Privacy Statement Updates September 2022

[olholder]

GitHub is introducing non-essential cookies on web pages that market our products to businesses. These cookies will provide analytics to improve the site experience and personalize content and ads for enterprise users. This change is only on subdomains, like resources.github.com, where GitHub markets products and services to enterprise customers. Github.com will continue to operate as-is.

This change updates the Privacy Statement based on this new activity.

These updates will go into effect after the 30-day notice and comment period, on September 1, 2022.

[rick]

Is the change from "Personal Data" to "personal data" a stylistic change?

I note that the paragraph above is still intact:

All capitalized terms have their definition in GitHub’s Terms of Service, unless otherwise noted here.

Presuming this capitalization change is unintentional, it has the unfortunate effect of decoupling "Personal Data" from the definition provided in the GitHub Terms of Service, which means that "personal data" is no longer as delineated there, but could well be anything.

If this is an intentional change, it would seem better made as a visible change to the Terms of Service. If the intent is not to change the Terms of Service but to arbitrarily expand "personal data" without drawing attention, well, that seems evil.

[rick]

Looking into this further -- it looks like "Personal Data" is defined these days in the GitHub Data Protection Agreement. Perhaps this was being decapitalized since it is not directly defined (afaict) in the GitHub Terms of Service?

[afkvido]

Oh bet

[Consolatis]

Let me prefix this by stating that I am a complete layman.

Previously: *GitHub* responds to browser DNT signals and follows the W3C spec.
Now: Some random services, somewhere in the world, hosted by GitHub or somebody else *may* respond to browser DNT signals and follow the W3C spec.

Doesn't this change invalidate the whole paragraph and turns it into a generic wiki article?

[MrBartusek]

Dunno, they will stop respecting DNT but leave this paragraph and make it seem as if they do. This is just confusing.

[Consolatis]

"Confusing" is one way to put it.

Edit:
@zzo38 articulated my personal opinion better than I could so I'll quote part of their comment here:

I also think that they should avoid using confusing privacy policies; the mention of DNT should either be kept as is if GitHub uses the DNT header to reduce tracking, or deleted entirely if GitHub does not use the DNT header. If it does so only in some cases, it should mention what cases these are. The privacy policy made sense before the change in the section about DNT, although the change mentioned above makes it confusing (as other comments already mention).

[..]

I have no problem with adding these non-essential cookies to the enterprise marketing pages, as long as the rest of GitHub can be used without it and it is documented which pages these are (and if the cookie domain is the same, also which cookies). Moving the enterprise marketing pages to a separate domain seems to me to be a good idea though, in order to be clearly distinguished (although a subdomain is probably good enough, in my opinion; as long as it is documented clearly which subdomains these are).

Emphasis are mine.
In my opinion, documented should mean being very specific and being part of a legally binding document like the privacy policy.

An example for not being specific is this part of the changes:

As described below, we may use non-essential cookies on certain pages of our website

[al1103]

:))

[jdgregson]

You lost me at ads for enterprise users.

[leoheck]

Github is being undermined by Microsoft.

[TechSolomon]

🍪 https://github.blog/2020-12-17-no-cookie-for-you/

[TheMaverickProgrammer]

so what github alternative is everyone using these days? asking for a friend.

[ocdtrekkie]

"We are also committing that going forward, we will only use cookies that are required for us to serve GitHub.com."

Apparently in corporate terms, a "commitment" is now less than two calendar years of obligation. Good to know. Though, I guess I don't visit the marketing pages and hence, don't really care that much? Corporations being untrustworthy isn't new territory.

Literally just "business advice": Your marketing teams should be weighing the value of the data here against the cost of "yet another breach of user trust and commitment", user trust, of course, being something extremely hard to earn back.

[karlshea]

Marketing people don't care about user trust or commitments. They'll just burn things to the ground and move on to the next corp job, each time making the world a slightly worse place.

[afkvido]

This clearly shows that GitHub cares more about revenue than the user base behind it.

Microsoft fucking sucks, GitHub wasn't evil until Microsoft really started to abuse GitHub.

[afkvido]

so what github alternative is everyone using these days? asking for a friend.

@TheMaverickProgrammer GitLab probbably.

[afkvido]

Requesting a change: Don't add this.

[RoyTinker]

I understand that cookies are helpful for analytics and gathering sales funnel data. It's always sad when companies don't keep prior promises, though 😟

If you must break the promise, here's my suggestion, for what it's worth: move enterprise marketing pages (maybe even all marketing pages besides the front page?) off of github.com onto a separate domain. Maybe github.info?

Then point marketing links from the front page to that domain.

This will allow folks to deal with that domain separately from github.com.

[tylt6688]

I personally feel that the enterprise version can be made independently.

