Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Privacy Statement Updates September 2022 #582

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

olholder
Copy link
Contributor

@olholder olholder commented Aug 2, 2022

GitHub is introducing non-essential cookies on web pages that market our products to businesses. These cookies will provide analytics to improve the site experience and personalize content and ads for enterprise users. This change is only on subdomains, like resources.github.com, where GitHub markets products and services to enterprise customers. Github.com will continue to operate as-is.

This change updates the Privacy Statement based on this new activity.

These updates will go into effect after the 30-day notice and comment period, on September 1, 2022.

Updates to privacy statement
@olholder olholder changed the title Update github-privacy-statement.md Privacy Statement Updates September 2022 Aug 2, 2022
@olholder olholder requested a review from literarytea Aug 2, 2022
@@ -33,13 +34,13 @@ To see our Privacy Notice to residents of California, please go to [GitHub's Not

| Section | What can you find there? |
|---|---|
| [Who is responsible for the processing of your information](#who-is-responsible-for-the-processing-of-your-information) | Subject to limited exceptions, GitHub is the controller and entity responsible for the processing of your Personal Data in connection with the Website or Service. |
Copy link

@rick rick Aug 2, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the change from "Personal Data" to "personal data" a stylistic change?

I note that the paragraph above is still intact:

All capitalized terms have their definition in GitHub’s Terms of Service, unless otherwise noted here.

Presuming this capitalization change is unintentional, it has the unfortunate effect of decoupling "Personal Data" from the definition provided in the GitHub Terms of Service, which means that "personal data" is no longer as delineated there, but could well be anything.

If this is an intentional change, it would seem better made as a visible change to the Terms of Service. If the intent is not to change the Terms of Service but to arbitrarily expand "personal data" without drawing attention, well, that seems evil.

Copy link

@rick rick Aug 2, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking into this further -- it looks like "Personal Data" is defined these days in the GitHub Data Protection Agreement. Perhaps this was being decapitalized since it is not directly defined (afaict) in the GitHub Terms of Service?


Our emails to users may contain a pixel tag, which is a small, clear image that can tell us whether or not you have opened an email and what your IP address is. We use this pixel tag to make our email communications more effective and to make sure we are not sending you unwanted email.

### DNT

"[Do Not Track](https://www.eff.org/issues/do-not-track)" (DNT) is a privacy preference you can set in your browser if you do not want online services to collect and share certain kinds of information about your online activity from third party tracking services. GitHub responds to browser DNT signals and follows the [W3C standard for responding to DNT signals](https://www.w3.org/TR/tracking-dnt/). If you would like to set your browser to signal that you would not like to be tracked, please check your browser's documentation for how to enable that signal. There are also good applications that block online tracking, such as [Privacy Badger](https://privacybadger.org/).
"[Do Not Track](https://www.eff.org/issues/do-not-track)" (DNT) is a privacy preference you can set in your browser if you do not want online services to collect and share certain kinds of information about your online activity from third party tracking services. Some services may respond to browser DNT signals and follow the [W3C standard for responding to DNT signals](https://www.w3.org/TR/tracking-dnt/). If you would like to set your browser to signal that you would not like to be tracked, please check your browser's documentation for how to enable that signal. There are also good applications that block online tracking, such as [Privacy Badger](https://privacybadger.org/) or [uBlock Origin](https://github.com/gorhill/uBlock/).

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let me prefix this by stating that I am a complete layman.

Previously: *GitHub* responds to browser DNT signals and follows the W3C spec.
Now: Some random services, somewhere in the world, hosted by GitHub or somebody else *may* respond to browser DNT signals and follow the W3C spec.

Doesn't this change invalidate the whole paragraph and turns it into a generic wiki article?

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dunno, they will stop respecting DNT but leave this paragraph and make it seem as if they do. This is just confusing.

Copy link

@Consolatis Consolatis Aug 3, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"Confusing" is one way to put it.

