gdpr privacy data-protection regulations google
Does gdpr.eu violate GDPR compliancy?
<p>As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user. If that's true, it's basically impossible to fetch any external resources on a website without asking for consent first, so not even style sheets or JavaScript libraries from CDNs. Recently, a <a href="https://www.golem.de/news/landgericht-muenchen-einbindung-von-google-fonts-ist-rechtswidrig-2202-162826.html" rel="noreferrer">German court even fined a website owner for using Google webfonts (German source: golem.de)</a>. People at my workplace where advised to host Google fonts locally because of that decision.</p>
<p>That being said, while I was reading about this regulation on <a href="https://gdpr.eu/" rel="noreferrer">https://gdpr.eu/</a>, I noticed that the site itself uses Google webfonts without asking for user consent (see screenshot).</p>
<p><a href="https://i.stack.imgur.com/S5jbL.png" rel="noreferrer"><img src="https://i.stack.imgur.com/S5jbL.png" alt="Screenshot of a web page on gdpr.eu in the Firefox browser. The opened network analysis tab shows a GET request to fonts.googleapis.com" /></a></p>
<p>What I would like to know is basically:
could gdpr.eu be in violation of the GDPR? Or am I misunderstanding the regulation? I am honestly confused. The consent form on the site also implicitly assumes consent, which I thought <a href="https://law.stackexchange.com/questions/28959/required-data-entry-seemingly-against-gdpr">was also a violation</a>. I've read some questions about the GDPR on here and information from gdpr.eu and other websites, but it's still very unclear to me what is legal and what is not.</p>
<p>I know that a EU regulation can be implemented and interpreted differently from country to country, and that a single court ruling in Germany doesn't even mean that the national law was correctly applied. From what I've read, I get the impression that this particular ruling was not unlikely to be overturned by a higher instance, if it came down to it. So my question probably both pertains to German law specifically and the EU regulation itself.</p>

<blockquote>
<p>As I understand it, the GDPR does not permit sending of personal information (which includes the IP address) without prior consent by the user.</p>
</blockquote>
<p>That's not exactly true, consent is merely one of six possible legal basis for processing (article 6). For example, processing of personal data can also be lawful if it necessary to perform a contract, legally mandatory, or in the public interest.</p>
<p>The court decision acknowledges that but rules out another basis in this case because it considers that it is possible to serve fonts without relying on a third-party (<em>[…] der Einsatz der Schriftarten auch möglich ist, ohne dass eine Verbindung von Besuchern zu externen Servern hergestellt werden muss</em>). Confusingly, it only refers to article 6(1)(f) when it seems to me that (b) would also be plausible but maybe this wasn't raised during the proceedings?</p>
<p>If the data controller cannot invoke any other basis for the lawfulness of the processing then yes, the only thing left is asking for consent, i.e. invoking article 6(1)(a). But that doesn't mean that you should expect to be asked for consent each and every time your personal information is being used.</p>
<blockquote>
<p>The consent form on the site also implicitly assumes consent, which I thought was also a violation.</p>
</blockquote>
<p>Yes, implying consent doesn't really make sense under the GDPR definition (article 4, see also article 7):</p>
<blockquote>
<p>‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action</p>
</blockquote>
<p>European data protection authorities have <a href="https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf" rel="noreferrer">issued guidelines</a> that detail what that means and clearly reject “bundling” different data processing. The regulation also makes it clear that data subjects should be able to withdraw consent at any time, which does not seem possible with the fonts on golem.de</p>
<p>My reading of all this is that assuming consent because you are using a service (or even created an account or checked a box at some point) simply isn't valid consent. Either you don't need consent at all in the first place or what you need is freely given, specific consent and “implying” consent or bundling it with a registration process achieves exactly nothing. But this is still extremely common and it might take some time before enforcement and case law definitively settle this question.</p>
<p>Smart data controllers trying to avoid collecting consent (like Meta) have abandoned any claim that signing up to the their services would constitute consent (because that's transparently not the case) and try to bypass the issue entirely using another basis like contractual necessity. This is also being litigated.</p>
<blockquote>
<p>I know that a EU regulation can be implemented and interpreted differently from country to country, and that a single court ruling in Germany doesn't even mean that the national law was correctly applied. From what I've read, I get the impression that this particular ruling was not unlikely to be overturned by a higher instance, if it came down to it. So my question probably both pertains to German law specifically and the EU regulation itself.</p>
</blockquote>
<p>That sounds more like the way EU directives work. Regulations are supposed to be immediately applicable (no implementation in national law necessary) with minimal differences between countries (except when they explicitely provide for that). Of course, enforcement would still mostly be in the hands of national court systems and (in Germany) provincial data protection authorities but there are mechanisms to ensure consistency (the European Data Protection Board, prejudicial questions to the CJEU, infringement proceedings from the European Commission…).</p>