[jacamera]

As a happy GitHub user I just hope all this recreational outrage doesn't result in GitHub allocating more time or resources than would otherwise be required to complete this change. Full speed ahead!

[afkvido]

As a happy GitHub user I just hope all this recreational outrage doesn't result in GitHub allocating more time or resources than would otherwise be required to complete this change. Full speed ahead!

I'd want GitHub to remove Microsoft, then continue full speed ahead

[evelynmarie]

This change is only on subdomains where GitHub markets products and services to enterprise customers, and all other GitHub subdomains will continue to operate as-is.

Why are people getting so riled up when this change only impacts the Enterprise marketing subdomains? Makes no sense to me how this of all things is getting negative attention. Majority of people don't use GitHub Enterprise, as its only for businesses, And they're just cookies. Use uBlock Origin as it says if you really can't stand a few cookies on subdomains you'll probably never end up going to.

Also, people love pointing the finger at Microsoft, as if this change was demanded by them. It more than likely wasn't. There are always going to be changes that people don't like, but not all changes are influenced by the parent company. If Microsoft was puttng their hands all over GitHub, they probably would've moved GitHub to the Microsoft Policy Statement a long time ago.

[afkvido]

Cuz GitHub said they wouldnt use cookies
daym its a borken promise

[evelynmarie]

"We are also committing that going forward, we will only use cookies that are required for us to serve GitHub.com."

Apparently in corporate terms, a "commitment" is now less than two calendar years of obligation. Good to know. Though, I guess I don't visit the marketing pages and hence, don't really care that much? Corporations being untrustworthy isn't new territory.

Literally just "business advice": Your marketing teams should be weighing the value of the data here against the cost of "yet another breach of user trust and commitment", user trust, of course, being something extremely hard to earn back.

How exactly does this in any way impact user trust? It doesn't impact the main site, like the dashboard, the landing page, or any other part of GitHub like profiles, repositories, or organizations. It literally only impacts the enterprise marketing pages, and its for sales data tracking & analytics. GitHub Enterprise is a very business-oriented product, so the only visitors to those pages will be by business leaders potentially interested in GitHub Enterprise, or users who land on that page by mistake.

And I believe that is what GitHub meant when they said "to serve GitHub.com" - the main site (dashboard, repos, profiles, etc), not including stuff related to their Enterprise product, so I genuinely don't believe they broke their commitment. People are overreacting, as usual, to insignificant changes that don't really impact them.

[afkvido]

Thats fine but fuck microsoft for existing

[afkvido]

There's a reason this PR has 128+ negative reactions 👎

[afkvido]

Also, they have, take a look at this PR.

[evelynmarie]

@afkvido: Also, they have, take a look at this PR.

This was more than likely not Microsoft's doing. Not everything a subsidiary of Microsoft does is because of Microsoft itself. You have the vast majority of comments on this PR (at 8 comments), and your opinion isn't be all end all. Most of the negative reactions are additionally probably from people who don't understand the scope of what GitHub said back when they committed to not use cookies not necessary to serve GitHub itself - they probably didn't extend it to the Enterprise marketing pages to begin with and always meant the main site that serves repositories and profiles and such.

There are things worse than cookies by the way, like actual trackers embedded in web pages. Cookies are relatively harmless if used sparingly and for very specific purposes like tracking sales analytics or for keeping a user logged into their web browsers, or in a specific GitHub use case, tracking the current site theme. There is nothing wrong with stuff like this.

You seem awfully mad at Microsoft for some reason, as if they stole your pet dog or something. This isn't 2000s & early 2010s-era Microsoft, Microsoft is nowhere near as bad as they were when Steve Ballmer was the CEO of Microsoft. Ever since Satya became CEO, I have noticed a significant improvement in Microsoft's business culture and strategy. MS was way, way, way worse back when Ballmer was CEO.

(also, slight question, why upvote your own comments?)

[afkvido]

This was more than likely not Microsoft's doing. Not everything a subsidiary of Microsoft does is because of Microsoft itself.

I don't know why anyone at GitHub would do this change, and Microsoft is the only other entity with the authority to make such a change.

You have the vast majority of comments on this PR (at 8 comments), and your opinion isn't be all end all.

I just poke in whenever this comes up on my GitHub notifications.

Most of the negative reactions are additionally probably from people who don't understand the scope of what GitHub said back when they committed to not use cookies not necessary to serve GitHub itself - they probably didn't extend it to the Enterprise marketing pages to begin with and always meant the main site that serves repositories and profiles and such.

That is a good point, however, that doesn't change the fact that GitHub is no longer the white and fluffy angel that it was.

There are things worse than cookies by the way, like actual trackers embedded in web pages. Cookies are relatively harmless if used sparingly and for very specific purposes like tracking sales analytics or for keeping a user logged into their web browsers, or in a specific GitHub use case, tracking the current site theme. There is nothing wrong with stuff like this.

While you seem quite intelligent, I don't think that you understand that cookies could actually be used as slight trackers, and if used to their fullest potential, complete on-site tracking for AI/ML based targeted recommendations for profit.

You seem awfully mad at Microsoft for some reason, as if they stole your pet dog or something. This isn't 2000s & early 2010s-era Microsoft, Microsoft is nowhere near as bad as they were when Steve Ballmer was the CEO of Microsoft. Ever since Satya became CEO, I have noticed a significant improvement in Microsoft's business culture and strategy. MS was way, way, way worse back when Ballmer was CEO.

Microsoft is still a mega-corp. They're still 'evil', just like Google or Apple. I also don't see much of a difference with the two CEOs. One was making more money, one was discussing ethics more often, but in the end, Microsoft is still somewhat invasive. To add on, Microsoft decided to absolutely RUIN Minecraft, a game that I don't really play these days, but my friends play a lot.

(also, slight question, why upvote your own comments?)

(also, slight question, why downvote my comments?)

[zzo38]

I think that the cookies ought to be documented, so that you know which cookie means what.

I also think that they should avoid using confusing privacy policies; the mention of DNT should either be kept as is if GitHub uses the DNT header to reduce tracking, or deleted entirely if GitHub does not use the DNT header. If it does so only in some cases, it should mention what cases these are. The privacy policy made sense before the change in the section about DNT, although the change mentioned above makes it confusing (as other comments already mention).

Mentioning other programs such as Privacy Badger and uBlock Origin are OK, although it might be worth to add a disclaimer if GitHub is not affiliated with such programs, even if they are hosted on GitHub. (Since GitHub is used for many FOSS projects, it is likely that some of them will be.)

I have no problem with adding these non-essential cookies to the enterprise marketing pages, as long as the rest of GitHub can be used without it and it is documented which pages these are (and if the cookie domain is the same, also which cookies). Moving the enterprise marketing pages to a separate domain seems to me to be a good idea though, in order to be clearly distinguished (although a subdomain is probably good enough, in my opinion; as long as it is documented clearly which subdomains these are).

About alternatives to GitHub, I would not recommend GitLab because it will not display the files if JavaScripts are not enabled. However, it is acceptable to use GitLab if there are mirrors on multiple services. GitHub, Codeberg, and NotABug, and some others, also use JavaScripts, although the files can be displayed even if JavaScripts are disabled (even though there is a note that says enable JavaScripts, it is not required to simply view files), so it is acceptable. Another alternative is Sourcehut, which also doesn't need JavaScripts (and says that all features work without JavaScripts, although it still has some).

[afkvido]

I don't mind GitLab, except that I have to pause for 15 minutes to finish laughing every time i see "Merge Requests"

[sammcj]

What happened to this policy https://github.blog/2020-12-17-no-cookie-for-you/ ?

I guess it's a bit like Microsoft ❤️ Linux....

[pablodz]

Wtf

[pivic]

Please refer from surveillance capitalism.

[hagemt]

I do appreciate the opportunity to comment on this. I know some parties (not calling out anyone particular in this thread) are upset by this change, to put it mildly. Count me among their number. I do not think these changes are a move in the positive direction. Please continue to support the DNT standard, and endeavour to instill its importance when acting in partnership with other businesses.

As we are all parties who interact with Microsoft, I find this expansion of tracking cookies another reason to weaken my personal relationship with the platform, as well as a reason to second guess business dealings with Microsoft and its subsidiaries. I am certainly NOT the only developer who feels this way. While GitHub offers a good product for many, be aware that any de facto position of market leader is beholden to a market that is very willing to vote with its feet.

edits: correcting typos, its vs. it's (written from a phone)

[gruselhaus]

We need 💯 as a reaction option

[devtooligan]

I oppose this. Please don't merge this change.

[csnyder616]

I'm sure various teams within GitHub (marketing, UX, product development, data analytics...) have been clamoring for this change for some time. However, they've almost certainly set expectations too high for how much value you'll get from this data, especially given the loss of trust with your customer base. Please reconsider this.

[thany]

Let me just tighten my content blocker.

Github already has SOOO MUCH information. Why the fluff does it need more? How can you STILL be hungry for more data? The tracking glutony must stop!

[Mindgamesnl]

As if github didn’t walk the line enough with copilot and the used training data.
@ashtom, Is this your call?

What the fuck

[ThomasFrans]

Time to completely move to GitLab.

