5 ms·

Our startup received GDPR violation “notice”

32 points by jitbit 3y ago

rolph 3y ago
[flagged]
- Dylan16807 3y ago
  Yes, that is the start of the article?
  - rolph 3y ago
    first paragraph is actually the start, probably the title as well. semantics aside, 2nd paragraph, is telling. if you use your BS detector, it is evident the blog post is about recieving an email shakedown scam. no further click required.
    - Dylan16807 3y ago
      The fakeness is implied by the title, isn't it? If people want to read the story they'll click, if they don't then they won't. You don't need to copy it here to spite the blog.
playday 3y ago
Using Google fonts is a type of fraud since most users don’t know that you’re giving Google some of their Pii. Thankfully it’s easy to block with noscript. Too bad for people who don’t have technical knowledge or have other limitations that prevent them from protecting themselves from personal information theft.
- interroboink 3y ago
  nit: using Google CDNs is the problem, not the fonts. You can self-host the fonts without issue, AFAIK. Google even provides a guide for it: https://fonts.google.com/knowledge/using_type/self_hosting_web_fonts https://fonts.google.com/knowledge/using_type/self_hosting_w...
- deleted 3y ago
  [deleted]
ajmurmann 3y ago
Would it be a crazy move for an early-stage startup to block access from the EU till product-market fit is established and one can focus on expansion and more compliance?
- jitbit 3y ago
  I personally don't think you should. The EU authorities have stated multiple times that they won't chase small startups and mom&pop shops with this. They explicitly target big-tech with this law (can't remember where I got this from, currently looking for a proof-link in another tab... will update the comment if I find one) Currently the fines do seem to correlate with the company size. E.g. Amazon Ireland has paid 750 million, Google - 90 million... While this one-man webmasters form Germany and Austria - $50 bucks and $100 bucks
  - orwin 3y ago
    Not totally true. If you're working with public institutes (universities in my case), they will ask you to comply to the major points (and help you comply, they effectively gave us two man-day of an architect, which, for a company with 3 dev, is huge).
    - Dylan16807 3y ago
      Which part of that post are you calling "not totally true"? I don't see any conflict between what they said and what you're saying.
      - orwin 3y ago
        That startup doesn't have to care. If you're b2b and have a public entity as a client, you should care.
        Dylan16807 3y ago
        They didn't say not to care, they said not to preemptively block the EU.
gochi 3y ago
That's funny, demanding the scammer pay more after finding out their scam site uses google fonts too.
kstrauser 3y ago
> After all I'm actually in the European Union, while he's just a little peice of... (that's where I inserted a bunch of Serbian curse words that I had to google). That’s a bad look. Swap “United States” for EU there to see what I mean. If you’d said “you’re not in the EU so you don’t have legal standing here”, cool.
- kwhitefoot 3y ago
  What's especially bad about it? Swearing at someone who has just tried to commit fraud against you strikes me as perfectly reasonable. It's what swearing is for.
  - kstrauser 3y ago
    Swearing at them that they're wrong: good. Swearing at them that they don't have the same nationality: not good.
    - Dylan16807 3y ago
      It's about location, not nationality. And mostly the scammer's location, not the author's. Also I choose to swap “United States” for Bosnian, because the mental image of sending a bunch of US swear words from google is quite funny.
- arp242 3y ago
  You omitted the bit before this, which is crucial context: P.S. Oh, but you bet I replied to that Bosnian scammer. After poking around on his "europedataprotection.com" site using dev-tools, guess what I found? You got it, network requests to fonts.gstatic.com I shot back a message, letting him know HE owes ME a thousand euros. Or better yet, a million. After all I'm actually in the European Union, you little peice of... (that's where I inserted a bunch of Serbian curse words that I had to google).
brycewray 3y ago
FWIW: - https://github.com/google/fonts/issues/1495 https://github.com/google/fonts/issues/1495 - https://github.com/google/fonts/issues/5537 https://github.com/google/fonts/issues/5537
kwhitefoot 3y ago
> The tricky part is that it's not just for EU citizens, but anyone in the EU. Why is this regarded as tricky? Laws generally apply to everyone in the jurisdiction not just citizens; why should it be tricky or surprising that this is also the case for laws regulating activities on the Internet?
- twosdai 3y ago
  Correct me if I am wrong, but I believe this was meant to mean a technically more tricky problem. If it was citizens I could see a case being made that protection implementation could be based on the inputted address that is required for billing or shipping. If it's solely based on if you're physically in a country, then you need to determine in your app if the user is currently in an eu country or not. Which to me at least is more technically difficult, than just going off of a user entered address.
  - chrismcb 3y ago
    Typically things like this go off the IP address. And while it is more difficult than going off of an inputted address, it isn't that difficult. But it is also what you need to do. As an American, if I travel to Europe I'm protected by gdpr laws (and one reason why I get spamed by the "accept cookie" popups even from sites I normally visit it have a US address associated.
    - SAI_Peregrinus 3y ago
      Someone physically located in the EU using a VPN with an endpoint outside the EU is still covered by the GDPR. Just going off IP address will miss this.
ericfrazier 3y ago
That's the trick, make yourself bulletproof from lawsuits by having no money or assets and you can do as you like.
- varispeed 3y ago
  Or, conversely, just become rich and have all the money and assets you can have and do as you like. In the end any fines are so small (if you are unlucky and your legal team has a slip up), you won't even notice them.
varispeed 3y ago
> In January 2022, a German court in Munich did establish a precedent - they deemed the use of Google Fonts a GDPR violation. The website owner had shared IP addresses with Google without getting users' consent first. And because IP addresses are apparently "PII" or Personally Identifiable Information, the result was... a whopping 50 euro fine for the webmaster. As predicted. Busy bodies going after low hanging fruit and bullying small business while big corporations can basically ignore GDPR - the fines if ever comes to it is just a cost of running business.
LaundroMat 3y ago
If you're worried about GDPR or your users' privacy when using Google Fonts, someone wrote privacy-friendly drop-in replacement at https://github.com/coollabsio/fonts https://github.com/coollabsio/fonts

32 points by jitbit 3y ago

rolph 3y ago

[flagged]

Dylan16807 3y ago
Yes, that is the start of the article?
- rolph 3y ago
  first paragraph is actually the start, probably the title as well. semantics aside, 2nd paragraph, is telling. if you use your BS detector, it is evident the blog post is about recieving an email shakedown scam. no further click required.
  - Dylan16807 3y ago
    The fakeness is implied by the title, isn't it? If people want to read the story they'll click, if they don't then they won't. You don't need to copy it here to spite the blog.

playday 3y ago

Using Google fonts is a type of fraud since most users don’t know that you’re giving Google some of their Pii. Thankfully it’s easy to block with noscript. Too bad for people who don’t have technical knowledge or have other limitations that prevent them from protecting themselves from personal information theft.

interroboink 3y ago
nit: using Google CDNs is the problem, not the fonts. You can self-host the fonts without issue, AFAIK. Google even provides a guide for it: https://fonts.google.com/knowledge/using_type/self_hosting_web_fonts https://fonts.google.com/knowledge/using_type/self_hosting_w...
deleted 3y ago
[deleted]

ajmurmann 3y ago

Would it be a crazy move for an early-stage startup to block access from the EU till product-market fit is established and one can focus on expansion and more compliance?

jitbit 3y ago
I personally don't think you should. The EU authorities have stated multiple times that they won't chase small startups and mom&pop shops with this. They explicitly target big-tech with this law (can't remember where I got this from, currently looking for a proof-link in another tab... will update the comment if I find one) Currently the fines do seem to correlate with the company size. E.g. Amazon Ireland has paid 750 million, Google - 90 million... While this one-man webmasters form Germany and Austria - $50 bucks and $100 bucks
- orwin 3y ago
  Not totally true. If you're working with public institutes (universities in my case), they will ask you to comply to the major points (and help you comply, they effectively gave us two man-day of an architect, which, for a company with 3 dev, is huge).
  - Dylan16807 3y ago
    Which part of that post are you calling "not totally true"? I don't see any conflict between what they said and what you're saying.
    - orwin 3y ago
      That startup doesn't have to care. If you're b2b and have a public entity as a client, you should care.
      - Dylan16807 3y ago
        They didn't say not to care, they said not to preemptively block the EU.

