Hacker News Reader

Comment by account-5 | Hacker News Reader

I'm torn here. I can see it from both points of view.

As a user I don't want any of my data going to third parties at all.

As a website owner trying to provide a service to my users I want the best experience for them. This might be linking to third party services that are doing a better job than I could.

I only see this going one way. The user will have to agree to the sharing of their data with third parties if they want to view third party content, or want the fonts rendered in a better was. Link NPRs text version when you don't agree.

View on HN

What's wrong with system fonts

This is a serious question, I personally prefer to set my own font for web browsing so why do people feel the need to force fonts on me and load them from google of all places?

I agree! The problem is that most browsers have awful defaults. I'm not sure why this is but it does mean that people end up wanting to change them. However my browser uses beautiful fonts by default and if you specify just serif, sans-serif or monospace. I wish this would be the common case so that we can just respect users font settings instead of picking what we think is the best.

I write an article on this a while back: https://kevincox.ca/2021/06/23/respect-user-fonts/

Note that GDPR talks about data minimisation - data you should not share more data then necessary. If there are no other way then linking to a third party then that would be just fine. But if there is another way to do it that don't requires you to share someone else data you should do that instead (in this case self host the fonts).

Also consent may not actually help here because the principle of data minimisation applies no matter what legal basis for the processing you use.

By that logic it sounds like you must use your own servers to host the data, otherwise you are sharing the IP with a cloud provider.

Its only a problem if its a company (and/or) using servers outside of the EU.

You could absolutely make that argument. That is why this particular case is so interesting. This is the first time I've seen a ruling regarding this and it may open up for more cases on where to draw the line on when processing is "necessary" and not.

Also it's worth noting that GDPR also puts other demands in place, for example that there be technical measures to protect the data from unauthorized access, or unintentional data loss. If you can argue that a cloud provider can handle those things better, then that may trump the data minimization argument.

Reply on news.ycombinator.com