3 ms·

Fyi: Under GDPR you have to host these fonts yourself.

by V__ 3y ago

onethought 3y ago
is that true? Using a font is not trafficking any of the users Pii data? Google might be breaching gdpr if they are doing some crazy tracking, but I don’t see how a consumer of their fonts could be breaching. I am probably missing something.
- cjpearson 3y ago
  Using a Google font causes the client to send a request to Google servers. The Google server then receives the client's IP address. Occasionally a judge will consider that a GDPR violation. [0] Sometimes using a CDN will also be considered a GDPR violation under the same logic. [1] But it seems like it just depends on which judge you get. There are thousands of sites in Europe that use Cloudflare, Google Fonts and Shopify and only a few that have been fined because of it. [0]: https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f... [1]: https://lsww-de.translate.goog/shopify-illegal/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://lsww-de.translate.goog/shopify-illegal/?_x_tr_sl=de&...
  - V__ 3y ago
    To expand on this. One difference between CDNs and Google Fonts is, that you normally sign a contract with your CDN under GDPR. I think the English term is data processing agreement. If the CDN is above board, and you have this contract, the situation is different.
  - onethought 3y ago
    Important context: - this is ridiculous. “Leaking an ip address on the internet!?” - so isps are screwed? - it was a 100£ fine.
- deleted 3y ago
  [deleted]
brycewray 3y ago
For any who doubt you on this count: https://github.com/google/fonts/issues/1495 https://github.com/google/fonts/issues/1495 ...still apparently up in the air, more than five years after the GDPR went into effect.
- V__ 3y ago
  I have found a clarifying comment, but while the comment [1] says: > The Google Fonts Web API does not log or store IP addresses. The linked source [2] only says that they don't use IPs to create profiles or to target ads. They very well might store them. Even giving them the benefit of the doubt, they can change their mind at any time and suddenly one is in legal jeopardy. [1] https://github.com/google/fonts/issues/5463#issuecomment-1297422332 https://github.com/google/fonts/issues/5463#issuecomment-129... [2] https://developers.google.com/fonts/faq/privacy https://developers.google.com/fonts/faq/privacy

Fyi: Under GDPR you have to host these fonts yourself.

by V__ 3y ago

Fyi: Under GDPR you have to host these fonts yourself.

is that true? Using a font is not trafficking any of the users Pii data? Google might be breaching gdpr if they are doing some crazy tracking, but I don’t see how a consumer of their fonts could be breaching. I am probably missing something.

cjpearson 3y ago
Using a Google font causes the client to send a request to Google servers. The Google server then receives the client's IP address. Occasionally a judge will consider that a GDPR violation. [0] Sometimes using a CDN will also be considered a GDPR violation under the same logic. [1] But it seems like it just depends on which judge you get. There are thousands of sites in Europe that use Cloudflare, Google Fonts and Shopify and only a few that have been fined because of it. [0]: https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/ https://www.theregister.com/2022/01/31/website_fine_google_f... [1]: https://lsww-de.translate.goog/shopify-illegal/?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://lsww-de.translate.goog/shopify-illegal/?_x_tr_sl=de&...
- V__ 3y ago
  To expand on this. One difference between CDNs and Google Fonts is, that you normally sign a contract with your CDN under GDPR. I think the English term is data processing agreement. If the CDN is above board, and you have this contract, the situation is different.
- onethought 3y ago
  Important context: - this is ridiculous. “Leaking an ip address on the internet!?” - so isps are screwed? - it was a 100£ fine.
deleted 3y ago
[deleted]

brycewray 3y ago

For any who doubt you on this count: https://github.com/google/fonts/issues/1495 https://github.com/google/fonts/issues/1495 ...still apparently up in the air, more than five years after the GDPR went into effect.

V__ 3y ago
I have found a clarifying comment, but while the comment [1] says: > The Google Fonts Web API does not log or store IP addresses. The linked source [2] only says that they don't use IPs to create profiles or to target ads. They very well might store them. Even giving them the benefit of the doubt, they can change their mind at any time and suddenly one is in legal jeopardy. [1] https://github.com/google/fonts/issues/5463#issuecomment-1297422332 https://github.com/google/fonts/issues/5463#issuecomment-129... [2] https://developers.google.com/fonts/faq/privacy https://developers.google.com/fonts/faq/privacy