4 ms·

Google Fonts Illegal in EU

26 points by ushakov 4y ago

pikseladam 4y ago
I couldn't understand what is illegal from the article. Is it illegal to use font as service?
- mschuster91 4y ago
  The problem is that a site loads a third-party asset without consent and Google gains information about the user's IP address and referrer as a result. And German law makes it really easy for lawyers to extort money by C&D letters.
  - bstegmaier 4y ago
    [dead]
  - ChuckNorris89 4y ago
    German laws are a holy godsend for abusive patent, copyright and IP trolls, plus the music record and film giants. GEMA and Alex Springer come to mind. Plus the bazillion scummy Bavarian law firms that act like the mafia and make a living by shaking down people who torrented an MP3. Honest question: Can't we have an unified EU set of sane IP laws that supersede the shitty ones from Germany and make them illegal? We abolished roaming charges and have a unified border across Schengen and a unified currency in the Eurozone and soon the whole consumer industry including Apple will be on USB-C. If those were possible, surely we can fix EU IP laws.
    - mschuster91 4y ago
      C&D letters are a common thing across many jurisdictions. Behave like you're supposed to and you won't get hit with them. Seriously, GDPR has been around for over four years now, everyone should have gotten the message now that sending data to third parties without consent is an absolute no-go.
      - ChuckNorris89 4y ago
        Yes, C&D letters are common everywhere, but that doesn't mean that the laws and implementation unde which they can be sent can't be flawed, leading to exploitative loopholes, as no other European jurisdiction is such a paradise for rampant abuse by any $BIG_CORP like in Germany.
        mschuster91 4y ago
        The law in question is the GDPR, universal across Europe. The thing why Germany is so much in the focus because we have a lot of privacy activists on one hand and a lot of experienced lawyers with too much time on their hands on the other.
- eesmith 4y ago
  "GDPR penalty for passing on of IP address to Google by using Google Fonts", 624 comments, 9 months ago, https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264 . Also, "Court Rules Websites Embedding Google Fonts Violates GDPR ", 97 comments, 8 months ago, https://news.ycombinator.com/item?id=30527427 https://news.ycombinator.com/item?id=30527427 . The latter links to https://thehackernews.com/2022/01/german-court-rules-websites-embedding.html https://thehackernews.com/2022/01/german-court-rules-website... which starts: > A regional court in the German city of Munich has ordered a website operator to pay €100 in damages for transferring a user's personal data — i.e., IP address — to Google via the search giant's Fonts library without the individual's consent.
- sgbeal 4y ago
  > I couldn't understand what is illegal from the article. See the link in the first sentence of the article and, if necessary, scroll down a bit to the "English Version" heading: <https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/> In short, importing a remote font exposes the user's IP to the font provider, which (that court has ruled) is a violation of the GDPR: > The disclosure of the user's IP address in the above-mentioned manner and the associated encroachment on the general right of personality is so significant with regard to the loss of control over a personal data to a company that is known to collect data about its users, and the individual discomfort felt by the user as a result, that a claim for damages is justified.
- mkmk3 4y ago
  why is eesmith being downvoted? Seems to answer and provide context for the parent
- Jyaif 4y ago
  Does that mean that CDNs like jsdelivr.com are illegal? Shouldn't the cloud be illegal too then? By hosting on AWS/GCP, you are leaking the IP addresses to the cloud providers after all!
  - mschuster91 4y ago
    > By hosting on AWS/GCP, you are leaking the IP addresses to the cloud providers after all! For hosters where the data transmission is a technical requirement, you don't need consent at all, but you need to enter a data processing agreement ("Auftragsdatenverarbeitung" in German) with the hoster and make sure that data transmission and recording is as minimal as possible (e.g. anonymize IP addresses in logs, delete logs after 2 weeks, keep data in EU cloud regions if possible).
    - herbstein 4y ago
      > keep data in EU cloud regions if possible I'm still not convinced this is enough. The US "CLOUD Act" can force employees of a company to pull data even when hosted in foreign countries. If an ops engineer technically can give themselves access they can be forced to do so by the US federal government. That is my understanding anyway.
