6 ms·

I couldn't understand what is illegal from the article. Is it illegal to use font as service?

mschuster91 4y ago
The problem is that a site loads a third-party asset without consent and Google gains information about the user's IP address and referrer as a result. And German law makes it really easy for lawyers to extort money by C&D letters.
- bstegmaier 4y ago
  [dead]
- ChuckNorris89 4y ago
  German laws are a holy godsend for abusive patent, copyright and IP trolls, plus the music record and film giants. GEMA and Alex Springer come to mind. Plus the bazillion scummy Bavarian law firms that act like the mafia and make a living by shaking down people who torrented an MP3. Honest question: Can't we have an unified EU set of sane IP laws that supersede the shitty ones from Germany and make them illegal? We abolished roaming charges and have a unified border across Schengen and a unified currency in the Eurozone and soon the whole consumer industry including Apple will be on USB-C. If those were possible, surely we can fix EU IP laws.
  - mschuster91 4y ago
    C&D letters are a common thing across many jurisdictions. Behave like you're supposed to and you won't get hit with them. Seriously, GDPR has been around for over four years now, everyone should have gotten the message now that sending data to third parties without consent is an absolute no-go.
    - ChuckNorris89 4y ago
      Yes, C&D letters are common everywhere, but that doesn't mean that the laws and implementation unde which they can be sent can't be flawed, leading to exploitative loopholes, as no other European jurisdiction is such a paradise for rampant abuse by any $BIG_CORP like in Germany.
      - mschuster91 4y ago
        The law in question is the GDPR, universal across Europe. The thing why Germany is so much in the focus because we have a lot of privacy activists on one hand and a lot of experienced lawyers with too much time on their hands on the other.
eesmith 4y ago
"GDPR penalty for passing on of IP address to Google by using Google Fonts", 624 comments, 9 months ago, https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264 . Also, "Court Rules Websites Embedding Google Fonts Violates GDPR ", 97 comments, 8 months ago, https://news.ycombinator.com/item?id=30527427 https://news.ycombinator.com/item?id=30527427 . The latter links to https://thehackernews.com/2022/01/german-court-rules-websites-embedding.html https://thehackernews.com/2022/01/german-court-rules-website... which starts: > A regional court in the German city of Munich has ordered a website operator to pay €100 in damages for transferring a user's personal data — i.e., IP address — to Google via the search giant's Fonts library without the individual's consent.
sgbeal 4y ago
> I couldn't understand what is illegal from the article. See the link in the first sentence of the article and, if necessary, scroll down a bit to the "English Version" heading: <https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/> In short, importing a remote font exposes the user's IP to the font provider, which (that court has ruled) is a violation of the GDPR: > The disclosure of the user's IP address in the above-mentioned manner and the associated encroachment on the general right of personality is so significant with regard to the loss of control over a personal data to a company that is known to collect data about its users, and the individual discomfort felt by the user as a result, that a claim for damages is justified.
mkmk3 4y ago
why is eesmith being downvoted? Seems to answer and provide context for the parent
Jyaif 4y ago
Does that mean that CDNs like jsdelivr.com are illegal? Shouldn't the cloud be illegal too then? By hosting on AWS/GCP, you are leaking the IP addresses to the cloud providers after all!
- mschuster91 4y ago
  > By hosting on AWS/GCP, you are leaking the IP addresses to the cloud providers after all! For hosters where the data transmission is a technical requirement, you don't need consent at all, but you need to enter a data processing agreement ("Auftragsdatenverarbeitung" in German) with the hoster and make sure that data transmission and recording is as minimal as possible (e.g. anonymize IP addresses in logs, delete logs after 2 weeks, keep data in EU cloud regions if possible).
  - herbstein 4y ago
    > keep data in EU cloud regions if possible I'm still not convinced this is enough. The US "CLOUD Act" can force employees of a company to pull data even when hosted in foreign countries. If an ops engineer technically can give themselves access they can be forced to do so by the US federal government. That is my understanding anyway.

