17 ms·
Court Rules Websites Embedding Google Fonts Violates GDPR
- viro 5y agoThis is silly, next up CDNs violate GDPR.
- jaywalk 5y agoThis ruling basically does say that embedding any third-party resources in your page is a GDPR violation. It is silly, and I'm not sure why you're getting downvoted. This ruling can't be allowed to stand.
- Lascaille 5y ago>This ruling can't be allowed to stand. Sounds like a great ruling from a security and user perspective. Just changes a design paradigm. If it kills a business model that's based on intrusive user-tracking and the user being totally unable to know who has their data and who their computer should vs shouldn't be connecting to - great. Trying to figure out from traffic analysis alone these days whether a website is malicious or not is an absolute nightmare as every single site pulls in 20 or 30 externally-hosted resources for totally impenetrable purposes. Let's migrate to an easily understandable model where sites host 100% of their own resources. If that means the site engine has to run CI behind the scenes and pull in those resources, great, it centralises responsibility.
- rezonant 5y agoHow about for video? This effectively kills the ability for a small website to pay for video hosting services from a well scaled video CDN. This effect can be generalized: At some point the only organizations with the resources to comply with the GDPR are in fact the big tech companies.
- jaywalk 5y ago> If it kills a business model that's based on intrusive user-tracking and the user being totally unable to know who has their data and who their computer should vs shouldn't be connecting to - great. What are you talking about? You can always block whatever you want, and we're not talking about "intrusive user-tracking" here but literally just an IP address. You can have the opinion that websites shouldn't use third-party resources, but legislating that requirement is beyond ridiculous. There are countless good reasons for using third-party resources on websites, and disallowing it will absolutely make the web a worse place regardless of any "privacy" benefits it could have.
- dleslie 5y agoOnly third party CDNs.
- gred 5y agoI wonder where the line is drawn? If you set up AWS CloudFront, does that count as third party? Or is this taking us back to colo / in-house data centers?
- lmkg 5y agoSo far, the line that has been drawn by the courts is "is the IP address visible to a company subject to the CLOUD Act in the United States?" AWS CloudFront would meet that definition: Amazon is covered by the CLOUD Act, and the visitor's IP address is visible when using that service.
- gred 5y agoThanks for the clarification. Seems crazy to me, but hopefully a compromise is worked out soon.
- lmkg 5y agoThat already happened. Cookiebot (Danish) was fined for using Akamai CDN. Note that it's not all CDNs, fonts, etc. It's ones that are subject to the CLOUD Act in the United States. Non-American companies, or even US companies which are not subject to the CLOUD Act, might be OK.
- jeroenhd 5y agoIt's not just American companies, though; African, Australian, Canadian, Mexican and Russian companies have the exact same restrictions. The general rule is "privacy enforcement and protections must be as good or better than the EU's". It's possible for a country to get certification from the EU that the privacy protections of said country are strong enough. When that happens (see the failed Privacy Shield and friends for an example), you can let companies from those countries process PII if there are significant protections built into the contract (say, a huge fine to you if they mess up and leak the data of your customers, as the EU cannot impose their own fines as easily). From what I can tell, the contracts and DPAs most American cloud providers eagerly send you are good enough to satisfy this constraint if the companies weren't subject to American law.
- lmkg 5y agoI see where you're coming from, but that's not quite true. GDPR basically puts international transfers into two buckets: Adequacy Decision, and Other. Adequacy decision means the other country's laws are "good enough," and your obligations are literally just to put the words "Adequacy Decision" in your privacy policy somewhere. Other means you need to take "additional safeguards" to ensure data privacy is protected. This is a bit of a bother, but eminently feasible. The "standard" way to do this is put additional terms in the contracts you sign with third parties (and only use third parties where you have signed contracts). The situation with the United States is unique: the EU have ruled that no possible safeguards are good enough. US law enforcement's needs override any contract you can sign, so it is legally literally not possible for an American company to safeguard data. This makes data transfers to the US substantially more restricted than data transfers to any other third-party country.
- jeroenhd 5y agoIf those CDNs are hosted in countries complying with the GDPR, then they're not. If the CDNs don't, they are.
- lmkg 5y agoSadly, no. Cookiebot was fined for using Akamai CDN, even though the court accepted the CDN servers were located in the EU and operated by Akamai's EU subsidiary. The EU court ruled that the American CLOUD Act still claims to have jurisdiction.
- jeroenhd 5y agoYou're right, but that's because exchanging data with the EU subsidiary isn't accepted by the GDPR. Like I said, a GDPR-compliant CDN is permitted. The problem is that this precludes most, if not all, American CDNs.
- Silhouette 5y agoBut given that many governments now grant themselves similar legal powers to inspect data held by corporations under national security legislation, in some cases including data held abroad but by a corporation within their reach, that is roughly equivalent to saying that only CDNs operated entirely within the jurisdiction of EU member states are allowed (because the GDPR conveniently allows similar intrusive behaviour if it's an EU member state that's doing it).
- draw_down 5y agoPeople wonder why sites just throw up their hands and block Europe instead of playing the EU’s game. Actions have consequences.
- vntok 5y agoSites are perfectly allowed to do just that... of course doing that they deprive themselves of an enormous, rich and growing market, a market that will surely be tackled by regional companies more respectful of their customers.
- jokethrowaway 5y agoAs a European, I hate this. It deprives me of choice in name of a privacy I don't care about. Google is welcome to track me. The net effect is that half of the us newspapers I try to read don't allow me to even read the content. I guess I need a VPN, Europe is slowly turning into China
- draw_down 5y ago
- Lutger 5y agoIt is not silly to protect the personal information of citizens. Whats silly is how the web is entangled with violating privacy and ownership of data, and it is considered as the just and normal thing to do.
- coldcode 5y agoI wonder how the court views Apple's iCloud Relay. If every browser used such a feature (where your IP is essentially elided), then would that not solve such IP related GDPR issues? Of course Apple knows your IP address, but no third party does.
- jeroenhd 5y agoI don't see what difference Apple's pseudo-VPNs would make. I don't think it's worth the effort for websites to recognize Apple's IP addresses and to enable GDPR-violating resources by default. Apple wouldn't want that, end users wouldn't want that, and the engineers working on websites wouldn't want that. Apple might eventually sell some of their IP space and you can get hit with a lawsuit and a fine if someone reuses that IP address and your mechanism messes up. It's easier to just comply with the GDPR and self-host your files, especially with something as simple as Google Fonts.
- kelseyfrog 5y agoThis is amazing. It reads as if the EU constructing PII as property. If so, what an interesting legal construction. Site operators would do well to avoid violating the NAP.
- detaro 5y agoGDPR very explicitly does not treat personal data as property. That's generally a model being pushed by people trying to make it easier to sell personal data, not by the pro-privacy side.
- unilynx 5y agoI found this part interesting: > Google Fonts can also be used by the defendant without a connection to a Google server is established and the IP address of the website user is transmitted to Google So they're saying that because a user is allowed to self host the fonts, they should (and presumably then there is no legitimate reason anymore to 'transmit the IP address to google' ?) Would Google Fonts then be in the clear if they deny you the right to selfhost so that the only way to use it is letting users fetch them from Google?
- ceejayoz 5y agoI very much doubt it; in that case, the site in question should use another font.
- kuschku 5y agoYou could also just proxy + cache the requests.
- antsar 5y agoWhy waste bandwidth requesting the same file? I guess you could cache it “indefinitely”, but that’s functionally the same as just hosting it..
- mikojan 5y agoFor the same reason you chose to use a CDN instead of self-hosting in the first place. It takes away a lot of the complexity. I'm not proxy'ing and HTTP caching typefaces but I used to URL-import JavaScript packages from a CDN. Availability as well as response latency at times were abysmal. I didn't want to give up on the comfort though. Now I'm just routing and HTTP caching requests to cdn.my-website.com to cdn.that-popular-provider.com Availability is tied to the my-website.com's availability - which is great. And response latency went way down. And I didn't have to compromise on just dropping arbitrary JavaScript with arbitrary dependencies on the server without going through all the node and npm hassle first. It's awesome.
- tlarkworthy 5y ago
- pluc 5y ago
- FredPret 5y agoAs the operator of a US-based site (and a rookie), what is the easiest way for me to deal with this? I'm thinking: - block EU traffic on a CDN level, or perhaps setting up a geoblock in nginx - ban EU citizens in the T&C on my site I'm not targeting European customers, so no need to worry about their rules. I just don't want to break a law inadvertently and get in trouble later. EDIT: the EU has every right to legislate whatever privacy regulations they want. I just don't target EU citizens. But if an EU citizen comes to my site somehow, I'm currently breaking the law over there; I don't want this to ever happen.
- Kliment 5y agoThe easiest way is to not use google fonts.
- FredPret 5y agoBut I like google fonts. And I don't like being told by a foreign entity that I can only use certain fonts.
- vntok 5y agoThe foreign entity does not forbid you to use any font at all, in any sense of the term. You are told by an assembly of elected representatives that you must treat their 450 million citizens' data with care and respect. You are perfectly allowed to self-host the fonts, use regional providers... or event block the zone entirely.
- jokethrowaway 5y agoNow, let's make a poll and see how many of those 450mln citizens care. Nobody ever considered cookies or online data when they engaged with the indirectly democratic process which appointed those representatives. Those representatives are random politicians that can be bought by the dozen by large corporations. This is obviously another regulatory step towards guaranteeing only large companies will have the legal expertise to be on the internet, stifling competition and killing small and independent providers.
- jacquesm 5y agoAt least the court isn't fooled: Google Fonts is just another tracking device.
- tlarkworthy 5y agoI don't think it has anything to do with that. It is the transmission of an IP address to US jurisdiction. Hosting a web page on github pages would have this issue too... (?)
- tiborsaas 5y ago> Hosting a web page on github pages would have this issue too... (?) No, because users are expected to know that visiting a webpage results in their IP address revealed. In that sense it becomes impossible to provide webpages to users if they first have to consent. Google fonts is different, because if I'm ok with germanwebsite.de knowing my IP it does not mean that I'm also ok with Google knowing about it with the same action of clicking a link.