nickdothutton 4y ago
I’m going to take a wild guess that since GDPR is mentioned, it’s somehow related to the fonts being fetched from google by the browser and leaving some tracking trace behind (without consent).
Cthulhu_ 4y ago
Not really written well, but I presume it's the fact that people download assets from Google's servers without user consent (and a ping to a Google server involves tracking and whatnot). Would it be legal if downloading the fonts off Google's servers was behind a cookie wall, along with the tracker codes and the like? The time of CDNs like that is past, in part due to them not being effective, in part due to hungry data collection schemes. Don't use CDNs, reduce or avoid 3rd party communications on your website. Legitimate tracking is fine, just don't share it with 3rd parties like google. I'm sure there's analytics options that can be installed on your own server.
rippercushions 4y ago
The linked-to judgement is in German, but it does not mention the word "Google" anywhere, so I'm pretty skeptical of the claim that it somehow renders Google Fonts "illegal". The Google Fonts FAQ pretty unambiguously states that Google does not use fonts for tracking individual users: The Google Fonts API is designed to limit the collection, storage, and use of end-user data to only what is needed to serve fonts efficiently. The use of the Google Fonts API is unauthenticated and the Google Fonts API does not set or log cookies. Requests to the Google Fonts API are made to resource-specific domains, such as fonts.googleapis.com or fonts.gstatic.com. Font requests are separate from and don't contain any credentials sent to google.com while using other Google services that are authenticated, such as Gmail. https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq#what_does_using_the_... If that's all true, I don't see how GDPR would come into play.
- number6 4y ago
  The argument goes that IPs are PII (at least for google). The data leaves the EU without consent and into an unsafe state (EU definition). For this The user must consent. Oh and promises from Google? We won't close Stadia? Also this point is moot since the transfer itself is illegal.
  - rippercushions 4y ago
    You can't make an HTTP request without exposing your IP, so isn't pulling in any resource from any site outside the EU against the GDPR then? That sounds like a bit of a stretch.
    - number6 4y ago
      In this ruling the judge argued that pulling any ressource from a company that collects and sells you data and thus exposing the IP is something that's so bad [0] that you are to be compensated for it with 100 €. And yes there are already lawyers out there who are scrapping the web to collect the money. So yes pulling anything from an Ad-Company is illegal. [0] Kontrollverlust über ein personenbezogenes Datum an ein Unternehmen, das bekanntermaßen Daten über seine Nutzer sammelt und das damit vom Nutzer empfundene individuelle Unwohlsein so erheblich, dass ein Schadensersatzanspruch gerechtfertigt ist.
BuyMyBitcoins 4y ago
Question from a non web developer: Wouldn’t it make more sense to bundle a large amount of fonts with Google Chrome itself? For instance when you install the browser and its updates you also install something like the top 100 most used web fonts on your machine. Would this be a viable thing to do?
- sgbeal 4y ago
  > Wouldn’t it make more sense to bundle a large amount of fonts with Google Chrome itself? Browser-specific features are what got the world in such a mess being tied to MSIE 6 for so long. i can't count how many times i heard "we have to use MSIE because it's the only browser which supports X" the first decade of this century. (Where "X" was normally "COM", which was frequently used in Enterprise-level web apps.) The fewer browser-specific content-side capabilities (as opposed to non-web-page capabilities) there are in browsers, the better it is for the world.
- dspillett 4y ago
  > Would this be a viable thing to do? Yes, ish. So not really. If you add them all to the OS font store then all those fonts are available to other applications (probably good) but this may be an inconvenience to a lot of users by making it hard to find the few fonts they actually do use for other work (almost certainly bad). If you don't add then to the OS font store then they only work with your browser. Also, even if you did add them to the OS font store, it still doesn't work on other browsers unless they also have yours installed. Also 100 fonts in a range of sub-styles (italic/not at least) and weights (at least bold/not) could be an extra 100Mb of stuff that you are adding to your installer and application footprint (potentially significant on small devices like non-flagship phones) which may be very rarely used (the majority of sites don't use Google Fonts). Furthermore, how do you pick the 100? Is that enough to cover enough cases to actually be useful? A site using specific fonts is likely to want something really specific and there are approaching 1,500 options on Google Fonts, so the top 100 might not cover a significant proportion of sites using the service. The point of web font loading is that a site can use what it wants without having to worry about whether it is already available on any given client device or not.
