My new blog post might of interest to anyone running websites / developing apps for people in the UK:
-
You might be interested, in particular, in the ICO's examples relating to:
* third-party hosted fonts; and
* CSS (and other technologies) which adjust a site based on a user's preferences
which, the ICO asserts, require notice and the chance to object / opt-out.
@neil
Nuts! -
@neil What the hell?
That raises a *lot* of questions.
Third party fonts - so you are OK if the fonts are on the same web site as the html? Yes? How is it being third party a factor in the decision?
Also, if I ran my site though a CSS tool to make all the styles on all the elements explicit style="" tags, which I assume is quite possible to do, is that still covered? OK some things are tricky for anything dynamic. What of just inline <style> for the css, is that OK as in the page?
@revk @neil third party fonts are a potential problem because they leak information (google knows all the websites you visit that use their fonts)
Of course, Cloudflare knows (in great detail) all the websites you visit that use them too, but I imagine they're far too lawyered up for the ICO to bother even glancing at.
-
You might be interested, in particular, in the ICO's examples relating to:
* third-party hosted fonts; and
* CSS (and other technologies) which adjust a site based on a user's preferences
which, the ICO asserts, require notice and the chance to object / opt-out.
@neil over here (Germany specifically) third-party hosted fonts have been a regular topic, a few years back a court awarded someone damages for a site using Google Fonts without informing them.
The "adjust based on user preferences" part I would have thought the intent would be something like "you can store the preference (e.g. if the user uses an option on your site to increase font size), and if doing so leads to more stuff being loaded tell them" but it isn't really clear
-
@neil sorry what
@neil like, I understand that it's often an unhelpful cliche to assume that people writing legislation that governs technology have no idea how anything actually works, but sometimes...
-
@neil over here (Germany specifically) third-party hosted fonts have been a regular topic, a few years back a court awarded someone damages for a site using Google Fonts without informing them.
The "adjust based on user preferences" part I would have thought the intent would be something like "you can store the preference (e.g. if the user uses an option on your site to increase font size), and if doing so leads to more stuff being loaded tell them" but it isn't really clear
> over here (Germany specifically) third-party hosted fonts have been a regular topic, a few years back a court awarded someone damages for a site using Google Fonts without informing them.
And indeed that case is linked from the blogpost
-
> over here (Germany specifically) third-party hosted fonts have been a regular topic, a few years back a court awarded someone damages for a site using Google Fonts without informing them.
And indeed that case is linked from the blogpost
@neil ah sorry, missed that bit
-
You might be interested, in particular, in the ICO's examples relating to:
* third-party hosted fonts; and
* CSS (and other technologies) which adjust a site based on a user's preferences
which, the ICO asserts, require notice and the chance to object / opt-out.
@neil the CSS bit took me two readings to make sure I understood. (This is not about your writing, it's just that's a wild thing to put in a law)
Funny how I recently decided I should add a dark mode option to my personal website.
-
You might be interested, in particular, in the ICO's examples relating to:
* third-party hosted fonts; and
* CSS (and other technologies) which adjust a site based on a user's preferences
which, the ICO asserts, require notice and the chance to object / opt-out.
@neil Note the CSS thing explicitly says 'Detecting preferences on the subscriber's or user's operating system' - not about your choice within your webpage; so it's saying you can't detect that the preferences for the system are dark mode/huge font/big monitor and transmit that data to you as a provider without permission.
-
@neil Note the CSS thing explicitly says 'Detecting preferences on the subscriber's or user's operating system' - not about your choice within your webpage; so it's saying you can't detect that the preferences for the system are dark mode/huge font/big monitor and transmit that data to you as a provider without permission.
@penguin42 That is one possible interpretation, but not the only one.
-
You might be interested, in particular, in the ICO's examples relating to:
* third-party hosted fonts; and
* CSS (and other technologies) which adjust a site based on a user's preferences
which, the ICO asserts, require notice and the chance to object / opt-out.
@neil Is it possible they were intending to target third party fonts loaded via JS and accidentally went too broad?
-
@penguin42 That is one possible interpretation, but not the only one.
@penguin42 I say this because "detecting" does not appear in the legislation, but the legislation covers both storage and access to information stored.
Put another way, the ICO could be a lot clear in its example
-
> Another wrinkle, CSS and especially fonts, can come from other third parties.
The blogpost expressly addresses third party fonts!
-
> Another wrinkle, CSS and especially fonts, can come from other third parties.
The blogpost expressly addresses third party fonts!
That's why I deleted.
-
@neil over here (Germany specifically) third-party hosted fonts have been a regular topic, a few years back a court awarded someone damages for a site using Google Fonts without informing them.
The "adjust based on user preferences" part I would have thought the intent would be something like "you can store the preference (e.g. if the user uses an option on your site to increase font size), and if doing so leads to more stuff being loaded tell them" but it isn't really clear
i'd guess CSS can be used to deduct uniquely fine-grained identifying aspects of one's computing environment, serving as some sort of super-cookie
-
-
-
My new blog post might of interest to anyone running websites / developing apps for people in the UK:
# An overview of the UK's updated laws on storing information in someone's terminal equipment, and accessing information stored in someone's terminal equipment
Catchy. But useful (I hope).
I must admit that - as you'll see towards the end - some of this baffles me.
An overview of the UK's updated laws on storing information in someone's terminal equipment, and accessing information stored in someone's terminal equipment
The UK’s law on storing information on someone’s terminal equipment, and accessing information stored in someone’s terminal equipment, has changed.
(decoded.legal)
@neil Just on the bit where you say "CSS based on the user’s settings... zero degree of privacy intrusion: it works solely based on a user’s choice of settings, and it happens entirely locally, on the user’s device" I'd say that's true if both the dark and light CSS has gone to the user and you're doing an @ query. But if you did, say:
<link rel="stylesheet" media="(prefers-color-scheme: dark)" href="dark.css"> then I think there's a dependent remote request. Which is different. -
@neil Just on the bit where you say "CSS based on the user’s settings... zero degree of privacy intrusion: it works solely based on a user’s choice of settings, and it happens entirely locally, on the user’s device" I'd say that's true if both the dark and light CSS has gone to the user and you're doing an @ query. But if you did, say:
<link rel="stylesheet" media="(prefers-color-scheme: dark)" href="dark.css"> then I think there's a dependent remote request. Which is different.@slowe Interesting - I have not seen it done that way before.
I agree that there is a difference there, technically.
I am still sceptical that that is really sufficient to warrant imposing a regulatory obligation and a banner, since it is just giving effect to a user's preference for dark mode?
-
@slowe Interesting - I have not seen it done that way before.
I agree that there is a difference there, technically.
I am still sceptical that that is really sufficient to warrant imposing a regulatory obligation and a banner, since it is just giving effect to a user's preference for dark mode?
@neil Yep. In fact, despite my zealousness about privacy, I think "dark mode" is something the user has choosen to "present" to the world at a system/browser level, in advance, so they've already made that decision before visiting a website. So, although I'm saying different resources get asked for, I think this is based on a choice that already happened.
-
@neil Yep. In fact, despite my zealousness about privacy, I think "dark mode" is something the user has choosen to "present" to the world at a system/browser level, in advance, so they've already made that decision before visiting a website. So, although I'm saying different resources get asked for, I think this is based on a choice that already happened.
@slowe Yes, I think that that is where I come down on this one too.
-
R relay@relay.infosec.exchange shared this topic
