Quote:A regional court in the German city of Munich has ordered a website operator to pay €100 in damages for transferring a user's personal data — i.e., IP address — to Google via the search giant's Fonts library without the individual's consent.

The unauthorized disclosure of the plaintiff's IP address by the unnamed website to Google constitutes a contravention of the user's privacy rights, the court said, adding the website operator could theoretically combine the gathered information with other third-party data to identify the "persons behind the IP address."

The violation amounts to the "plaintiff's loss of control over a personal data to Google," the ruling issued by Landgericht München's third civil chamber in Munich read.

Google Fonts is a font embedding service library from Google, allowing developers to add fonts to their Android apps and websites simply by referencing a stylesheet. As of January 2022, Google Fonts is a repository for 1,358 font families and is used by over 50.1 million websites.

(02-03-2022, 03:02 PM)Boudica Wrote: I don't know if I'm being dumb, but I don't understand how this has anything to do with fonts? Unless it's more to do with it being a third party?

(02-03-2022, 03:09 PM)Dismas Wrote:

(02-03-2022, 03:02 PM)Boudica Wrote: I don't know if I'm being dumb, but I don't understand how this has anything to do with fonts? Unless it's more to do with it being a third party?

Google's font library is used on websites. When a developer uses Google's public font library on their website, they are often embedding Google's resources. Since visitors load these resources when they visit the webpage, they are inadvertently connecting to Google (and disclosing their IP). This can be avoided by hosting fonts locally, but the larger issue is that Germany is trying to hold people responsible for embedding 3rd party resources.

(02-03-2022, 03:09 PM)Dismas Wrote: but the larger issue is that Germany is trying to hold people responsible for embedding 3rd party resources.

(02-04-2022, 08:25 AM)Boudica Wrote:

(02-03-2022, 03:09 PM)Dismas Wrote:

(02-03-2022, 03:02 PM)Boudica Wrote: I don't know if I'm being dumb, but I don't understand how this has anything to do with fonts? Unless it's more to do with it being a third party?

Google's font library is used on websites. When a developer uses Google's public font library on their website, they are often embedding Google's resources. Since visitors load these resources when they visit the webpage, they are inadvertently connecting to Google (and disclosing their IP). This can be avoided by hosting fonts locally, but the larger issue is that Germany is trying to hold people responsible for embedding 3rd party resources.

Ohhh I see. So it's just that using the third party means the third party has access to something deemed as protected information under GDPR (AKA IP). I'm following now. How can business get around this? Are they going to make users click another bloody button giving consent every time they use the site? This is a fine example of a great idea to protect people that has been executed poorly. I'm not saying I can come up with something better than GDPR, but it's clear it isn't working.

(02-04-2022, 10:43 AM)Dismas Wrote:

(02-04-2022, 08:25 AM)Boudica Wrote:

(02-03-2022, 03:09 PM)Dismas Wrote: Google's font library is used on websites. When a developer uses Google's public font library on their website, they are often embedding Google's resources. Since visitors load these resources when they visit the webpage, they are inadvertently connecting to Google (and disclosing their IP). This can be avoided by hosting fonts locally, but the larger issue is that Germany is trying to hold people responsible for embedding 3rd party resources.

Ohhh I see. So it's just that using the third party means the third party has access to something deemed as protected information under GDPR (AKA IP). I'm following now. How can business get around this? Are they going to make users click another bloody button giving consent every time they use the site? This is a fine example of a great idea to protect people that has been executed poorly. I'm not saying I can come up with something better than GDPR, but it's clear it isn't working.

The reality is that most websites do use 3rd party JavaScript or images, so pretty much any website you visit (or load resources from) can hypothetically collect your IP.