4 ms·

Yeah... it could be nice if people stop spreading FUD on GDPR ;-) All GDPR is asking mostly is: you only gather minimal PII to provide a service (if needed at

Yeah... it could be nice if people stop spreading FUD on GDPR ;-) All GDPR is asking mostly is: you only gather minimal PII to provide a service (if needed at all). If you use PII for another purpose than providing the service or meeting operational purposes (like fraud detection or monitoring your infra), then you must obtain the consent of the user (for marketing or selling your users data for example). This extends to your providers too (like Google Analytics...) The problem is that a lot of "internet services" take for granted that they can do whatever they want with the data they got for a specific purpose... even without informing the user! And that's not good... so GDPR has been created. But if your service is "fair" to the user (meaning: you only use the datas to provide the service), then there's no problem...

jansan 3y ago
Apparently a German court ruled that embedding fonts from Google Fonts is not "fair" to the user. You either have to ignore parts of the GDPR or you accept to not be able to do many useful things.
- usr1106 3y ago
  You can do useful things without selling user data to Google. Yes it's selling: You provied the data, Google gives you hosted services back. If you think embedded fonts are useful for you, you can host them. Then you pay the bill and not your users.
j16sdiz 3y ago
> (like fraud detection or monitoring your infra) reCAPTCHA, in this case can be consider as "fraud detection". Can we do it without PII? Yes. Maybe. With lots of effort and less optimal result. Does this fit the "necessary" provision of GDPR? This depends on which court you ask. reCAPTCHA does not add "direct" value to the user, it even cost some harass... but it is a life saver if your service is big spam target.
- account42 3y ago
  Like any US-based service (or one controlled by a US company), reCAPTCHA is subject to US laws which mean they CANNOT guarantee that your PII is only used for fraud detection purposes because the govermnet can order them at any time to hand over that data while also ordering them to keep silent about that.

jansan 3y ago

Apparently a German court ruled that embedding fonts from Google Fonts is not "fair" to the user. You either have to ignore parts of the GDPR or you accept to not be able to do many useful things.

usr1106 3y ago
You can do useful things without selling user data to Google. Yes it's selling: You provied the data, Google gives you hosted services back. If you think embedded fonts are useful for you, you can host them. Then you pay the bill and not your users.

j16sdiz 3y ago

> (like fraud detection or monitoring your infra) reCAPTCHA, in this case can be consider as "fraud detection". Can we do it without PII? Yes. Maybe. With lots of effort and less optimal result. Does this fit the "necessary" provision of GDPR? This depends on which court you ask. reCAPTCHA does not add "direct" value to the user, it even cost some harass... but it is a life saver if your service is big spam target.

account42 3y ago
Like any US-based service (or one controlled by a US company), reCAPTCHA is subject to US laws which mean they CANNOT guarantee that your PII is only used for fraud detection purposes because the govermnet can order them at any time to hand over that data while also ordering them to keep silent about that.