anfogoat 4y ago
I don't see what this has to do with Google Fonts, it's an aside at best. What's illegal is causing a user agent to send an HTTP request (to a third party) without the operator's consent.
- waltbosz 4y ago
  Yes, I am confused on this point as well. By this logic, it sounds like all forms of hotlinking would be illegal, not just fonts but images, js, css, etc. How does a modern website operate under this law? Are there other options besides: 1. locally hosted resources, 2. an annoying consent popup ? Tangent: I found this 2018 article about a list of websites that block visitors from GDPR countries. I wonder how many of these blocks are still in place today. I assume they were removed after the websites became GDPR compliance. https://econsultancy.com/gdpr-which-websites-are-blocking-visitors-from-the-eu-2/ https://econsultancy.com/gdpr-which-websites-are-blocking-vi...
  - anfogoat 4y ago
    > Are there other options besides: 1. locally hosted resources, 2. an annoying consent popup? As far as I understand it, the only situation where you are allowed to send a third party request without consent is one where there are no other ways to achieve whatever the request is in service of, and that whatever itself has to be something you don't need consent for ofc. Assuming I've got that right, then that's a no for images, JS and CSS.
    - spiffytech 4y ago
      Yep - and it's not whether data transmission is necessary for what you want to do; it has to be necessary for what the user wants you to do.
  - orev 4y ago
    > How does a modern website operate under this law? As someone who has seen the web evolve from basic pages to the apps of today, the way “modern websites” are currently built is absolutely horrific. Web developers don’t seem to have any qualms about pulling in random crap from random places, and those random places can pull in more crap. It makes it impossible to get a simple baseline for security without an army of people reviewing code, and the web devs just shrug and say “that’s how everyone does it now”. If these laws pour cold water on some of this and force web devs to shape up, that’s fine with me.
dspillett 4y ago
> It is remarkable that Google does not warn developers for this infringement Not that remarkable. If they do that then they are taking responsibility for informing users about legal requirements, and effectively volunteer themselves to monitor and interpret laws in all jurisdictions across the world (they do this anyway for their own legal concerns, but they won't want to accept responsibility for accurately assessing the situation for others).
jmole 4y ago
Webpages served in Germany cannot automatically download a 3rd party asset from any other website without consent from the user. Why not just build this law into the browser? Do you also need user consent before sending users to an edge cache like cloudflare?
- number6 4y ago
  > Why not just build this law into the browser? This is what cookie banners are trying to emulate. > Do you also need user consent before sending users to an edge cache like cloudflare? Don't tell them! But, yes you do, if the operator falls under jurisdiction outside of the EU.
- cdkmoose 4y ago
  So if I have a product website and I want to let you know you can buy my product from Amazon, Target, Walmart, et al, by linking to their logos, is that also illegal based on this?
  - eesmith 4y ago
    To my limited understanding, yes. But my reading of https://advertising.amazon.com/resources/ad-policy/brand-usage https://advertising.amazon.com/resources/ad-policy/brand-usa... says you can host the logo yourself. > Third-party vendors and sellers on our marketplace are permitted to display the “available at Amazon” logo in their ads to promote the availability of their products and services at Amazon. No formal review or approval is needed to use this logo.
zvr 4y ago
The whole discussed when the ruling was published, 9 months ago: https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264 389 points, 645 comments

