S. Jester reshared this.
Okay, so: German court decided on Jan. 20th 2022 that sites will need to host Google fonts locally.
Visitors are otherwise entitled to receive 100€ in recompensation for Google fonts transferring IP numbers to Google servers.
Google uses fonts to track users, especially if they are logged into only one other server, where stored personal data might identify them.
Court decision text in German (Landgericht München)
rewis.io/urteile/urteil/lhm-20…
#google #tracking #fonts #liability #germany #funny
LG München: 3 O 17493/20 vom 20.01.2022 | 3. Zivilkammer
Urteil des LG München vom 20.01.2022 im Volltext. Gegenstand: Unterlassungsanspruch und Schadensersatz (hier 100 €) wg. Weitergabe von IP-Adresse an Google durch Nutzung von Google Fontsrewis.io
clacke: exhausted pixie dream boy 🇸🇪🇭🇰💙💛 likes this.
reshared this
Alex Gleason
in reply to _jayrope (moving to Hubzilla) • • •clacke: exhausted pixie dream boy 🇸🇪🇭🇰💙💛
in reply to Alex Gleason • • •Bernie
in reply to _jayrope (moving to Hubzilla) • • •How exactly is Google tracking users with fonts?
I don't see any cookies on fonts.googleapis.com nor on fonts.gstatic.com.
Nanook
in reply to Bernie • • •Leonie :pb: :22breadinv: :vf:
in reply to _jayrope (moving to Hubzilla) • • •_jayrope (moving to Hubzilla)
in reply to Leonie :pb: :22breadinv: :vf: • • •Leonie :pb: :22breadinv: :vf:
Unknown parent • • •🐧DaveNull🐧 ☣️pResident Evil☣
Unknown parent • • •> another option would be just to get the visitor to agree that his IP address will be transferred, before it is.
No, that is not really "another option", you don't "get the user to" do whatever suits you.
The GDPR requires you to ask for their consent and comply with their choices. Not to « get them to accept so you can you whatever you like".
It means asking for consent without trying to influence their answers, or @jayrope - 1/3
The Ancient Good
Unknown parent • • •🐧DaveNull🐧 ☣️pResident Evil☣
Unknown parent • • •specific and *freely given*, not enforced in order to be able to use the service.
@jayrope @Porfirio - 3/3
🐧DaveNull🐧 ☣️pResident Evil☣
in reply to 🐧DaveNull🐧 ☣️pResident Evil☣ • • •blackmail them in the typical “You either accept or you can't use the site because the code is written in a way that you'll be tracked anyway, if you" manner.
If you ask for consent ONLY to avoid probably less than 5-min of "work" to put fonts locally, then you're basically giving users choice to either accept google's (or whoever) tracking or go to fuck off. That is NOT Legal. To be valid, the consent should be informed, unambiguous, @Porfirio @jayrope - 2/3
Mina
in reply to _jayrope (moving to Hubzilla) • • •never understood why people wouldn't just do that
five minutes of work, and your cookie consent looks much shorter
_jayrope (moving to Hubzilla)
in reply to Mina • • •Kuba Orlik
in reply to _jayrope (moving to Hubzilla) • • •Mina
in reply to Kuba Orlik • • •Kuba Orlik
in reply to Mina • • •The Ancient Good
in reply to Kuba Orlik • • •Kuba Orlik
in reply to Mina • • •The Ancient Good
Unknown parent • • •Kuba Orlik
Unknown parent • • •and then they know that this font is used in that particular website. What i'm wondering is how exactly does it track a user.
Don't get me wrong, I hate Google with a passion and always self-host my fonts. I've tried reporting sites for using Google Fonts and it rarely worked, I just want to know what exact angle can be used for it to trigger a fine
Tony
in reply to _jayrope (moving to Hubzilla) • • •The Ancient Good
in reply to Tony • • •or people could build sites which are just sites, not a mine field with trackers upon trackers and scripts.