Edit:
@zzo38 articulated my personal opinion better than I could so I'll quote part of their comment here:

I also think that they should avoid using confusing privacy policies; the mention of DNT should either be kept as is if GitHub uses the DNT header to reduce tracking, or deleted entirely if GitHub does not use the DNT header. If it does so only in some cases, it should mention what cases these are. The privacy policy made sense before the change in the section about DNT, although the change mentioned above makes it confusing (as other comments already mention).

[..]

I have no problem with adding these non-essential cookies to the enterprise marketing pages, as long as the rest of GitHub can be used without it and it is documented which pages these are (and if the cookie domain is the same, also which cookies). Moving the enterprise marketing pages to a separate domain seems to me to be a good idea though, in order to be clearly distinguished (although a subdomain is probably good enough, in my opinion; as long as it is documented clearly which subdomains these are).

Emphasis are mine.
In my opinion, documented should mean being very specific and being part of a legally binding document like the privacy policy.

An example for not being specific is this part of the changes:

As described below, we may use non-essential cookies on certain pages of our website

Copy link

@al1103 al1103 Aug 7, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:))

@jdgregson
Copy link

@jdgregson jdgregson commented Aug 2, 2022

You lost me at ads for enterprise users.

@leoheck
Copy link

@leoheck leoheck commented Aug 3, 2022

Github is being undermined by Microsoft.

@TechSolomon
Copy link

@TechSolomon TechSolomon commented Aug 3, 2022

🍪 https://github.blog/2020-12-17-no-cookie-for-you/

@TheMaverickProgrammer
Copy link

@TheMaverickProgrammer TheMaverickProgrammer commented Aug 3, 2022

so what github alternative is everyone using these days? asking for a friend.

@ocdtrekkie
Copy link

@ocdtrekkie ocdtrekkie commented Aug 3, 2022

"We are also committing that going forward, we will only use cookies that are required for us to serve GitHub.com."

Apparently in corporate terms, a "commitment" is now less than two calendar years of obligation. Good to know. Though, I guess I don't visit the marketing pages and hence, don't really care that much? Corporations being untrustworthy isn't new territory.

Literally just "business advice": Your marketing teams should be weighing the value of the data here against the cost of "yet another breach of user trust and commitment", user trust, of course, being something extremely hard to earn back.

@karlshea
Copy link

@karlshea karlshea commented Aug 3, 2022

Marketing people don't care about user trust or commitments. They'll just burn things to the ground and move on to the next corp job, each time making the world a slightly worse place.

@afkvido
Copy link

@afkvido afkvido commented Aug 3, 2022

This clearly shows that GitHub cares more about revenue than the user base behind it.

Microsoft fucking sucks, GitHub wasn't evil until Microsoft really started to abuse GitHub.

@afkvido
Copy link

@afkvido afkvido commented Aug 3, 2022

so what github alternative is everyone using these days? asking for a friend.

@TheMaverickProgrammer GitLab probbably.

Copy link

@afkvido afkvido left a comment

Requesting a change: Don't add this.

@RoyTinker
Copy link

@RoyTinker RoyTinker commented Aug 3, 2022

I understand that cookies are helpful for analytics and gathering sales funnel data. It's always sad when companies don't keep prior promises, though 😟

If you must break the promise, here's my suggestion, for what it's worth: move enterprise marketing pages (maybe even all marketing pages besides the front page?) off of github.com onto a separate domain. Maybe github.info?

Then point marketing links from the front page to that domain.

This will allow folks to deal with that domain separately from github.com.

@tylt6688
Copy link

@tylt6688 tylt6688 commented Aug 3, 2022

I personally feel that the enterprise version can be made independently.

@jacamera
Copy link

@jacamera jacamera commented Aug 3, 2022

As a happy GitHub user I just hope all this recreational outrage doesn't result in GitHub allocating more time or resources than would otherwise be required to complete this change. Full speed ahead!

@afkvido
Copy link

@afkvido afkvido commented Aug 3, 2022

As a happy GitHub user I just hope all this recreational outrage doesn't result in GitHub allocating more time or resources than would otherwise be required to complete this change. Full speed ahead!

