Yeah but that is really debateable. What most people do is just put really broad terms in their data protection declaration. I think there have been a couple "A

Yeah but that is really debateable. What most people do is just put really broad terms in their data protection declaration. I think there have been a couple "Abmahnungen" but this was never really tested in court, right? Personally, I think hotlinking should not be considered leaking of PII. Setting a link should not imply endorsement, and embedding an image or an iframe should not create a derived work. The website just gives instructions to the user's browser. I could change the font myself or open another window with the embedded image next to the website, it is merely a convenience. But lawmakers try to put everything in the mold of yesterdays technologies, which is why we cannot have nice things. Now, how to deal with the fact that Google does get your IP and/or can identify you with cookies? Just ban profiling. It's not so hard.