Hacker News Reader

Comment by WhyNotHugo | Hacker News Reader

It's not even clear if using Google Fonts is GDPR compliant (since you're leaking the fact that your visitor has visited your website): https://github.com/google/fonts/issues/1495

Even if you do want to use your own hand-picked font on your site, just self host it, or bundle it with something like https://fontsource.org/

They provide the tools to bundle the fonts and serve them yourself: https://fontsource.org/fonts/merriweather-sans

EDIT: The original comment mentioned "fortawesome" instead of "fontsource". I mixed up the names, my bad!

View on HN

> bundle it with something like https://fortawesome.com/

Using FA as a CDN is not GDPR compliant, either.

Generally speaking using any public CDN is not GDPR compliant. If you _could_ self host the files, then you can not meet the necessity test required for any of the relevant legal basis in GDPR art 6(1).

Google Fonts and FA are worse, because the personal data is shipped off wholesale to the USA. Neither FA or Google (for fonts) offers a data processing agreement that would make it legal to use.

You're very right, my bad. I meant to link to Fontsource:

https://fontsource.org/

They provide the tools to bundle the fonts and serve them yourself:

https://fontsource.org/fonts/merriweather-sans

Will update original comment.

It's been ruled once already that using Google Fonts is a breach of GDPR [0].

> The disclosure of the user's IP address in the above-mentioned manner and the associated encroachment on the general right of personality is so significant with regard to the loss of control over a personal data to Google, a company that is known to collect data about its users, and the individual discomfort felt by the user as a result, that a claim for damages is justified.

[0] https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/

Surely you are not processing data in this case though? The client (software) determines whether to make a connection to fonts.google.com. Your website never passed the information to google.

> Your website never passed the information to google.

Your website is malware that contains code which makes the visitor's browser connect to Google's server.

No, that's not how it works. If the website (via js or tags) requests that something is called, than your software calls it and you're responsible. The client only runs your software, in this case, HTML & co.

Though it arguably doesn't get enforced anyways, except for some big corps.

That may be technically correct, but doesn't count in front of a judge. They generally don't care for implementation details but they care for the results. And the result is that you made your visitor talk to google.

Reading the relevant court decision actually showed enough technical understanding by the judge to make a balanced decision.

The reasoning was that as it is so very easy to self host Google fonts and with caching as an argument gone there is actually not enough reason anymore to use the hosted version by Google and transmit PD to Google.

Would the site have used a foundry that didn't offer self hosting the reasoning might have turned out differently if the site owner could have made a strong argument for using this specific font by this foundry.

At least that was my reading but IANAL.

Judges do not tend to be impressed by technicalities. You're causing the information to be passed to google; the means by which that happens are largely irrelevant.

And also, if the technical line of argument were found meaningful, it could also be used for absurdities: "no, your honor, my website didn't display copyrighted images without a license – it merely gave the visitors' browsers some instructions which they happened to interpret in a way that resulted in them causing some pixels on a screen to light up in a way that somewhat resembles the copyrighted images".

Technical people often see law as a form of code, and the judge as a form of code executing computer, able to be tricked by literal interpretations.

It doesn't often really work out that way.

Indeed. And even though I consider myself a technical person through and through, I wouldn't want the law to work like that. We, as humans, are not capable of specifying society's functioning at that precision. We need the fuzziness of humans in the loop.

Neither would I. Though every now and then I wouldn't dislike to be bound to rules that I can evaluate in advance, without having to bet on what a judge's a posteriori interpretation will be.

I agree. But other times I'd also very much dislike being bound by "code" that the democratically elected lawmakers agree is buggy (buggy compared to their and the electorate's intentions).

This is one of the services lawyers who are specialized in the area can provide; they will know the case law around particular rules, etc.

Tax Law is especially interesting here, because you can basically depend on what the IRS has said but there's a chance that even if they said X, the tax court will actually rule Y (in your favor). Sometimes the risk can be worth it (if you made a good-faith effort to comply with a reasonable understanding of the law, and the court rules against you, you just have to pay the tax; even if you were found unreasonable you pay the tax + penalty which often isn't that much).

Many websites also do not provide their JS source code in readable form and state the code's license. They purposefully obfuscate it using uglifiers and then build in things talking to Google into their website. Even the usual "isogram" thingy for GA is not readable. Giving this, I definitely hold the web developer and company responsible.

Your website instructed the client to connect to Google, so yes, you are responsible for this passing data to a third party.

The user likely has no idea they contacted Google — it only happened because the code in your application executed it.

Reply on news.ycombinator.com