I'd want GitHub to remove Microsoft, then continue full speed ahead

@evelynmarie
Copy link

@evelynmarie evelynmarie commented Aug 3, 2022

This change is only on subdomains where GitHub markets products and services to enterprise customers, and all other GitHub subdomains will continue to operate as-is.

Why are people getting so riled up when this change only impacts the Enterprise marketing subdomains? Makes no sense to me how this of all things is getting negative attention. Majority of people don't use GitHub Enterprise, as its only for businesses, And they're just cookies. Use uBlock Origin as it says if you really can't stand a few cookies on subdomains you'll probably never end up going to.

Also, people love pointing the finger at Microsoft, as if this change was demanded by them. It more than likely wasn't. There are always going to be changes that people don't like, but not all changes are influenced by the parent company. If Microsoft was puttng their hands all over GitHub, they probably would've moved GitHub to the Microsoft Policy Statement a long time ago.

@afkvido
Copy link

@afkvido afkvido commented Aug 3, 2022

Cuz GitHub said they wouldnt use cookies
daym its a borken promise

@evelynmarie
Copy link

@evelynmarie evelynmarie commented Aug 3, 2022

"We are also committing that going forward, we will only use cookies that are required for us to serve GitHub.com."

Apparently in corporate terms, a "commitment" is now less than two calendar years of obligation. Good to know. Though, I guess I don't visit the marketing pages and hence, don't really care that much? Corporations being untrustworthy isn't new territory.

Literally just "business advice": Your marketing teams should be weighing the value of the data here against the cost of "yet another breach of user trust and commitment", user trust, of course, being something extremely hard to earn back.

How exactly does this in any way impact user trust? It doesn't impact the main site, like the dashboard, the landing page, or any other part of GitHub like profiles, repositories, or organizations. It literally only impacts the enterprise marketing pages, and its for sales data tracking & analytics. GitHub Enterprise is a very business-oriented product, so the only visitors to those pages will be by business leaders potentially interested in GitHub Enterprise, or users who land on that page by mistake.

And I believe that is what GitHub meant when they said "to serve GitHub.com" - the main site (dashboard, repos, profiles, etc), not including stuff related to their Enterprise product, so I genuinely don't believe they broke their commitment. People are overreacting, as usual, to insignificant changes that don't really impact them.

@afkvido
Copy link

@afkvido afkvido commented Aug 3, 2022

Thats fine but fuck microsoft for existing

@afkvido
Copy link

@afkvido afkvido commented Aug 3, 2022

There's a reason this PR has 128+ negative reactions 👎

@afkvido
Copy link

@afkvido afkvido commented Aug 3, 2022

Also, they have, take a look at this PR.

@evelynmarie
Copy link

@evelynmarie evelynmarie commented Aug 3, 2022

@afkvido: Also, they have, take a look at this PR.

This was more than likely not Microsoft's doing. Not everything a subsidiary of Microsoft does is because of Microsoft itself. You have the vast majority of comments on this PR (at 8 comments), and your opinion isn't be all end all. Most of the negative reactions are additionally probably from people who don't understand the scope of what GitHub said back when they committed to not use cookies not necessary to serve GitHub itself - they probably didn't extend it to the Enterprise marketing pages to begin with and always meant the main site that serves repositories and profiles and such.

There are things worse than cookies by the way, like actual trackers embedded in web pages. Cookies are relatively harmless if used sparingly and for very specific purposes like tracking sales analytics or for keeping a user logged into their web browsers, or in a specific GitHub use case, tracking the current site theme. There is nothing wrong with stuff like this.

You seem awfully mad at Microsoft for some reason, as if they stole your pet dog or something. This isn't 2000s & early 2010s-era Microsoft, Microsoft is nowhere near as bad as they were when Steve Ballmer was the CEO of Microsoft. Ever since Satya became CEO, I have noticed a significant improvement in Microsoft's business culture and strategy. MS was way, way, way worse back when Ballmer was CEO.

(also, slight question, why upvote your own comments?)

