Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.
If I host my website behind Google Cloud CDN they have logs of the visitors IP. If I host my site on S3 they log the IP.
Does this mean that a visitor must insteract only with services that I own until I can get concent to use "unnecessary" third party services?
I think it is pretty significant if "necessary" is reduced to "could have don't it without". Because sure I could avoid Google Fonts, but now I need to do splitting and per-browser detection myself. Ok sure, browser font support is pretty consistent these days and I know my site just uses English and emoji in some pages. But now I can't throw that site in cloud storage. I also can't use a VPS because there are traffic logs. So I buy a server in a datacenter. But what if they have some form of traffic logs? I guess my question is where does this definition of "unnecessary" stop.
[0] https://www.taylorwessing.com/en/insights-and-events/insight...
People of course don't mind, reality is often like this too.
[0] https://en.wikipedia.org/wiki/Inline_linking#Controversial_u...
https://developers.google.com/fonts/faq#what_does_using_the_...
It's on the original website to prove that they only use your data for what you asked them to, if you want to do anything else, you need to request informed consent. Using hosted Google fonts is not needed to run the website (as you can also easily embed them without having the user touch Google). And Google will not say they won't do anything with that data, as they would be lying since that's the whole reason google fonts and other free webdev resources by Google exists: to gather as much data about the user it can.
The same does not apply to sideside CDNs.
However, I believe NPM CDNs are the same scenario, so I'd start serving packages from the server as well.
I guess this particular case seems somewhat reasonable, but where is the line.
Also note that Google Fonts is a lot more that just hosting a download. It has different font files for different browsers for max compatibility as well as font splitting so that you aren't downloading too many glyphs and weights that you don't need for this page. Reimplementing Google Fonts isn't trivial.
Whether it is "unnecessary" is the interesting question. For fonts, it's really hard to claim that you couldn't have created the website without Google's fonts CDN.
So perhaps the issue is whether it is necessary/sensible, just for providing a simple font, to contact Google/any cdn.
Spoiler, of course we all know it is not...
translated:
> Google fonts can be used by the defendant in a different way, so that a connection to the website does not make a connection to the Google server, thus without transmitting the IP address of the website visitor to Google.
You could rent colo, go with a friendly neighborhood hoster like uberspace or with something like Telekom Cloud (lol).
[0] https://www.taylorwessing.com/en/insights-and-events/insight...
There is a technical necessity for your hosting provider to see the user's IP.
The GDPR does not require consent for passing on private information when there is a technical or legal necessity, as well as a number of other preconditions.
It looks like the court decided SCCs were not sufficient as Cloudflare is subject to US surveillance laws so they wouldn't be able to provide adequate guarantees.
ELI5: Why does the EU not just prevent Google from using personal data they receive by law in any way they see fit? Would that not be a lot more effective than requiring the millions of small businesses and small web devs to figure it out on their end?
The EU gives companies the option and only requires all this hoopla if you want to use the data for something else than the user requested. The "problem" is that Google does want that, as they are an advertising network, so they give web developers access to their tools but tell you that you have to ask the user for consent. That everyone totally forgets those warnings and somehow forgets that Google is an advertising network is on them, just like it is your responsibility what are random dependencies you download using whatever dependency tool you use.
If Google was banking its business on Europeans continuing to click "Accept all" in privacy popups, that would be worrisome – but I doubt it's true.