9 ms·

Good find. Every prompt I see I now wonder, did the EU do this? I came across an EU site that now make you click accept before they show you the LINK to a yout

• leobg 5y ago
  You cannot even embed fonts or libraries from a CDN. Because this could be construed as “leaking the visitor’s IP address” to the non-EU “Ausland”. You either have to host everything yourself, or ask the user for consent first.
  • david422 5y ago
    Once again, shouldn't that be controlled by the browser? The users browser is making the request, not the website.
    • leobg 5y ago
      Of course. Any engineer would solve it that way. And it ran just fine as a browser setting since the 1990s. But the EU isn’t run by engineers. It’s run by bureaucrats who try to save the web without understanding it. They’ve heard nothing of Chesterton’s Fence.
      • pojzon 5y ago
        Im pretty sure EU passed GDPR as a response to brexit figgling and facebook/google avoiding paying taxes.” Hurting EU market immensly. Politics dont understand the web but noticed its dengerous if left unregulated.
        • _abox 5y ago
          Not really. GDPR preparations predated the Brexit vote. It was even completed and passed several months before the vote even happened (back when everyone still expected it to fail, even Cameron who initiated it has no expectation it would pass) And EU tax avoidance is mainly done through Ireland and the Netherlands which are still member states.
      • zuzun 5y ago
        The GDPR is a sensible legislation and no amount of FUD can change that. If you can't explain what you are doing with personal data, you shouldn't be allowed to handle it. You are also confusing legislation with rulings. GDPR says your business interests cannot outweigh my rights. That's it. Now courts find that leaking my IP address to third countries is something that harms me more than it does your business good. I can live with that.
    • heavenlyblue 5y ago
      How does the web browser know if the website is under EU or US jurisdiction?
      • Joeri 5y ago
        GDPR applies to the data subject (the person visiting the site). It doesn’t matter where the website is hosted, it matters who visits it.
    • sofixa 5y ago
      The website is making the browser make that request, and the user has not had the opportunity to accept or deny the data transfer to the destination. That's it.
      • VBprogrammer 5y ago
        I don't believe it makes sense to have every website in the world implement this in a half arsed JavaScript implementation when it could be done once per major browser. Same with the cookie nonsense.
        • jakear 5y ago
          The only real explanation is that the cookie laws were explicitly designed to wear users down into blindly accepting whatever prompts get thrown at them on website load. Anyone with half a brain and a real intent to reduce tracking would have mandated websites abide by the existing Do not Track toggle. Unfortunately the law was instead introduced by politicians with strong lobbying from media industry. So no brain, and no intent to reduce tracking.
          • sofixa 5y ago
            The GDPR isn't a "don't track" law, it's a "tell me what data you collect on me, what you're going to do with it, who are you going to share it with, and allow me to refuse that, retroactively if need be" law. Vastly more nuance than an on/off toggle.
            • jakear 5y ago
              On paper, sure. In practice, it’s a quick path to “yeah whatever I accept all your stuff just show me the damn content I came here for”. The web would be much better off if the law was implanted with normal consumers and sane defaults in mind.
              • munk-a 5y ago
  • Dylan16807 5y ago
    Are you sure it's an issue if you use a CDN that isn't tracking people?
    • Godel_unicode 5y ago
      You mean like Google fonts? Yes, still an issue. https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq#what_does_using_the_...
      • Dylan16807 5y ago
        "Google Fonts logs records of the CSS and the font file requests, and access to this data is kept secure." They don't say how long the raw data is kept either, on a page trying to minimize the tracking, so we can probably assume it's longer than necessary for technical purposes. They keep it separate from their other tracking, but that's still collecting user data.
        • Godel_unicode 5y ago
          > still collecting user data. No.
          • Dylan16807 5y ago
            So logging every request indefinitely and in detail wouldn't count? The fact that you linked that page makes it seem like you agree that a CDN could collect user data. So what would it look like to meet that bar, by your reckoning?
            • Godel_unicode 5y ago
              > ...and in detail... This is an extremely disingenuous way to phrase it. It's deliberately not hosted on a domain which would have any session information sent. There's no tacking information set by that service. I invite you to actually look at a call to this service (you'll want to Google "browser developer tools", that should get you started) and realize that there is no user data in the request. Because of course there isn't. >...makes it seem like you agree... Ah, the classic tactic of standing up a weak strawman and then arguing against that. Good to see you again, nemesis.
  • turbinerneiter 5y ago
    Maybe if everyone wasn't leaking my entire lifes history to 58 different adtech shitcompanies the EU wouldn't have needed to step in. Now people say "oh but if every website hosts their own fonts the browser can't cache them" while sending me 35 megs of shitty tracking Javascript code. There is a very clear aggressor here and it's not the EU or the regulators.
    • Talinx 5y ago
      What about a HTML tag that includes a hash sum? Only request the resource if not already present. That could enable cross-website resource caching without leaking information. (IF the resource the site sends if necessary matches the resource of the tag, otherwise the hash sum would tell the server whether the user visited some other site.) Hashing content makes more sense than relying on the URL staying the same IMHO.