- tlarkworthy 5y agoVisiting a website by a European in Europe does not require IP address to be exposed to US soil, right?
- antsar 5y agoYes, and that’s more a commentary on GitHub Pages also being a tracking service, not disproving anything about Google Fonts. Surely Microsoft doesn’t let those access logs just sit around collecting dust.
- skilled 5y agoI wonder how much this is going to affect themes for popular CMSs. E.g. WordPress and others. A lot of the themes built for those platforms generally pull their fonts from Google Fonts. And, I know from experience that some of them don't provide the option to easily remove such a "feature". Still, I agree that this is a bit of a silly measure.
- nicbou 5y agoGiven that there is virtually no enforcement for flagrant GDPR violations... not at all.
- ratg13 5y agoDo you have any examples of this?
- nicbou 5y agoWelt.de comes to mind. Just see what you accept with "legitimate interest" tracking. This is one of the largest news publications in Germany. There are far, far more of them, but I don't see them thanks to my ad blocker. Just look at this: https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
- syntheticnature 5y ago
- tehbeard 5y agoDoesn't this mean a video embed is illegal as well? Self hosted video isn't feasible for a lot of sites... This'll be "fun".
- vntok 5y agoIn the EU, most video embeds I find now have an interstitial popup you have to click for the video to actually load.
- kmeisthax 5y agoMaybe, though the ruling mostly revolves around website subresources that are not particularly burdensome to self-host. It could be the case that replacing your iframes with an image that says "click to watch this video on YouTube" might be OK; because then it wouldn't be a subresource, and users would actually have a choice as to whether or not to watch the YouTube video and have Google be able to log that. This is something that PeerTube already does for it's embeds, because P2P is a privacy nightmare[0]. Or, the courts might demand all web video in the EU be hosted by people bound by GDPR and US subpoena-proof; and if that costs way too much then it's not their problem. That would also fatally imperil PeerTube and LBRY, as the CIA/NSA/FBI wouldn't need to subpoena Google anymore. They could just watch the video and get your data that way. [0] As many thousands of people who have gotten sued for using BitTorrent can concur.
- detaro 5y agodupe: https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264 ( 389 points, 648 comments)
- dragonwriter 5y agoWouldn’t the logic of this apply to literally 100% of all inclusions of materials from a site not owned by the site owner of the main site (including any user-submitted links in sites that host user-generated content), since those will produce a request to the external site which will then “transfer” the IP address? Did the GDPR just accidentally outlaw the entire WWW except strictly-siloed single-organization websites?
- rezonant 5y agoYep, exactly. This is actually silly. We should detect EU visitors and serve all sites in font-family: Comic Sans, Times New Roman. EDIT: Oh the burning rage from HN for this one, sheesh
- kuschku 5y agoYou can't embed material that's loaded from servers that'll strack you, correct. Which is why many German news sites hide all twitter/facebook embeds and instead show a placeholder. Only once you click "embed content from ..." on that placeholder will the actual embed be loaded. Plain links on the other hand are fine.
- rezonant 5y agoLinks to other websites aren't the problem. You cant embed material (images, scripts, fonts, video, etc) from any external site at all, because the IP address is always conveyed to that third party because that's how the Internet works. Thus you must host it yourself or not at all. This isn't just about whether you perceive the third party as a scary big tech "tracker" website or not
- nybble41 5y ago> Links to other websites aren't the problem. Just wait until they find out about link prefetching.
- kuschku 5y ago> You cant embed material (images, scripts, fonts, video, etc) from any external site at all Of course you can, as long as that other site is in EU or 14 other countries and obeys the GDPR as well.
- RcouF1uZ4gsC 5y agoRemember how when GDPR was first introduced, how everyone claimed that all this talk about how it would radically change how websites are hosted is FUD? Well it looks like GDPR has banned CDNs. Have fun paying more for bandwidth or hosting with European companies that now have less competition and can charge you more.
- ceejayoz 5y ago> Well it looks like GDPR has banned CDNs. No, the GDPR has banned third-party CDNs subject to US jurisdiction.
- jokethrowaway 5y agoBe right back, I'm going to sue every website and stop working
- ada1981 5y agoExactly, just scrape every site to see who is using Google Fonts, visit it, log it, and send them a demand letter for $$$, cite this ruling. Alternately, offer to fix the issue for $$$.
- mitjam 5y agoIf you follow this line of thought, you can eg. run your services for say a learning platform yourself than using SaaS like Thinkific. Or self-host WordPress instead of using WordPress.com - This is a huge disadvantage for business based in Europe, especially small ones. On paper any businesses with users in Europe should follow this, but in practice nobody is bothered except domestic businesses.
- ChrisArchitect 5y agoargh, this isn't some new info, this story is from the same time as the rest of them at the end of January. Didn't we talk about this somewhere already? https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264
- zvr 5y agoAlready discussed a month ago: https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264