3 ms·

I'm not saying that I agree with the current situation, but as of now it's risk for the developer to use Google Fonts. To answer your question more specifically

I'm not saying that I agree with the current situation, but as of now it's risk for the developer to use Google Fonts. To answer your question more specifically, I guess you could argue that it's a layer problem. Lower layers can't prevent "leaking" your ip with the current state of the internet, upper layers can and should.

jjulius 4y ago
>... as of now it's risk for the developer to use Google Fonts. Couldn't the developer download and host the font locally instead of calling back to Google's servers to load the font?
- teknopaul 4y ago
  Yes
- cardanome 4y ago
  Yes. The person claiming Google Fonts would be "illegal" in Germany is misinformed. It is simply considered best practice to self-host Google Fonts now and you are absolutely safe doing so. The basics of privacy law is basically don't violate the privacy of your users for no good reason. There is no technical justification to use a Google's third party service for fonts, especially as that potentially allows Google to track users. (You could still use Google's hosting if you were to get prior user consent though. Just have a fallback font. That wouldn't be worth it though.) So yes, you can use third party services and CDNs on your website but it needs to be either technically necessary or you need for user consent beforehand.
  - Jack5500 4y ago
    Just to make sure, I didn't say illegal, just unlawful. I agree with everything else you said.
    - Archelaos 4y ago
      To further contextualise the judgement: This was a trial before a medium level district court (Landgericht). So there has not yet been any landmark court decisions on this specific issue in Germany.
  - tiborsaas 4y ago
    Is caring about performance a good enough justification? Chances are most popular Google Fonts are already cached in your browser.
    - 542458 4y ago
      Cross-site caching doesn’t exist in any modern browser (IIRC each site gets it’s own separate cache) because it enables all sorts of tracking and leaks browsing history.
- zamalek 4y ago
  Shared CDNs (Google Fonts, jsdelivr, etc.) provide absolutely no advantage in modern browsers due to privacy concerns. The developer should be self-hosting the font instead of using Google's servers irrespective of German law.
542458 4y ago
Is that actually the test? That still sounds like it would make every third-party CDN (Cloudflare, Akami, etc) illegal - a CDN isn’t “necessary” and logs IP addresses all over the place. I can’t help but feel that the situation is much more complicated and nuanced than the original comment in this thread is making it sound.
- mminer237 4y ago
  No, that's actually what the law says: https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ So far, the courts have only selectively enforced it against Google, but any website which is controlled by an American entity, hosted by an American entity, or which embeds content controlled by or hosted in the US is de jure illegal under GDPR because it means an American court could theoretically get a warrant for EU citizens' IP addresses.
jhugo 4y ago
Do you have a source that backs up your interpretation of the situation? IP addresses are "leaked" (I think that's a really shitty term in this context tbh) to every single thing you communicate with, or via, on the Internet, and most of those things are operated by third parties. If "necessary" or "unavoidable" is the test, then it gets really murky — is it really necessary for your ISP to buy wholesale IP transit from another ISP when they could build out their own infra instead? It's entirely avoidable for them to peer at IXes for more economical / efficient routing — and those IXes have switches and routers operated by third parties which can see your traffic — so is it illegal for them to offload your traffic there as well?
- Jack5500 4y ago
  Hi, yes there are several sources: https://www.golem.de/news/landgericht-muenchen-einbindung-von-google-fonts-ist-rechtswidrig-2202-162826.html https://www.golem.de/news/landgericht-muenchen-einbindung-vo... https://t3n.de/news/google-fonts-illegal-urteil-dsgvo-1447698/ https://t3n.de/news/google-fonts-illegal-urteil-dsgvo-144769... https://www.derstandard.de/story/2000138472819/datenschutzanwalt-fordert-in-massenbrief-190-euro-von-websitebetreibern-fuer-google https://www.derstandard.de/story/2000138472819/datenschutzan... All these sources lead back to this verdict: https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/
deleted 4y ago
[deleted]

jjulius 4y ago

>... as of now it's risk for the developer to use Google Fonts. Couldn't the developer download and host the font locally instead of calling back to Google's servers to load the font?

teknopaul 4y ago
Yes
cardanome 4y ago
Yes. The person claiming Google Fonts would be "illegal" in Germany is misinformed. It is simply considered best practice to self-host Google Fonts now and you are absolutely safe doing so. The basics of privacy law is basically don't violate the privacy of your users for no good reason. There is no technical justification to use a Google's third party service for fonts, especially as that potentially allows Google to track users. (You could still use Google's hosting if you were to get prior user consent though. Just have a fallback font. That wouldn't be worth it though.) So yes, you can use third party services and CDNs on your website but it needs to be either technically necessary or you need for user consent beforehand.
- Jack5500 4y ago
  Just to make sure, I didn't say illegal, just unlawful. I agree with everything else you said.
  - Archelaos 4y ago
    To further contextualise the judgement: This was a trial before a medium level district court (Landgericht). So there has not yet been any landmark court decisions on this specific issue in Germany.
- tiborsaas 4y ago
  Is caring about performance a good enough justification? Chances are most popular Google Fonts are already cached in your browser.
  - 542458 4y ago
    Cross-site caching doesn’t exist in any modern browser (IIRC each site gets it’s own separate cache) because it enables all sorts of tracking and leaks browsing history.
zamalek 4y ago
Shared CDNs (Google Fonts, jsdelivr, etc.) provide absolutely no advantage in modern browsers due to privacy concerns. The developer should be self-hosting the font instead of using Google's servers irrespective of German law.

542458 4y ago

Is that actually the test? That still sounds like it would make every third-party CDN (Cloudflare, Akami, etc) illegal - a CDN isn’t “necessary” and logs IP addresses all over the place. I can’t help but feel that the situation is much more complicated and nuanced than the original comment in this thread is making it sound.

mminer237 4y ago
No, that's actually what the law says: https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ So far, the courts have only selectively enforced it against Google, but any website which is controlled by an American entity, hosted by an American entity, or which embeds content controlled by or hosted in the US is de jure illegal under GDPR because it means an American court could theoretically get a warrant for EU citizens' IP addresses.

jhugo 4y ago

Do you have a source that backs up your interpretation of the situation? IP addresses are "leaked" (I think that's a really shitty term in this context tbh) to every single thing you communicate with, or via, on the Internet, and most of those things are operated by third parties. If "necessary" or "unavoidable" is the test, then it gets really murky — is it really necessary for your ISP to buy wholesale IP transit from another ISP when they could build out their own infra instead? It's entirely avoidable for them to peer at IXes for more economical / efficient routing — and those IXes have switches and routers operated by third parties which can see your traffic — so is it illegal for them to offload your traffic there as well?

Jack5500 4y ago
Hi, yes there are several sources: https://www.golem.de/news/landgericht-muenchen-einbindung-von-google-fonts-ist-rechtswidrig-2202-162826.html https://www.golem.de/news/landgericht-muenchen-einbindung-vo... https://t3n.de/news/google-fonts-illegal-urteil-dsgvo-1447698/ https://t3n.de/news/google-fonts-illegal-urteil-dsgvo-144769... https://www.derstandard.de/story/2000138472819/datenschutzanwalt-fordert-in-massenbrief-190-euro-von-websitebetreibern-fuer-google https://www.derstandard.de/story/2000138472819/datenschutzan... All these sources lead back to this verdict: https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/

deleted 4y ago

[deleted]