Following enquiries from several customers, we have taken a closer look at the case and will discuss the technical aspects of the letter. However, this does not constitute legal advice.
The second paragraph claims: “After visiting your website, my client discovered that you had forwarded her IP address, 212.95.5.xxx, to a company belonging to the US-based “Alphabet Inc.” group ("Google") without her consent. ”
This statement is incorrect for the following reasons:
All IP addresses in the letter are dynamic and NAT IP addresses belonging to Magenta / Telering. In technical terms, this means that multiple internet connections with private IP addresses belonging to various customers share this IP address, so the IP address itself cannot be used to identify the customer.
All fonts requested from Google have a cache entry. This means that when a user visits a website that uses a particular font, it is stored on their computer (in the browser cache) for 365 days and is not downloaded again from Google's server when they visit the next website.
All requests to Google Cloud and its static resources – images, CSS, fonts, JavaScript, maps and the like – are routed via a service called Anycast-DNS to the nearest data centre. In our case, with requests originating in Austria, this is usually Frankfurt. (fra16s53-in-f3.1e100.net [142.250.185.227])
These servers are subject to the GDPR and may only pass data on to third parties with consent. According to Google, access logs are stored only in anonymised form to ensure compliance with data protection regulations when operating its services.The screenshots included in the letter merely show that Google services are embedded, along with a screenshot of the website, but do not show whether any data was actually transmitted. See points 2 and 3 regarding data disclosure.
For these reasons, the allegations are highly questionable. After analysing the log files of a hosting server containing several customers’ websites, we found that these different, unrelated hosts had been accessed within milliseconds of one another.
This behaviour, including the screenshots, is only possible through automation using web crawlers and, for example, unit testing tools from Google or Mozilla. The commands used to do this are documented on this website:
Using a headless browser to capture page screenshots
Google Chrome API documentation
The screenshots in the letter were probably taken using headless Google Chrome – a product of Google and its US parent company Alphabet Inc ...
Using Google content is a common way to speed up websites thanks to its fast servers, and should not constitute a breach of the GDPR, as the data is delivered from European servers.
Another very puzzling aspect of this letter, which smacks of large-scale phishing, is the absence of a reference number for the compensation payment. The instructions simply ask you to enter “Vergleich” (“settlement”) as the payment reference, making it impossible to link the payment unambiguously to the case in question.
These mass mailings were sent using a service provided by Österreichische Post:
Online Letter Dispatch Post.at
Further information and the latest news on this case can be found at: