4 ms·

>The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. I wouldn't say so. By m

>The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. I wouldn't say so. By making use of the Google Fonts service, the website owner set up a scenario where the browser would then share the user's IP with Google. That's the default behavior of most browser setups. It's as good as sharing with Google directly, no? I feel like the scenario is similar to setting up a trap. Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame?

rpadovani 5y ago
> Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame? Well said. Law is not a programming language, the fact that the website didn't _technically_ share the IP, but did it through the browser, is not relevant.
- marcus_cemes 5y ago
  I agree, but the definition of the law can also be interpreted many different ways, until it's clarified, I guess. This seems to me like a very grey area. There was no trap, in my opinion, document clearly specifies that an additional resource, here a font, will help the website look as intended by the designer. It's visible and its effects are well known (it's part of a well understood specification) and can be blocked. Websites have a responsibility, absolutely, but this is just feels like going too far...
  - npteljes 5y ago
    The going far feeling might come from the Overton window being pushed away in a direction. Regardless of what's right, healthy, good or bad usual things feel normal, and unusual will feel like going too far. The thing that matters in this feeling is what someone is gotten used to, which is not an objective quality of the thing, but an attribute of the viewer.
  - xg15 5y ago
    Not a lawyer, but to my knowledge, GDPR does not care if something technically "can be blocked" with some effort. It cares if there was clear, voluntary consent to share a particular bit of data - which wasn't the case here.
    - marcus_cemes 5y ago
      I'm not either, and neither are most developers. My takeaway from this is GDPR doesn't care, leaked data is leaked data. I'm just worried about this implications this will have for non-malicious intent that the internet has evolved to use over time. Perhaps this is for the better, but I fail to see that future at the moment.
      - xg15 5y ago
        But we have enough evidence that there is a lot of malicious usage taking place - so I think this is sort of justified.
    - 2ion 5y ago
      Then GDPR should blame the browser vendors for shipping with JS execution enabled by default and demand that JS execution for all browsers be turned off by default. To repaint the stories spun by the grand parents: If I hold up a dagger and announce the fact, why would you run into the dagger anyway without protection? Put on some armor, dude. The client browser had all the information it needed to not make the request (geolocation, external resource, purpose of external resource) and yet it did. I know this is just shifting blame but it's also a good argument for returning HTTP 451 to EU clients and be done with it.
      - npteljes 5y ago
        >If I hold up a dagger and announce the fact, why would you run into the dagger anyway without protection? Put on some armor, dude. Let's say I'm dumb, and I run into the dagger that you're holding. The case is then investigated by the law enforcement. Who do you think they'll blame? Would I be deemed guilty, and would my crime be not having armor on?
marcus_cemes 5y ago
This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear. I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing?
- npteljes 5y ago
  "Can be sniffed", and "Provider is making a third party sniff" are two different things. Legally and ethically too. Right now you're right, the internet works this way. But that doesn't make it right, or fair, or anything, it just is. And it's also no reason it couldn't work in a different way.
- foxfluff 5y ago
  > This ruling will never stand in higher courts imo, because it would break the internet through fear. It wouldn't break the internet. The internet was fine when the vast majority of sites hosted all their own content and didn't ask your browser to load crap from dozens of domains. It wasn't even that long ago. Honestly I think it was better.
  - marcus_cemes 5y ago
    But it has since evolved, greatly, in complexity. Just because things were like something once, doesn't make it easy to go back. Hey, I'm all for more privacy, I'd like to go back to how it was before but keep the good parts from today, but this would make it harder for the small guy without some advancements in IT, private CDNs and easier font management. IT is already a nightmare just to keep it from breaking.
- Isinlor 5y ago
  This ruling will 100% be upheld in the higher courts. The website is arguing that they have a legitimate interest in downloading fonts from Google in client browser, but as the court correctly states the website can provide these fonts directly. There is no reason to infringe on the user privacy, so there is no legitimate interest. And therefore use of Google fonts was without a legal basis. BTW - The website could have used a different legal basis out of 6 available, like consent. See: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ > I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing? Unless there is another way to achieve the same purpose there is a legitimate interest in processing that data for the purposes expected by the client i.e. providing internet service.

rpadovani 5y ago

> Technically the victim activates the mechanism, but surely the one who sets the trap carries the blame? Well said. Law is not a programming language, the fact that the website didn't _technically_ share the IP, but did it through the browser, is not relevant.

marcus_cemes 5y ago
I agree, but the definition of the law can also be interpreted many different ways, until it's clarified, I guess. This seems to me like a very grey area. There was no trap, in my opinion, document clearly specifies that an additional resource, here a font, will help the website look as intended by the designer. It's visible and its effects are well known (it's part of a well understood specification) and can be blocked. Websites have a responsibility, absolutely, but this is just feels like going too far...
- npteljes 5y ago
  The going far feeling might come from the Overton window being pushed away in a direction. Regardless of what's right, healthy, good or bad usual things feel normal, and unusual will feel like going too far. The thing that matters in this feeling is what someone is gotten used to, which is not an objective quality of the thing, but an attribute of the viewer.
- xg15 5y ago
  Not a lawyer, but to my knowledge, GDPR does not care if something technically "can be blocked" with some effort. It cares if there was clear, voluntary consent to share a particular bit of data - which wasn't the case here.
  - marcus_cemes 5y ago
    I'm not either, and neither are most developers. My takeaway from this is GDPR doesn't care, leaked data is leaked data. I'm just worried about this implications this will have for non-malicious intent that the internet has evolved to use over time. Perhaps this is for the better, but I fail to see that future at the moment.
    - xg15 5y ago
      But we have enough evidence that there is a lot of malicious usage taking place - so I think this is sort of justified.
  - 2ion 5y ago
    Then GDPR should blame the browser vendors for shipping with JS execution enabled by default and demand that JS execution for all browsers be turned off by default. To repaint the stories spun by the grand parents: If I hold up a dagger and announce the fact, why would you run into the dagger anyway without protection? Put on some armor, dude. The client browser had all the information it needed to not make the request (geolocation, external resource, purpose of external resource) and yet it did. I know this is just shifting blame but it's also a good argument for returning HTTP 451 to EU clients and be done with it.
    - npteljes 5y ago
      >If I hold up a dagger and announce the fact, why would you run into the dagger anyway without protection? Put on some armor, dude. Let's say I'm dumb, and I run into the dagger that you're holding. The case is then investigated by the law enforcement. Who do you think they'll blame? Would I be deemed guilty, and would my crime be not having armor on?

marcus_cemes 5y ago

This is, for better or for worse, how the internet works. There may be better alternatives, but we're stuck with this for now. The truth is that an extraordinary amount of websites use a third-party resources, jQuery from CDNs, fonts from Google, etc. This ruling will never stand in higher courts imo, because it would break the internet through fear. I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing?

npteljes 5y ago
"Can be sniffed", and "Provider is making a third party sniff" are two different things. Legally and ethically too. Right now you're right, the internet works this way. But that doesn't make it right, or fair, or anything, it just is. And it's also no reason it couldn't work in a different way.
foxfluff 5y ago
> This ruling will never stand in higher courts imo, because it would break the internet through fear. It wouldn't break the internet. The internet was fine when the vast majority of sites hosted all their own content and didn't ask your browser to load crap from dozens of domains. It wasn't even that long ago. Honestly I think it was better.
- marcus_cemes 5y ago
  But it has since evolved, greatly, in complexity. Just because things were like something once, doesn't make it easy to go back. Hey, I'm all for more privacy, I'd like to go back to how it was before but keep the good parts from today, but this would make it harder for the small guy without some advancements in IT, private CDNs and easier font management. IT is already a nightmare just to keep it from breaking.
Isinlor 5y ago
This ruling will 100% be upheld in the higher courts. The website is arguing that they have a legitimate interest in downloading fonts from Google in client browser, but as the court correctly states the website can provide these fonts directly. There is no reason to infringe on the user privacy, so there is no legitimate interest. And therefore use of Google fonts was without a legal basis. BTW - The website could have used a different legal basis out of 6 available, like consent. See: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ > I'm curious to know whether DNS and your IP being in the the header of packets travelling through various different countries that can be sniffed is also considered as unwilful data sharing? Unless there is another way to achieve the same purpose there is a legitimate interest in processing that data for the purposes expected by the client i.e. providing internet service.