26 points by ushakov 4y ago

pikseladam 4y ago

I couldn't understand what is illegal from the article. Is it illegal to use font as service?

mschuster91 4y ago
The problem is that a site loads a third-party asset without consent and Google gains information about the user's IP address and referrer as a result. And German law makes it really easy for lawyers to extort money by C&D letters.
- bstegmaier 4y ago
  [dead]
- ChuckNorris89 4y ago
  German laws are a holy godsend for abusive patent, copyright and IP trolls, plus the music record and film giants. GEMA and Alex Springer come to mind. Plus the bazillion scummy Bavarian law firms that act like the mafia and make a living by shaking down people who torrented an MP3. Honest question: Can't we have an unified EU set of sane IP laws that supersede the shitty ones from Germany and make them illegal? We abolished roaming charges and have a unified border across Schengen and a unified currency in the Eurozone and soon the whole consumer industry including Apple will be on USB-C. If those were possible, surely we can fix EU IP laws.
  - mschuster91 4y ago
    C&D letters are a common thing across many jurisdictions. Behave like you're supposed to and you won't get hit with them. Seriously, GDPR has been around for over four years now, everyone should have gotten the message now that sending data to third parties without consent is an absolute no-go.
    - ChuckNorris89 4y ago
      Yes, C&D letters are common everywhere, but that doesn't mean that the laws and implementation unde which they can be sent can't be flawed, leading to exploitative loopholes, as no other European jurisdiction is such a paradise for rampant abuse by any $BIG_CORP like in Germany.
      - mschuster91 4y ago
        The law in question is the GDPR, universal across Europe. The thing why Germany is so much in the focus because we have a lot of privacy activists on one hand and a lot of experienced lawyers with too much time on their hands on the other.
eesmith 4y ago
"GDPR penalty for passing on of IP address to Google by using Google Fonts", 624 comments, 9 months ago, https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264 . Also, "Court Rules Websites Embedding Google Fonts Violates GDPR ", 97 comments, 8 months ago, https://news.ycombinator.com/item?id=30527427 https://news.ycombinator.com/item?id=30527427 . The latter links to https://thehackernews.com/2022/01/german-court-rules-websites-embedding.html https://thehackernews.com/2022/01/german-court-rules-website... which starts: > A regional court in the German city of Munich has ordered a website operator to pay €100 in damages for transferring a user's personal data — i.e., IP address — to Google via the search giant's Fonts library without the individual's consent.
sgbeal 4y ago
> I couldn't understand what is illegal from the article. See the link in the first sentence of the article and, if necessary, scroll down a bit to the "English Version" heading: <https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/> In short, importing a remote font exposes the user's IP to the font provider, which (that court has ruled) is a violation of the GDPR: > The disclosure of the user's IP address in the above-mentioned manner and the associated encroachment on the general right of personality is so significant with regard to the loss of control over a personal data to a company that is known to collect data about its users, and the individual discomfort felt by the user as a result, that a claim for damages is justified.
mkmk3 4y ago
why is eesmith being downvoted? Seems to answer and provide context for the parent
Jyaif 4y ago
Does that mean that CDNs like jsdelivr.com are illegal? Shouldn't the cloud be illegal too then? By hosting on AWS/GCP, you are leaking the IP addresses to the cloud providers after all!
- mschuster91 4y ago
  > By hosting on AWS/GCP, you are leaking the IP addresses to the cloud providers after all! For hosters where the data transmission is a technical requirement, you don't need consent at all, but you need to enter a data processing agreement ("Auftragsdatenverarbeitung" in German) with the hoster and make sure that data transmission and recording is as minimal as possible (e.g. anonymize IP addresses in logs, delete logs after 2 weeks, keep data in EU cloud regions if possible).
  - herbstein 4y ago
    > keep data in EU cloud regions if possible I'm still not convinced this is enough. The US "CLOUD Act" can force employees of a company to pull data even when hosted in foreign countries. If an ops engineer technically can give themselves access they can be forced to do so by the US federal government. That is my understanding anyway.

nickdothutton 4y ago

I’m going to take a wild guess that since GDPR is mentioned, it’s somehow related to the fonts being fetched from google by the browser and leaving some tracking trace behind (without consent).

