4 ms·

Currently in Germany there’s a wave of lawyers letters making the rounds. They claim a website violates the privacy of some dummy client when they accessed the

Currently in Germany there’s a wave of lawyers letters making the rounds. They claim a website violates the privacy of some dummy client when they accessed the website and their IP was transmitted to Google’s servers to download Google Fonts from the cloud. I’ve been putting in some extra hours this week to help scared clients localize their Google Fonts. The wave started after an half-assed sentence from a court in Munich back in January decided that Google Fonts server seeing a user’s IP number is a punishable privacy violation.

slyall 4y ago
I have a small website that happens to be hosted in Germany since a German company donated a server. We had to add an "Impressum" with our contact details to make sure we didn't get hit with a letter demanding money from one of the law firms that specialise in shaking down sites that are missing them.
- nicbou 4y ago
  You can just tell them to sod off. The Impressum requirement is for German commercial websites. If you are not bound by this law, you don't have to obey it.
  - iggldiggl 4y ago
    1. The legal definition of what's "commercial" under that law and what's not isn't necessarily quite as straightforward as a layman might think. (For one, that law doesn't literally say "commercial" ("gewerbsmäßig"), but rather "geschäftsmäßig" ("business-like"), which apparently can be interpreted to not require an intent to make money, but instead to include anything you plan on regularly doing). 2. Assuming you're referring to the Telemediengesetz, there's a second law (Medienstaatsvertrag) which mandates an imprint for anything that's not strictly for "personal or family purposes". Depending on who you ask, those two terms also require a rather narrow reading, so anything beyond a strictly private family diary (careful not to make references to any outside persons or businesses, though, because those entities will then have a legal interest in being able to identify you in case you malign them!) or family pictures or your private Dropbox replacement (ideally all the above should be password-protected and therefore not accessible by the general public anyway) might again already be in a grey area. 2b. Additionally, blogs can enter another grey area where depending on what and how you're blogging about, they might be classified as a journalistic service offering and therefore require an extended imprint, too.
- BrandoElFollito 4y ago
  So what could happen, in practical terms? If you are not located in Germany and do not have business there (I mean monetary business, one you can draw money from) then good luck for them trying to get something from you.
gigel82 4y ago
I mean... it is, isn't it? Google is specifically known to be using their fonts for tracking users across the web.
- treeman79 4y ago
  Never thought about that. And now my weekend plans have changed…
- subroutine 4y ago
  Source?
  - gingerlime 4y ago
    I’m not sure this is the issue precisely. However there’s been rulings that ban using Google analytics simply because doing so means the user sends a request to Google, and the user IP address is considered personal data (look up Schrems II). The same applies to Google fonts or anything hosted by Google. The interesting thing specifically about the fonts case is that, unlike other privacy regulation that defines only fines, and not compensation/damages (fines are levied by the data protection authorities). However in the font case there was a precedent that awarded damages to the claimant in the tune of 500€. Now we see a wave of ambulance chasing lawyers exploiting this ruling to shake up companies. Sad, but potentially useful for privacy. IANAL and all that jazz.
    - subroutine 4y ago
      OP said "Google is specifically known to be using their fonts for tracking users across the web." I mean... is it?
  - gigel82 4y ago
    Here's Google's 1st hit for "Google Fonts privacy", you can find more: https://www.brycewray.com/posts/2020/08/google-fonts-privacy/ https://www.brycewray.com/posts/2020/08/google-fonts-privacy...
deleted 4y ago
[deleted]
bmacho 4y ago
Just put it in your GDPR disclaimer that you send all of your users online time, location, interest, activity on the site, and unique identifiers to attach these data with other data to a foreign countries company for no actual reason; and if they don't want that they cannot do anything about it, and you are fine. Also the GDPR law is only 6 years old I think if you say you've never heard of it, you can get away with that.
- Ylpertnodi 4y ago
  >Also the GDPR law is only 6 years old I think if you say you've never heard of it, you can get away with that. "I'm sorry Officer, I didn't know I couldn't do that." https://youtu.be/FclScfPoKes?t=595 https://youtu.be/FclScfPoKes?t=595
Schroedingersat 4y ago
...good? That's what google fonts is for.
ezoe 4y ago
Just like EU cookie law, it's a really stupid judgement. It's you, your computer and your web browser who download the fonts from Google server, not the web server in Germany. All the web server do is presenting the URL to the google server. You should be responsible for the behaviour of your computer and the web browser run on top of it.

slyall 4y ago

I have a small website that happens to be hosted in Germany since a German company donated a server. We had to add an "Impressum" with our contact details to make sure we didn't get hit with a letter demanding money from one of the law firms that specialise in shaking down sites that are missing them.

nicbou 4y ago
You can just tell them to sod off. The Impressum requirement is for German commercial websites. If you are not bound by this law, you don't have to obey it.
- iggldiggl 4y ago
  1. The legal definition of what's "commercial" under that law and what's not isn't necessarily quite as straightforward as a layman might think. (For one, that law doesn't literally say "commercial" ("gewerbsmäßig"), but rather "geschäftsmäßig" ("business-like"), which apparently can be interpreted to not require an intent to make money, but instead to include anything you plan on regularly doing). 2. Assuming you're referring to the Telemediengesetz, there's a second law (Medienstaatsvertrag) which mandates an imprint for anything that's not strictly for "personal or family purposes". Depending on who you ask, those two terms also require a rather narrow reading, so anything beyond a strictly private family diary (careful not to make references to any outside persons or businesses, though, because those entities will then have a legal interest in being able to identify you in case you malign them!) or family pictures or your private Dropbox replacement (ideally all the above should be password-protected and therefore not accessible by the general public anyway) might again already be in a grey area. 2b. Additionally, blogs can enter another grey area where depending on what and how you're blogging about, they might be classified as a journalistic service offering and therefore require an extended imprint, too.
BrandoElFollito 4y ago
So what could happen, in practical terms? If you are not located in Germany and do not have business there (I mean monetary business, one you can draw money from) then good luck for them trying to get something from you.

gigel82 4y ago

I mean... it is, isn't it? Google is specifically known to be using their fonts for tracking users across the web.

treeman79 4y ago
Never thought about that. And now my weekend plans have changed…
subroutine 4y ago
Source?
- gingerlime 4y ago
  I’m not sure this is the issue precisely. However there’s been rulings that ban using Google analytics simply because doing so means the user sends a request to Google, and the user IP address is considered personal data (look up Schrems II). The same applies to Google fonts or anything hosted by Google. The interesting thing specifically about the fonts case is that, unlike other privacy regulation that defines only fines, and not compensation/damages (fines are levied by the data protection authorities). However in the font case there was a precedent that awarded damages to the claimant in the tune of 500€. Now we see a wave of ambulance chasing lawyers exploiting this ruling to shake up companies. Sad, but potentially useful for privacy. IANAL and all that jazz.
  - subroutine 4y ago
    OP said "Google is specifically known to be using their fonts for tracking users across the web." I mean... is it?
- gigel82 4y ago
  Here's Google's 1st hit for "Google Fonts privacy", you can find more: https://www.brycewray.com/posts/2020/08/google-fonts-privacy/ https://www.brycewray.com/posts/2020/08/google-fonts-privacy...

deleted 4y ago

[deleted]

bmacho 4y ago

Just put it in your GDPR disclaimer that you send all of your users online time, location, interest, activity on the site, and unique identifiers to attach these data with other data to a foreign countries company for no actual reason; and if they don't want that they cannot do anything about it, and you are fine. Also the GDPR law is only 6 years old I think if you say you've never heard of it, you can get away with that.

Ylpertnodi 4y ago
>Also the GDPR law is only 6 years old I think if you say you've never heard of it, you can get away with that. "I'm sorry Officer, I didn't know I couldn't do that." https://youtu.be/FclScfPoKes?t=595 https://youtu.be/FclScfPoKes?t=595

Schroedingersat 4y ago

...good? That's what google fonts is for.

ezoe 4y ago

Just like EU cookie law, it's a really stupid judgement. It's you, your computer and your web browser who download the fonts from Google server, not the web server in Germany. All the web server do is presenting the URL to the google server. You should be responsible for the behaviour of your computer and the web browser run on top of it.