      • kevin_thibedeau 5y ago
        The Decentraleyes extension does this.
        • contravariant 5y ago
          Unless the situation has changed the LocalCDN extension is a bit more active and contains more (recent) resources.
      • MarkSweep 5y ago
        I think the reason this is not done is it would leak to the website if the user had previously downloaded the same file from a different website.
        • vanviegen 5y ago
          Sure. And you can do the same thing with a CDN file by timing how long it takes to load. Sub millisecond means cache.
  • varenc 5y ago
    That’s just absurd. Browsers, or User-Agents, should be where this is implemented. “This site would like to fetch external resources. Allow or Block?”. Same goes for all those cookie prompts. Then the consent question would actually be presented in a balanced way. And the preference could be stored even if you wipe cookies. At moment if you distrust cookies, your preferences expressing your distrust of cookies is constantly being reset forcing you be re-prompted again and again. (It might be harder for regulation to require changes in browser though, and then there's legacy browsers, so I can see how we ended up here)
    • Fatnino 5y ago
      Is it really harder to require 2-4 entities to make a change than it is to require zillions of website to do it?
      • varenc 5y ago
        Fair point. It would certainly be a better world. Though constantly self-updating browsers are a relatively new thing and the legislators probably wanted to "protect" all those people stuck on IE11? And legal precedence wise, laws have been requiring things of websites for a long time, but I can't think of any legislation that has required certain behavior by browser applications themselves. Since browsers, in theory, just implement open web standards, requiring something of them is effectively legislating a forced change into web standards. That's a spooky thought. But let's be real... having individual websites ask for cookie and 3rd party request consent makes opt-out massively less popular than if this was built into the browser. If the "disable ad-targeting cookies" button wasn't hidden behind obtuse UI bespoke to each site, far far more people would opt out of them. I suspect that's a big reason why we got to this arrangement.
    • TheCoelacanth 5y ago
      GDPR isn't about loading external resources, though. It's about tracking. The browser has no way of knowing what kind of tracking is going to happen on the server it's connecting to or what jurisdiction that data would fall under. If trackers would provide metadata indicating what kind of tracking each resource is going to do, then browsers could handle it, but trackers would never do that without being forced because they want to make opting out of tracking as painful as possible.
  • wolki 5y ago
    AIUI the embedding is itself not the issue. The issue is that you are leaking user data to a third party, and this needs to be handled with care, considering the degree of threat to the user data, your legitimate need to use a CDN, and any possible consent. If your CDN assures you that this data will only be used for legitimate purposes and conforming to GDPR, I think (but IANAL) that explicit user consent wouldn't be necessary, as site owners have a legitimate interest in using CDN services. After all, DDoS prevention is even explicitly listed as a legitimate interest, and fulfilling this legitimate interest is itself enough to allow processing of personal data, without further consent. With the Google fonts ruling, the issue seemed to be that there was no such agreement in place, Google is known for aggressively building user profiles, and the technical need for this was judged to be low, as fonts are rather small and the site could have operated with self-hosted fonts. This was considered to go beyond the scope of the legitimate interest - it's essentially selling user data to Google to save a little on bandwidth, and that would require consent. (Then there is a separate issue with a human rights dispute between EU and US that makes things a bit more complicated)
  • dotancohen 5y ago
    > You either have to host everything yourself, or ask the user for consent first. As a user, I am very very glad that this is the case.
• vasco 5y ago
  I wonder if nobody in the EU regulatory bodies read what Snowden shared. The fact that requests go to US based datacenters has no impact on US's ability to spy on foreign citizens. They latch on to fiber cables everywhere and slurp up all the data they can. What EU should be doing is telling US to reel in their agencies or else all US tech companies get taxed out of the wazoo for operating in the EU. But no, instead all European citizens and businesses have to suffer through these braindead restrictions in how buttons are placed or what popups are needed as if they have any impact on privacy whatsoever.
  • smooc 5y ago
    This is exactly what the Schrems I/II rulings encapsulated: the Privacy Shield agreement was ruled invalid as any guarantees made on the privacy of European Citizens data transferred to the US were deemed to be fake. This has put a lot of cloud migrations on hold particularly for companies that are dealing with sensitive data, like banks and health care, but also retailers. So it is approached from the consuming end for better or worse.
  • woobar 5y ago
    Because EU regulators knew what the response will be. Trade wars go both ways, and EU is more vulnerable in case of all out confrontation.
  • PoignardAzur 5y ago
    Uh, there's also increasingly broad mandates that all sensitive data of european citizens should be located in european-based datacenters managed by european companies with no legal liability to the US. Acting like the EU isn't reacting to american spying is frankly just ignorance of the situation.
• Semaphor 5y ago
  > I came across an EU site that now make you click accept before they show you the LINK to a youtube video. This was somewhat common in Germany for years. I also remember Facebook buttons behind such an opt-in mechanism.