Worst part is that a lot of my buddies are installing OS, then bunch of nice fonts, ricing the DE and then website is like "oh no no no, you can't use all these nice fonts you have in your system, I think you must use Arial instead, there is one on Google servers". :D
Site is just a formatted text (roughly), leave it to me decide which font I like to see it in.
@jayrope
Tony
in reply to The Ancient Good • • •not sure if characterize someone leveraging the benefits of all these tools as building a minefield. Using Google fonts because I want a consistent online appearance for my "brand" isn't a crazy concept. Leveraging the power of someone like Google's incredibly powerful CDN to make the experience smooth, not crazy.
What's wrong with disclosure and allowing the visitor to take responsibility for the decision to browse or not.
@jayrope
frankiezafe
in reply to _jayrope (moving to Hubzilla) • • •Julien Deswaef
in reply to frankiezafe • • •Olm-e ☮️
in reply to Julien Deswaef • • •this is super broad and will probably only start to roll now in courts all over EU ... (see noyb.eu )
@frankiezafe
My Privacy is None of Your Business
noyb.euJulien Deswaef
in reply to Olm-e ☮️ • • •Olm-e ☮️
in reply to Julien Deswaef • • •IP address are since long time part of personal data like your street adress etc ... (in EU at least)
@frankiezafe
Julien Deswaef
in reply to Olm-e ☮️ • • •Olm-e ☮️
in reply to Julien Deswaef • • •Julien Deswaef
in reply to Olm-e ☮️ • • •Olm-e ☮️
in reply to Julien Deswaef • • •Olm-e ☮️
in reply to Julien Deswaef • • •@frankiezafe
EUR-Lex - 62010CJ0070 - EN - EUR-Lex
eur-lex.europa.euJulien Deswaef
in reply to Olm-e ☮️ • • •Ma remarque est due au fait que les premiers à avoir poussé l'idée que l' IP permet d'identifier une personne sont bien les gestionnaires de droits.
L'EU dit que l'IP est bien PII uniquement dans certains cas particuliers. Et ces cas particuliers sont quand l'entité qui collecte l'adresse IP collecte également d'autres données sur l'utilisateur (ce qui est le cas ici de Scarlet).
Donc, une IP, en soi, n'est pas PII. Ni en Europe, ni aux US.
Olm-e ☮️
in reply to Julien Deswaef • • •heu oui enfin, c'est le principe de l'adresse, on peut relier une donnée à une personne, mais pas spécialement univoquement identifier cette personne par cette donnée ... l'IP fait donc partie des donnée personnelles, mais ne devrait pas permettre d’incriminer uniquement sur cette base par exemple (cas adopi) les "ayants droits" voudraient que si.
donc une IP, qui n'est jamais "en soi", est bien une donnée personnelle en Europe (y a eut d'autres jugements après scarlet/sabam)
@frankiezafe
Olm-e ☮️
in reply to Olm-e ☮️ • • •Julien Deswaef
in reply to Olm-e ☮️ • • •Olm-e ☮️
in reply to Julien Deswaef • • •Noch Nicht Hier
in reply to Julien Deswaef • • •This follows from GDPR Chapter 1: General provisions, Article 4: Definitions (emphasis mine):
Suppose you reply to an email, thus establishing a link between your identity and your ip address. This allows anyone who collects ip addresses from your recent and/or future browsing to attribute even more data to you.
How many of your contacts use gmail? 50%, 80%, or more? And how many sites rely on
... show moreThis follows from GDPR Chapter 1: General provisions, Article 4: Definitions (emphasis mine):
Suppose you reply to an email, thus establishing a link between your identity and your ip address. This allows anyone who collects ip addresses from your recent and/or future browsing to attribute even more data to you.
How many of your contacts use gmail? 50%, 80%, or more? And how many sites rely on Google for maps, ads, analytics, API's, fonts, or hosting? 80%, 90% or more?
This is just one example of how ip addresses fall into the identifiable category.
@Julien Deswaef @Olm-e @frankiezafe
clacke: exhausted pixie dream boy 🇸🇪🇭🇰💙💛 likes this.