gochi 3y ago

That's funny, demanding the scammer pay more after finding out their scam site uses google fonts too.

kstrauser 3y ago

> After all I'm actually in the European Union, while he's just a little peice of... (that's where I inserted a bunch of Serbian curse words that I had to google). That’s a bad look. Swap “United States” for EU there to see what I mean. If you’d said “you’re not in the EU so you don’t have legal standing here”, cool.

kwhitefoot 3y ago
What's especially bad about it? Swearing at someone who has just tried to commit fraud against you strikes me as perfectly reasonable. It's what swearing is for.
- kstrauser 3y ago
  Swearing at them that they're wrong: good. Swearing at them that they don't have the same nationality: not good.
  - Dylan16807 3y ago
    It's about location, not nationality. And mostly the scammer's location, not the author's. Also I choose to swap “United States” for Bosnian, because the mental image of sending a bunch of US swear words from google is quite funny.
arp242 3y ago
You omitted the bit before this, which is crucial context: P.S. Oh, but you bet I replied to that Bosnian scammer. After poking around on his "europedataprotection.com" site using dev-tools, guess what I found? You got it, network requests to fonts.gstatic.com I shot back a message, letting him know HE owes ME a thousand euros. Or better yet, a million. After all I'm actually in the European Union, you little peice of... (that's where I inserted a bunch of Serbian curse words that I had to google).

brycewray 3y ago

FWIW: - https://github.com/google/fonts/issues/1495 https://github.com/google/fonts/issues/1495 - https://github.com/google/fonts/issues/5537 https://github.com/google/fonts/issues/5537

kwhitefoot 3y ago

> The tricky part is that it's not just for EU citizens, but anyone in the EU. Why is this regarded as tricky? Laws generally apply to everyone in the jurisdiction not just citizens; why should it be tricky or surprising that this is also the case for laws regulating activities on the Internet?

twosdai 3y ago
Correct me if I am wrong, but I believe this was meant to mean a technically more tricky problem. If it was citizens I could see a case being made that protection implementation could be based on the inputted address that is required for billing or shipping. If it's solely based on if you're physically in a country, then you need to determine in your app if the user is currently in an eu country or not. Which to me at least is more technically difficult, than just going off of a user entered address.
- chrismcb 3y ago
  Typically things like this go off the IP address. And while it is more difficult than going off of an inputted address, it isn't that difficult. But it is also what you need to do. As an American, if I travel to Europe I'm protected by gdpr laws (and one reason why I get spamed by the "accept cookie" popups even from sites I normally visit it have a US address associated.
  - SAI_Peregrinus 3y ago
    Someone physically located in the EU using a VPN with an endpoint outside the EU is still covered by the GDPR. Just going off IP address will miss this.

ericfrazier 3y ago

That's the trick, make yourself bulletproof from lawsuits by having no money or assets and you can do as you like.

varispeed 3y ago
Or, conversely, just become rich and have all the money and assets you can have and do as you like. In the end any fines are so small (if you are unlucky and your legal team has a slip up), you won't even notice them.

varispeed 3y ago

> In January 2022, a German court in Munich did establish a precedent - they deemed the use of Google Fonts a GDPR violation. The website owner had shared IP addresses with Google without getting users' consent first. And because IP addresses are apparently "PII" or Personally Identifiable Information, the result was... a whopping 50 euro fine for the webmaster. As predicted. Busy bodies going after low hanging fruit and bullying small business while big corporations can basically ignore GDPR - the fines if ever comes to it is just a cost of running business.

LaundroMat 3y ago

If you're worried about GDPR or your users' privacy when using Google Fonts, someone wrote privacy-friendly drop-in replacement at https://github.com/coollabsio/fonts https://github.com/coollabsio/fonts