8

As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any external resources on a website without asking for consent first, so not even style sheets or JavaScript libraries from CDNs. Recently, a German court even fined a website owner for using Google webfonts (German source: golem.de). People at my workplace where advised to host Google fonts locally because of that decision.

That being said, while I was reading about this regulation on https://gdpr.eu/, I noticed that the site itself uses Google webfonts without asking for user consent (see screenshot).

Screenshot of a web page on gdpr.eu in the Firefox browser. The opened network analysis tab shows a GET request to fonts.googleapis.com

What I would like to know is basically: could gdpr.eu be in violation of the GDPR? Or am I misunderstanding the regulation? I am honestly confused. The consent form on the site also implicitly assumes consent, which I thought was also a violation. I've read some questions about the GDPR on here and information from gdpr.eu and other websites, but it's still very unclear to me what is legal and what is not.

I know that a EU regulation can be implemented and interpreted differently from country to country, and that a single court ruling in Germany doesn't even mean that the national law was correctly applied. From what I've read, I get the impression that this particular ruling was not unlikely to be overturned by a higher instance, if it came down to it. So my question probably both pertains to German law specifically and the EU regulation itself.

7
  • 2
    That's an interesting court decision. If it holds, it would also mean that embedding third-party content without consent is illegal. Good for all of us who do not need/want all that advertisement-clickbaiting all over the place.
    – PMF
    Jan 6, 2023 at 17:51
  • 2
    Please note that the gdpr.eu site is not official in any way. The site is more like a content marketing blog for Protonmail. I agree that it's crappy, both with regards to its technical details and its explainer articles.
    – amon
    Jan 6, 2023 at 21:14
  • 2
    “basically impossible to fetch any external resources” – that's kind of the point. There are no legal issues if the external servers are provided by a site's “data processor”, but there is a problem if the CDN is run by an independent “controller” who would be allowed to use personal data for their own purposes. Google Fonts doesn't offer a data processing agreement, so websites need a legal basis for causing browsers to send data to Google. Hosting assets locally is perfectly fine and often faster, especially since browser cache partitioning and HTTP/2 became mainstream.
    – amon
    Jan 6, 2023 at 21:18
  • 1
    I haven't commented on this aspect of the question but on top of @amon excellent observations, it also seems that GDPR.eu is basically dormant so it's not completely surprising it's not up to date on recent case law. Of course, it's not a great look for a site about the GDPR and linked to a company focused on privacy but for a random 2020 information website that doesn't seem to really do anything, the privacy policy while not perfect is not horrible. Just don't take it as a model or worry too much about what they are doing.
    – Relaxed
    Jan 6, 2023 at 21:28
  • 2
    I don't know if it matters or not, but a company sending back a page that contains a reference to a web font isn't doing anything whatsoever wrt to your data by that action. It is simply telling your browser where else the font is located. Your browser makes the connection to the 3rd party to fetch it, and whatever happens there is between you and the 3rd party.
    – user46053
    Jan 7, 2023 at 2:02

1 Answer 1

8

As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user.

That's not exactly true, consent is merely one of six possible legal basis for processing (article 6). For example, processing of personal data can also be lawful if it necessary to perform a contract, legally mandatory, or in the public interest.

The court decision acknowledges that but rules out another basis in this case because it considers that it is possible to serve fonts without relying on a third-party ([…] der Einsatz der Schriftarten auch möglich ist, ohne dass eine Verbindung von Besuchern zu externen Servern hergestellt werden muss). Confusingly, it only refers to article 6(1)(f) when it seems to me that (b) would also be plausible but maybe this wasn't raised during the proceedings?

If the data controller cannot invoke any other basis for the lawfulness of the processing then yes, the only thing left is asking for consent, i.e. invoking article 6(1)(a). But that doesn't mean that you should expect to be asked for consent each and every time your personal information is being used.

The consent form on the site also implicitly assumes consent, which I thought was also a violation.

Yes, implying consent doesn't really make sense under the GDPR definition (article 4, see also article 7):

‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action

European data protection authorities have issued guidelines that detail what that means and clearly reject “bundling” different data processing. The regulation also makes it clear that data subjects should be able to withdraw consent at any time, which does not seem possible with the fonts on golem.de

My reading of all this is that assuming consent because you are using a service (or even created an account or checked a box at some point) simply isn't valid consent. Either you don't need consent at all in the first place or what you need is freely given, specific consent and “implying” consent or bundling it with a registration process achieves exactly nothing. But this is still extremely common and it might take some time before enforcement and case law definitively settle this question.

Smart data controllers trying to avoid collecting consent (like Meta) have abandoned any claim that signing up to the their services would constitute consent (because that's transparently not the case) and try to bypass the issue entirely using another basis like contractual necessity. This is also being litigated.

I know that a EU regulation can be implemented and interpreted differently from country to country, and that a single court ruling in Germany doesn't even mean that the national law was correctly applied. From what I've read, I get the impression that this particular ruling was not unlikely to be overturned by a higher instance, if it came down to it. So my question probably both pertains to German law specifically and the EU regulation itself.

That sounds more like the way EU directives work. Regulations are supposed to be immediately applicable (no implementation in national law necessary) with minimal differences between countries (except when they explicitely provide for that). Of course, enforcement would still mostly be in the hands of national court systems and (in Germany) provincial data protection authorities but there are mechanisms to ensure consistency (the European Data Protection Board, prejudicial questions to the CJEU, infringement proceedings from the European Commission…).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .