6 ms·

Until now GitHub has sent client-side requests to Google Analytics with a client ID that was also sent in a second client-side request to an in-house analytics

Until now GitHub has sent client-side requests to Google Analytics with a client ID that was also sent in a second client-side request to an in-house analytics API at GitHub for augmenting and cross-referencing user data. The client-side Google Analytics request no longer appears to be sent, but a request containing personal data is still sent to collector.githubapp.com. The privacy policy page which lists third party data subprocessors and cookies used on GitHub [1] seems to be outdated. Does the announced change also mean that Google Analytics and other subprocessors have been eliminated, or has some of the tracking merely moved server-side? [1] https://docs.github.com/en/free-pro-team@latest/github/site-policy/github-subprocessors-and-cookies https://docs.github.com/en/free-pro-team@latest/github/site-...

spinningslate 6y ago
Came here to say this. Eliminating Google analytics is unequivocally a good thing. A strong B+ assessment. But the blog doesn't say anything about eliminating _tracking_. Personally, I can live with analysis that's used solely for product improvement. If that's all github is doing, then the score goes up to an A. But if they're siphoning off data for any other purposes - whether passing to the mother ship or otherwise - then the score is down to D-. The intent of EU cookie regulation is to make tracking and data collection transparent and opt in. Changing the implementation to server side might comply with the letter of the law but it violates the spirit. It would be good if GitHub would clarify their position.
- dessant 6y ago
  I've been planning to post about this issue a couple of months ago, when I've noticed that GitHub was sending personal data collected on the client-side to Google Analytics without user consent. Then recently they have introduced a consent popup, which was actually one of the most refreshing cookie consent popups I have ever seen: it contained two buttons, Accept and Reject. This popup has now been removed. I think a lot of developers may have clicked on Reject, though removing tracking cookies will not absolve GitHub of the requirement to continue asking for informed and free consent under GDPR, if they will continue to process personal data, and share it with third-party services from their servers. The current website code points to the same data still being sent to GitHub, only the implementation has changed.
  - deleted 6y ago
    [deleted]
- bcrosby95 6y ago
  Isn't using the data for product improvement still tracking? I don't personally care, but I'm not sure if the GDPR does.
- feanaro 6y ago
  Why do you think changing the implementation to the server side will comply with the letter of the law? Or perhaps I should ask which law. GDPR doesn't differentiate between the client side or server side, you're simply not allowed to keep information on users unless they've consented to for it to be kept or it is required for a legitimate functionality to which they have consented.
  - adrr 6y ago
    So I am not allowed to keep server logs without consent?
    - feanaro 6y ago
      That depends entirely on the nature of the information that is contained in your server logs.
      - rcxdude 6y ago
        And the purposes for which those logs are being used.
    - iamacyborg 6y ago
      If you're processing server logs for marketing purposes, then no, you need consent to do that. You also should be trying to scrub IP adresses from those logs as that counts as PII.
      - M2Ys4U 6y ago
        >You also should be trying to scrub IP adresses from those logs as that counts as PII. That counts as personal data. The GDPR doesn't care about "PII", as that is a US legal term and not something defined or references in EU law.
        iamacyborg 6y ago
        Fair point.
- natfriedman 6y ago
  This is all detailed in our updated privacy policy: https://github.com/github/site-policy/pull/336 https://github.com/github/site-policy/pull/336
  - dessant 6y ago
    Thanks for the update. It appears the data will continue to be sent to Google Analytics from the backend.
  - spinningslate 6y ago
    Thanks for responding Nat. My interpretation from the PR: You've stopped using cookies as a mechanism for marketing/tracking. But you're still doing it by other means. Rationale: 1. You are still tracking and may share the data with 3rd parties. Justification: privacy statement [0] line 147. It states that data are "aggregated, non-personally identified" which might mean it's GDPR compliant. OTOH: you're presumably holding the non-aggregated data for aggregation purposes in the first place. IANAL but I think that needs consent. I don't know CCPA well enough to comment. 2. The sub-processors statement [2] says this includes Google (and Google Analytics specifically), LinkedIn and Eloqua (marketing analytics firm) among others. 3. Cookies and - possibly? - other client-side technologies are only used for running and improving the service. Justification: Line 238 in the privacy statement. (There's a typo in there btw: "complie" should be "compile" I think). 3. You respect DNT - line 244. Which, presumably, means you do not track user behaviour on any sites other than github? i.e. those in which you are a 3rd party. 4. However, the privacy statement line 31 [1] states: "GitHub may also collect User Personal Information from third parties." Interpretation: whilst you're not collecting 3rd party personal information using cookies, you are (or "may") do so through other means. [0]: https://github.com/github/site-policy/pull/336/commits/fe1b687dbed7717a26ee4664faf44923f55e9ce6 https://github.com/github/site-policy/pull/336/commits/fe1b6... -- EDIT: clarified GDPR point. [1]: https://github.com/github/site-policy/pull/336/commits/79a994c9db1e0e967a838d0c89f838f53ccf608b https://github.com/github/site-policy/pull/336/commits/79a99... [2]: https://github.com/github/site-policy/pull/336/commits/e98e37dd49904de7671dab959daacc9e4b18072b https://github.com/github/site-policy/pull/336/commits/e98e3...
    - 6y ago
nicky0 6y ago
When you say GitHub is collecting personal data in a JS request, what data do you mean exactly? IP address, browser, screen resolution type stuff?

