Re:Google's reCAPTCHA likely illegal in Europe?
by jansan on Thursday June 22, 2023 @10:05AM
(#36432382)
Apparently a German court ruled that embedding fonts from Google Fonts is not "fair" to the user. You either have to ignore parts of the GDPR or you accept to not be able to do many useful things.
Re:Google's reCAPTCHA likely illegal in Europe?
by usr1106 on Thursday June 22, 2023 @11:37AM
(#36433805)
You can do useful things without selling user data to Google.
Yes it's selling: You provied the data, Google gives you hosted services back. If you think embedded fonts are useful for you, you can host them. Then you pay the bill and not your users.
Re:Google's reCAPTCHA likely illegal in Europe?
by j16sdiz on Thursday June 22, 2023 @11:03AM
(#36433220)
> (like fraud detection or monitoring your infra)
reCAPTCHA, in this case can be consider as "fraud detection".
Can we do it without PII? Yes. Maybe. With lots of effort and less optimal result.
Does this fit the "necessary" provision of GDPR? This depends on which court you ask.
reCAPTCHA does not add "direct" value to the user, it even cost some harass... but it is a life saver if your service is big spam target.
Re:Google's reCAPTCHA likely illegal in Europe?
by account42 on Friday June 23, 2023 @08:23AM
(#36445863)
Like any US-based service (or one controlled by a US company), reCAPTCHA is subject to US laws which mean they CANNOT guarantee that your PII is only used for fraud detection purposes because the govermnet can order them at any time to hand over that data while also ordering them to keep silent about that.
All GDPR is asking mostly is: you only gather minimal PII to provide a service (if needed at all). If you use PII for another purpose than providing the service or meeting operational purposes (like fraud detection or monitoring your infra), then you must obtain the consent of the user (for marketing or selling your users data for example). This extends to your providers too (like Google Analytics...)
The problem is that a lot of "internet services" take for granted that they can do whatever they want with the data they got for a specific purpose... even without informing the user! And that's not good... so GDPR has been created.
But if your service is "fair" to the user (meaning: you only use the datas to provide the service), then there's no problem...