Question Google Fonts on Default Site

[Janko1000]

Server operating system version

Ubuntu 22.04.1 LTS

Plesk version and microupdate number

18.0.46

Hello All,

one of our customers received a warning from a lawyer because of the default Plesk page.
The site uses Google Fonts

Will there be a Plesk update for this or do we now have to manually remove the Google fonts on all standard pages?

 

[Maarten]

I just checked the default Plesk page when you add a new subscription, and I don't see any google font links.
What default Plesk site are you referring to? Can you post a screenshot?

 

[Kaspar]

Google Fonts website clearly states:

All fonts are released under open source licenses. You can use them in any non-commercial or commercial project.

See also: Frequently Asked Questions | Google Fonts | Google Developers

IANAL, but I would be sure to check if you're dealing with an actual lawyer and not some scammer.

 

[Bitpalast]

@Kaspar The lawyer's action is about GDPR violations of users who are using Google Fonts but are not declaring it in their privacy policy properly. That scam has been going in Austria widely for some while now and it also is an issue in the northern parts of Germany. Once again GDPR and privacy acts proof to support criminals (the lawyer in this case) and to put unreasonable burdens on normal people. It's a pity that politics don't realize that data protection at least in Austria and Germany is primarily protecting criminals and laying ground for a huge number of attacks and revenge acts (by dissatisfied customers), but have no use for what they are actually meant for.

However, the point is: When Google Fonts are used on a web page eternally, the privacy policy must include a detailed section on the external resource, because which each request Google receives at least the IP address of a surfer. That is a violation of privacy legislation. What @Janko1000 most likely means is that some "default page" of his web server or website is using Google fonts.

Plesk itself, as @maartenv has pointed out, normally should not use externally linked Google fonts, so if @Janko1000 could clarify what default page he/she means, we might understand this better.

 

[Janko1000]

Hi Maartenv,

thanks for your Reply.
Here are a Link with an Example: Domain Default page
The Site set also Cookies and connect to several other Domains without asking.

 

[Bitpalast]

@IgorG I a tagging you, because this is relevant for EU users, indeed the page is using Google Fonts, it is in the stylesheet css/style.css. I think this ought to be fixed that the fonts get stored locally. The problem is that lawyers in the EU, proven in Germany and Austria, are sending cease & desist letters to users when they let their sites connect to Google Fonts without telling the users about it.

@Janko1000 good point. I was not aware of this as we are using our own "default page", so i did not much care about the Plesk original. Maybe you can do the same as a workaround. You can edit the /var/www/vhosts/.skel/0/httpdoc content for that. Each time a new account is created, this is copied to the new account. You may also need to modify the general web server default page. I don't have the path at hand at this moment.

 

[Maarten]

The fonts seem to be imported from https://assets.plesk.com/static/default-website-content

I suggest creating your own default page:

https://support.plesk.com/hc/en-us/articles/213367389--How-to-change-the-default-content-for-newly-created-domains-in-Plesk-

or change the template directly in:

/var/www/vhosts/.skel/0/httpdocs

 

[Janko1000]

Hey all,

on our "Managed Servers" we use a own Default Site but this is a dedicated Server for our Client.
The Clients knows he is responsible for this Case but he is angry against the Lawyer and dont understand why is this Case possible with Plesk at all. God bless its "only" 850Euros.
If we now create a own Default Site for the Customers, what happend to the existing "Default Site"?

 

[Bitpalast]

If I remember correctly, currently the general advice is to first ask for an extension of the notice period to being able to check the case and second to not to pay. In the current scam case it is questionable whether this type of mass notices are legitimate.

The legal anchor for the treatment of abusive warnings or a mass warning is § 8 paragraph 4 UWG (German Unfair Competition Law): "The assertion of the claims referred to in paragraph 1 is inadmissible if it is abusive, taking into account all the circumstances, in particular if it primarily serves to create a claim for reimbursement of expenses or costs of legal action against the offender“. In the current case there is some likelihood that the lawyer is abusing UWG to make money out of the case. I suggest your client consults legal assistance as we cannot do this here for the individual case. I can only recommend that people who are targeted should not simply pay what the scammer is asking for and neither sign the cease and desist letter.

 

[IgorG]

Sorry, but I don't understand where you found Google Fonts on the default Plesk page?
As far as I know we removed Google Fonts a long time ago and don't use them. And it was done not because of European laws, but because of Chinese laws that blocked these fonts.

 

[Bitpalast]

Maybe it only affects default pages that were previously generated? I can't check this here, because we replace all these by our own when installing a new server. In the sample that @Janko1000 provides, Google Fonts are still used. Is that a newly generated page or has it been around for a long while?

 

[IgorG]

I created a test default site and tested it with 360 Monitoring according to this article. The result was no Google Fonts detected.
Apparently, @Janko1000 site has some kind of customization.

 

[korsar]

@Janko1000, @maartenv, and @Peter Debik are right - there are no google fonts on the default page in any new clean installations of Plesk Obsidian.
We've removed the Google fonts even before GDPR took effect. We removed Google Fonts links n 2018 due to blocking the links by China. So, the fonts were removed for the initial version of Plesk Obsidian.

Maybe it only affects default pages that were previously generated? I can't check this here, because we replace all these by our own when installing a new server. In the sample that @Janko1000 provides, Google Fonts are still used. Is that a newly generated page or has it been around for a long while?

This is the main reason for the fact that the Default page might have references to Google Fonts. But, unfortunately, we cannot change already existing default pages (in the general case) because people can change them.
That's why if a server owner wants to have their Default pages up2date should do it manually (we have the related KB article for that)