spinningslate 6y ago

Came here to say this. Eliminating Google analytics is unequivocally a good thing. A strong B+ assessment. But the blog doesn't say anything about eliminating _tracking_. Personally, I can live with analysis that's used solely for product improvement. If that's all github is doing, then the score goes up to an A. But if they're siphoning off data for any other purposes - whether passing to the mother ship or otherwise - then the score is down to D-. The intent of EU cookie regulation is to make tracking and data collection transparent and opt in. Changing the implementation to server side might comply with the letter of the law but it violates the spirit. It would be good if GitHub would clarify their position.

dessant 6y ago
I've been planning to post about this issue a couple of months ago, when I've noticed that GitHub was sending personal data collected on the client-side to Google Analytics without user consent. Then recently they have introduced a consent popup, which was actually one of the most refreshing cookie consent popups I have ever seen: it contained two buttons, Accept and Reject. This popup has now been removed. I think a lot of developers may have clicked on Reject, though removing tracking cookies will not absolve GitHub of the requirement to continue asking for informed and free consent under GDPR, if they will continue to process personal data, and share it with third-party services from their servers. The current website code points to the same data still being sent to GitHub, only the implementation has changed.
- deleted 6y ago
  [deleted]
bcrosby95 6y ago
Isn't using the data for product improvement still tracking? I don't personally care, but I'm not sure if the GDPR does.
feanaro 6y ago
Why do you think changing the implementation to the server side will comply with the letter of the law? Or perhaps I should ask which law. GDPR doesn't differentiate between the client side or server side, you're simply not allowed to keep information on users unless they've consented to for it to be kept or it is required for a legitimate functionality to which they have consented.
- adrr 6y ago
  So I am not allowed to keep server logs without consent?
  - feanaro 6y ago
    That depends entirely on the nature of the information that is contained in your server logs.
    - rcxdude 6y ago
      And the purposes for which those logs are being used.
  - iamacyborg 6y ago
    If you're processing server logs for marketing purposes, then no, you need consent to do that. You also should be trying to scrub IP adresses from those logs as that counts as PII.
    - M2Ys4U 6y ago
      >You also should be trying to scrub IP adresses from those logs as that counts as PII. That counts as personal data. The GDPR doesn't care about "PII", as that is a US legal term and not something defined or references in EU law.
      - iamacyborg 6y ago
        Fair point.
natfriedman 6y ago
This is all detailed in our updated privacy policy: https://github.com/github/site-policy/pull/336 https://github.com/github/site-policy/pull/336
- dessant 6y ago
  Thanks for the update. It appears the data will continue to be sent to Google Analytics from the backend.
- spinningslate 6y ago
  Thanks for responding Nat. My interpretation from the PR: You've stopped using cookies as a mechanism for marketing/tracking. But you're still doing it by other means. Rationale: 1. You are still tracking and may share the data with 3rd parties. Justification: privacy statement [0] line 147. It states that data are "aggregated, non-personally identified" which might mean it's GDPR compliant. OTOH: you're presumably holding the non-aggregated data for aggregation purposes in the first place. IANAL but I think that needs consent. I don't know CCPA well enough to comment. 2. The sub-processors statement [2] says this includes Google (and Google Analytics specifically), LinkedIn and Eloqua (marketing analytics firm) among others. 3. Cookies and - possibly? - other client-side technologies are only used for running and improving the service. Justification: Line 238 in the privacy statement. (There's a typo in there btw: "complie" should be "compile" I think). 3. You respect DNT - line 244. Which, presumably, means you do not track user behaviour on any sites other than github? i.e. those in which you are a 3rd party. 4. However, the privacy statement line 31 [1] states: "GitHub may also collect User Personal Information from third parties." Interpretation: whilst you're not collecting 3rd party personal information using cookies, you are (or "may") do so through other means. [0]: https://github.com/github/site-policy/pull/336/commits/fe1b687dbed7717a26ee4664faf44923f55e9ce6 https://github.com/github/site-policy/pull/336/commits/fe1b6... -- EDIT: clarified GDPR point. [1]: https://github.com/github/site-policy/pull/336/commits/79a994c9db1e0e967a838d0c89f838f53ccf608b https://github.com/github/site-policy/pull/336/commits/79a99... [2]: https://github.com/github/site-policy/pull/336/commits/e98e37dd49904de7671dab959daacc9e4b18072b https://github.com/github/site-policy/pull/336/commits/e98e3...
  - 6y ago

nicky0 6y ago

When you say GitHub is collecting personal data in a JS request, what data do you mean exactly? IP address, browser, screen resolution type stuff?