Cthulhu_ 4y ago

Not really written well, but I presume it's the fact that people download assets from Google's servers without user consent (and a ping to a Google server involves tracking and whatnot). Would it be legal if downloading the fonts off Google's servers was behind a cookie wall, along with the tracker codes and the like? The time of CDNs like that is past, in part due to them not being effective, in part due to hungry data collection schemes. Don't use CDNs, reduce or avoid 3rd party communications on your website. Legitimate tracking is fine, just don't share it with 3rd parties like google. I'm sure there's analytics options that can be installed on your own server.

rippercushions 4y ago

The linked-to judgement is in German, but it does not mention the word "Google" anywhere, so I'm pretty skeptical of the claim that it somehow renders Google Fonts "illegal". The Google Fonts FAQ pretty unambiguously states that Google does not use fonts for tracking individual users: The Google Fonts API is designed to limit the collection, storage, and use of end-user data to only what is needed to serve fonts efficiently. The use of the Google Fonts API is unauthenticated and the Google Fonts API does not set or log cookies. Requests to the Google Fonts API are made to resource-specific domains, such as fonts.googleapis.com or fonts.gstatic.com. Font requests are separate from and don't contain any credentials sent to google.com while using other Google services that are authenticated, such as Gmail. https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users https://developers.google.com/fonts/faq#what_does_using_the_... If that's all true, I don't see how GDPR would come into play.

number6 4y ago
The argument goes that IPs are PII (at least for google). The data leaves the EU without consent and into an unsafe state (EU definition). For this The user must consent. Oh and promises from Google? We won't close Stadia? Also this point is moot since the transfer itself is illegal.
- rippercushions 4y ago
  You can't make an HTTP request without exposing your IP, so isn't pulling in any resource from any site outside the EU against the GDPR then? That sounds like a bit of a stretch.
  - number6 4y ago
    In this ruling the judge argued that pulling any ressource from a company that collects and sells you data and thus exposing the IP is something that's so bad [0] that you are to be compensated for it with 100 €. And yes there are already lawyers out there who are scrapping the web to collect the money. So yes pulling anything from an Ad-Company is illegal. [0] Kontrollverlust über ein personenbezogenes Datum an ein Unternehmen, das bekanntermaßen Daten über seine Nutzer sammelt und das damit vom Nutzer empfundene individuelle Unwohlsein so erheblich, dass ein Schadensersatzanspruch gerechtfertigt ist.

BuyMyBitcoins 4y ago

Question from a non web developer: Wouldn’t it make more sense to bundle a large amount of fonts with Google Chrome itself? For instance when you install the browser and its updates you also install something like the top 100 most used web fonts on your machine. Would this be a viable thing to do?

sgbeal 4y ago
> Wouldn’t it make more sense to bundle a large amount of fonts with Google Chrome itself? Browser-specific features are what got the world in such a mess being tied to MSIE 6 for so long. i can't count how many times i heard "we have to use MSIE because it's the only browser which supports X" the first decade of this century. (Where "X" was normally "COM", which was frequently used in Enterprise-level web apps.) The fewer browser-specific content-side capabilities (as opposed to non-web-page capabilities) there are in browsers, the better it is for the world.
dspillett 4y ago
> Would this be a viable thing to do? Yes, ish. So not really. If you add them all to the OS font store then all those fonts are available to other applications (probably good) but this may be an inconvenience to a lot of users by making it hard to find the few fonts they actually do use for other work (almost certainly bad). If you don't add then to the OS font store then they only work with your browser. Also, even if you did add them to the OS font store, it still doesn't work on other browsers unless they also have yours installed. Also 100 fonts in a range of sub-styles (italic/not at least) and weights (at least bold/not) could be an extra 100Mb of stuff that you are adding to your installer and application footprint (potentially significant on small devices like non-flagship phones) which may be very rarely used (the majority of sites don't use Google Fonts). Furthermore, how do you pick the 100? Is that enough to cover enough cases to actually be useful? A site using specific fonts is likely to want something really specific and there are approaching 1,500 options on Google Fonts, so the top 100 might not cover a significant proportion of sites using the service. The point of web font loading is that a site can use what it wants without having to worry about whether it is already available on any given client device or not.

anfogoat 4y ago

I don't see what this has to do with Google Fonts, it's an aside at best. What's illegal is causing a user agent to send an HTTP request (to a third party) without the operator's consent.

waltbosz 4y ago
Yes, I am confused on this point as well. By this logic, it sounds like all forms of hotlinking would be illegal, not just fonts but images, js, css, etc. How does a modern website operate under this law? Are there other options besides: 1. locally hosted resources, 2. an annoying consent popup ? Tangent: I found this 2018 article about a list of websites that block visitors from GDPR countries. I wonder how many of these blocks are still in place today. I assume they were removed after the websites became GDPR compliance. https://econsultancy.com/gdpr-which-websites-are-blocking-visitors-from-the-eu-2/ https://econsultancy.com/gdpr-which-websites-are-blocking-vi...
- anfogoat 4y ago
  > Are there other options besides: 1. locally hosted resources, 2. an annoying consent popup? As far as I understand it, the only situation where you are allowed to send a third party request without consent is one where there are no other ways to achieve whatever the request is in service of, and that whatever itself has to be something you don't need consent for ofc. Assuming I've got that right, then that's a no for images, JS and CSS.
  - spiffytech 4y ago
    Yep - and it's not whether data transmission is necessary for what you want to do; it has to be necessary for what the user wants you to do.
- orev 4y ago
  > How does a modern website operate under this law? As someone who has seen the web evolve from basic pages to the apps of today, the way “modern websites” are currently built is absolutely horrific. Web developers don’t seem to have any qualms about pulling in random crap from random places, and those random places can pull in more crap. It makes it impossible to get a simple baseline for security without an army of people reviewing code, and the web devs just shrug and say “that’s how everyone does it now”. If these laws pour cold water on some of this and force web devs to shape up, that’s fine with me.

dspillett 4y ago

> It is remarkable that Google does not warn developers for this infringement Not that remarkable. If they do that then they are taking responsibility for informing users about legal requirements, and effectively volunteer themselves to monitor and interpret laws in all jurisdictions across the world (they do this anyway for their own legal concerns, but they won't want to accept responsibility for accurately assessing the situation for others).

jmole 4y ago

Webpages served in Germany cannot automatically download a 3rd party asset from any other website without consent from the user. Why not just build this law into the browser? Do you also need user consent before sending users to an edge cache like cloudflare?

number6 4y ago
> Why not just build this law into the browser? This is what cookie banners are trying to emulate. > Do you also need user consent before sending users to an edge cache like cloudflare? Don't tell them! But, yes you do, if the operator falls under jurisdiction outside of the EU.
cdkmoose 4y ago
So if I have a product website and I want to let you know you can buy my product from Amazon, Target, Walmart, et al, by linking to their logos, is that also illegal based on this?
- eesmith 4y ago
  To my limited understanding, yes. But my reading of https://advertising.amazon.com/resources/ad-policy/brand-usage https://advertising.amazon.com/resources/ad-policy/brand-usa... says you can host the logo yourself. > Third-party vendors and sellers on our marketplace are permitted to display the “available at Amazon” logo in their ads to promote the availability of their products and services at Amazon. No formal review or approval is needed to use this logo.

zvr 4y ago

The whole discussed when the ruling was published, 9 months ago: https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264 389 points, 645 comments