The problem is that a site loads a third-party asset without consent and Google gains information about the user's IP address and referrer as a result. And German law makes it really easy for lawyers to extort money by C&D letters.

bstegmaier 4y ago
[dead]
ChuckNorris89 4y ago
German laws are a holy godsend for abusive patent, copyright and IP trolls, plus the music record and film giants. GEMA and Alex Springer come to mind. Plus the bazillion scummy Bavarian law firms that act like the mafia and make a living by shaking down people who torrented an MP3. Honest question: Can't we have an unified EU set of sane IP laws that supersede the shitty ones from Germany and make them illegal? We abolished roaming charges and have a unified border across Schengen and a unified currency in the Eurozone and soon the whole consumer industry including Apple will be on USB-C. If those were possible, surely we can fix EU IP laws.
- mschuster91 4y ago
  C&D letters are a common thing across many jurisdictions. Behave like you're supposed to and you won't get hit with them. Seriously, GDPR has been around for over four years now, everyone should have gotten the message now that sending data to third parties without consent is an absolute no-go.
  - ChuckNorris89 4y ago
    Yes, C&D letters are common everywhere, but that doesn't mean that the laws and implementation unde which they can be sent can't be flawed, leading to exploitative loopholes, as no other European jurisdiction is such a paradise for rampant abuse by any $BIG_CORP like in Germany.
    - mschuster91 4y ago
      The law in question is the GDPR, universal across Europe. The thing why Germany is so much in the focus because we have a lot of privacy activists on one hand and a lot of experienced lawyers with too much time on their hands on the other.

eesmith 4y ago

"GDPR penalty for passing on of IP address to Google by using Google Fonts", 624 comments, 9 months ago, https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264 . Also, "Court Rules Websites Embedding Google Fonts Violates GDPR ", 97 comments, 8 months ago, https://news.ycombinator.com/item?id=30527427 https://news.ycombinator.com/item?id=30527427 . The latter links to https://thehackernews.com/2022/01/german-court-rules-websites-embedding.html https://thehackernews.com/2022/01/german-court-rules-website... which starts: > A regional court in the German city of Munich has ordered a website operator to pay €100 in damages for transferring a user's personal data — i.e., IP address — to Google via the search giant's Fonts library without the individual's consent.

sgbeal 4y ago

> I couldn't understand what is illegal from the article. See the link in the first sentence of the article and, if necessary, scroll down a bit to the "English Version" heading: <https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/> In short, importing a remote font exposes the user's IP to the font provider, which (that court has ruled) is a violation of the GDPR: > The disclosure of the user's IP address in the above-mentioned manner and the associated encroachment on the general right of personality is so significant with regard to the loss of control over a personal data to a company that is known to collect data about its users, and the individual discomfort felt by the user as a result, that a claim for damages is justified.

mkmk3 4y ago

why is eesmith being downvoted? Seems to answer and provide context for the parent

Jyaif 4y ago

Does that mean that CDNs like jsdelivr.com are illegal? Shouldn't the cloud be illegal too then? By hosting on AWS/GCP, you are leaking the IP addresses to the cloud providers after all!

mschuster91 4y ago
> By hosting on AWS/GCP, you are leaking the IP addresses to the cloud providers after all! For hosters where the data transmission is a technical requirement, you don't need consent at all, but you need to enter a data processing agreement ("Auftragsdatenverarbeitung" in German) with the hoster and make sure that data transmission and recording is as minimal as possible (e.g. anonymize IP addresses in logs, delete logs after 2 weeks, keep data in EU cloud regions if possible).
- herbstein 4y ago
  > keep data in EU cloud regions if possible I'm still not convinced this is enough. The US "CLOUD Act" can force employees of a company to pull data even when hosted in foreign countries. If an ops engineer technically can give themselves access they can be forced to do so by the US federal government. That is my understanding anyway.