[torstenvl]

This is a poorly-considered change. If you want analytics cookies, I understand that, but deliberately ignoring DNT is beyond the pale.

[bnb]

Wildly disappointed in this shift. The developer goodwill you will burn from making this change is not worth the marginal potential pipeline increase.

This reflects extremely poorly both on GitHub and on Microsoft as the stewards of this platform.

[bermannoah]

As someone who uses both github dot com and github enterprise on a daily basis for work, I do not appreciate being tracked across one set of offerings -- what more could you possibly want to know about us? What data do you not get by knowing everything we do on the platform, our codebase, the way we use CI/CD, and so on? If you want to have a site for people who don't use the product but you want tracking details from them, why not make a separate domain entirely for marketing purposes and send that around? How are we supposed to trust any of Github's other commitments if they won't even stick to no cookies?

[Studio384]

GitHub ain't evil, yknow, It's Microsoft that's a fuckin dawg

This policy was introduced under Microsoft in the first place.

[gruselhaus]

"and other marketing efforts." 🤨

[jmillerv]

Should this merge go through, I'll be pulling my personal projects and ending my GitHub subscription.

[EtchedPixels]

I think your lawyers need to look at the EU rules a bit more carefully before ignoring DNT, and also fix your EU/US data sharing in light of the legal rulings over adequacy

[mbifulco]

(Interrupting my beach vacation OOO for this one... 🏝)

Happy GitHub user here - I've used it for many projects with many organizations (from bootstrapped startup to enterprise orgs), OSS teams, and personal projects.

IMO, this is a bad move.

GitHub has the power and potential to get the attention of virtually every enterprise business around the world - by way of delivering great, meaningful and impactful products.

You've brought many things to market that are improve team workflows, save orgs money, and make delivering great software incrementally easier. Tools like codespaces and copilot, Kanban boards for issue tracking and Actions for automation can make all of our lives easier. We see these things and we pay attention. Every dev team in the world knows what GitHub can deliver on.

We also see when GitHub makes decisions that endanger people, erode trust, and work against the presumptive goals of OSS and an open internet. These things hurt GitHub more than they help, despite the short term gains which may seem appealing during Annual and Quarterly planning.

This choice seems like one of those decisions.

The long term effect of adopting non-essential cookies is to serve what must feel like an easy short term win is a net negative for GitHub and its users, especially after a very public recent announcement that GitHub would be doing exactly the opposite of this from [then] on.

Please consider rejecting this proposal, and not approving the use of any non-essential tracking. The dev community and your enterprise customers will appreciate you for it that much more.

[9999years]

This is a really poor change. Sad to see GitHub so obviously prioritizing profits over its users.

[afkvido]

https://www.change.org/GitHubCookies

STOP THE COOKIES

[jdsimcoe]

This is a poor direction. Please reverse this GitHub.

[aldenjenkins]

I thoroughly disagree with the proposed changes.

Relevant: https://github.blog/2020-12-17-no-cookie-for-you/

[ricobeck]

Please revert this poor decision!

[RamiAwar]

Why can't we just block cookies from Github?

[ryanvade]

If GitHub proceeds with this change then where will the data go?

[ShadeAJ1]

😡

[sethmlarson]

Hey, I'm an extremely heavy user, advocate, and enjoyer of GitHub. 👋

Totally understand the desire to use cookies for marketing purposes. It's clear you're trying to keep the boundaries where non-essential cookies are only used for enterprise pages. I appreciate this approach.

Two suggestions that would make me less worried that these changes would one day spill over into the critical open source software infrastructure side of GitHub that so many of us care about and depend on:

• Before (or worse case, after) this change is published, make a statement referencing your prior commitment to privacy and how this change won't change that commitment for public projects. Your reputation on this prior commitment is already blemished, especially because this wasn't presented as a blog post and instead as only a pull request to the privacy statement.
• Don't make an exception for DNT, even on the enterprise pages. Respect privacy, even if it means that you're making slightly less money.

[lennartzellmer]

Don't do that - please!

[andrewthetechie]

I am a long-term paying user of Github and an advocate for the use of Github in the businesses I interact with. I view this change as hostile to user privacy and if adopted, will move my code off of Github and change my advocacy with businesses as well.

As many other commenters have already voiced, this change reneges on a previous privacy promise you made to your users. There are many suggestions in the thread already of how you can make this change more palatable so I'll refrain from adding any more.

[BLamy]

It’s good everyone agrees not to do this.

[dragonDScript]

This is a really poor change. Sad to see GitHub so obviously prioritizing profits over its users.

Nothing bad on making extra profit, they're a business and we're in the middle of a crisis. But, privacy is essential, they promised not to use cookies. Look, just the fact that I'll have to click a reject cookies dialog - makes me sick.