google Fonts isn't trivial.

kevincox 5y ago

How does this not reduce to hitting any server not owned by you is leaking your IP address? If I host my website behind Google Cloud CDN they have logs of the visitors IP. If I host my site on S3 they log the IP. Does this mean that a visitor must insteract only with services that I own until I can get concent to use "unnecessary" third party services? I think it is pretty significant if "necessary" is reduced to "could have don't it without". Because sure I could avoid Google Fonts, but now I need to do splitting and per-browser detection myself. Ok sure, browser font support is pretty consistent these days and I know my site just uses English and emoji in some pages. But now I can't throw that site in cloud storage. I also can't use a VPS because there are traffic logs. So I buy a server in a datacenter. But what if they have some form of traffic logs? I guess my question is where does this definition of "unnecessary" stop.

kall 5y ago
That‘s what it reduces to, yes, and german courts seem set on actually creating precedents [0] for that dreadful situation. [0] https://www.taylorwessing.com/en/insights-and-events/insights/2021/12/vg-wiesbaden-prohibits-use-of-content-delivery-networks https://www.taylorwessing.com/en/insights-and-events/insight...
- Jon_Lowtek 5y ago
  The core issue with the linked situations is that the US Cloud Act applies, which means that US governmental agencies can request access to i.e. traffic logs, without a court order for mass surveillance.
- deleted 5y ago
  [deleted]

quyse 5y ago

What if I host my website on Google Cloud Platform? I guess it should be OK then to use Google Fonts CDN on the website, because it's the same entity, and visitor's IP was already leaked to Google when the HTML page was served. Can't really ask user for consent before loading the HTML page!

kall 5y ago
You may not serve a website to german visitors from GCP at all, certainly not without getting consent first.
- quyse 5y ago
  Does it mean Google, AWS, DigitalOcean, Cloudflare, Akamai, and everybody else (except Hetzner) are now outlawed in Germany? Because, as I said, I cannot ask for consent before serving the initial HTML, unless someone develops a magical IP-less protocol for delivering consent. I'm not sure if even Hetzner server is OK, it's still a third party even if Germany-based.
  - kall 5y ago
    If we take another ruling [0] seriously, Hetzner is dicy only because they recently added a US datacenter. For the others, yeah. You could rent colo, go with a friendly neighborhood hoster like uberspace or with something like Telekom Cloud (lol). [0] https://www.taylorwessing.com/en/insights-and-events/insights/2021/12/vg-wiesbaden-prohibits-use-of-content-delivery-networks https://www.taylorwessing.com/en/insights-and-events/insight...
- perlgeek 5y ago
  I'm pretty sure this is not correct. There is a technical necessity for your hosting provider to see the user's IP. The GDPR does not require consent for passing on private information when there is a technical or legal necessity, as well as a number of other preconditions.

floatingatoll 5y ago

Using a CDN service operated by a non-GDPR business such as Cloudflare, Google, Amazon, or Akamai could potentially be confirmed to be a violation of GDPR, yes, if the CDN-hosted resources are used without opt-in. I’m eagerly awaiting the first complaint on these grounds to be reviewed and judged, now that the GDPR treaty with the United States has lapsed. It doesn’t matter where the CDN’s servers are; without the US having signed a treaty into law, each of their businesses are subject to compulsion by various US authorities to dishonor their commitments to the GDPR.

hammyhavoc 5y ago
Is CloudFlare really non-GDPR? https://www.cloudflare.com/en-gb/trust-hub/gdpr/ https://www.cloudflare.com/en-gb/trust-hub/gdpr/
- CodeBytes 5y ago
  There was a very recent case which, at least for some types of data, found Cloudflare is not adequate: https://edpb.europa.eu/news/national-news/2021/census-2021-portuguese-dpa-cnpd-suspended-data-flows-usa_en https://edpb.europa.eu/news/national-news/2021/census-2021-p... It looks like the court decided SCCs were not sufficient as Cloudflare is subject to US surveillance laws so they wouldn't be able to provide adequate guarantees.