@afkvido
Copy link

@afkvido afkvido commented Aug 3, 2022

This was more than likely not Microsoft's doing. Not everything a subsidiary of Microsoft does is because of Microsoft itself.

I don't know why anyone at GitHub would do this change, and Microsoft is the only other entity with the authority to make such a change.


You have the vast majority of comments on this PR (at 8 comments), and your opinion isn't be all end all.

I just poke in whenever this comes up on my GitHub notifications.


Most of the negative reactions are additionally probably from people who don't understand the scope of what GitHub said back when they committed to not use cookies not necessary to serve GitHub itself - they probably didn't extend it to the Enterprise marketing pages to begin with and always meant the main site that serves repositories and profiles and such.

That is a good point, however, that doesn't change the fact that GitHub is no longer the white and fluffy angel that it was.


There are things worse than cookies by the way, like actual trackers embedded in web pages. Cookies are relatively harmless if used sparingly and for very specific purposes like tracking sales analytics or for keeping a user logged into their web browsers, or in a specific GitHub use case, tracking the current site theme. There is nothing wrong with stuff like this.

While you seem quite intelligent, I don't think that you understand that cookies could actually be used as slight trackers, and if used to their fullest potential, complete on-site tracking for AI/ML based targeted recommendations for profit.


You seem awfully mad at Microsoft for some reason, as if they stole your pet dog or something. This isn't 2000s & early 2010s-era Microsoft, Microsoft is nowhere near as bad as they were when Steve Ballmer was the CEO of Microsoft. Ever since Satya became CEO, I have noticed a significant improvement in Microsoft's business culture and strategy. MS was way, way, way worse back when Ballmer was CEO.

Microsoft is still a mega-corp. They're still 'evil', just like Google or Apple. I also don't see much of a difference with the two CEOs. One was making more money, one was discussing ethics more often, but in the end, Microsoft is still somewhat invasive. To add on, Microsoft decided to absolutely RUIN Minecraft, a game that I don't really play these days, but my friends play a lot.


(also, slight question, why upvote your own comments?)

(also, slight question, why downvote my comments?)

@zzo38
Copy link

@zzo38 zzo38 commented Aug 3, 2022

I think that the cookies ought to be documented, so that you know which cookie means what.

I also think that they should avoid using confusing privacy policies; the mention of DNT should either be kept as is if GitHub uses the DNT header to reduce tracking, or deleted entirely if GitHub does not use the DNT header. If it does so only in some cases, it should mention what cases these are. The privacy policy made sense before the change in the section about DNT, although the change mentioned above makes it confusing (as other comments already mention).

Mentioning other programs such as Privacy Badger and uBlock Origin are OK, although it might be worth to add a disclaimer if GitHub is not affiliated with such programs, even if they are hosted on GitHub. (Since GitHub is used for many FOSS projects, it is likely that some of them will be.)

I have no problem with adding these non-essential cookies to the enterprise marketing pages, as long as the rest of GitHub can be used without it and it is documented which pages these are (and if the cookie domain is the same, also which cookies). Moving the enterprise marketing pages to a separate domain seems to me to be a good idea though, in order to be clearly distinguished (although a subdomain is probably good enough, in my opinion; as long as it is documented clearly which subdomains these are).

About alternatives to GitHub, I would not recommend GitLab because it will not display the files if JavaScripts are not enabled. However, it is acceptable to use GitLab if there are mirrors on multiple services. GitHub, Codeberg, and NotABug, and some others, also use JavaScripts, although the files can be displayed even if JavaScripts are disabled (even though there is a note that says enable JavaScripts, it is not required to simply view files), so it is acceptable. Another alternative is Sourcehut, which also doesn't need JavaScripts (and says that all features work without JavaScripts, although it still has some).

@afkvido
Copy link

@afkvido afkvido commented Aug 3, 2022

I don't mind GitLab, except that I have to pause for 15 minutes to finish laughing every time i see "Merge Requests"

@sammcj
Copy link

@sammcj sammcj commented Aug 3, 2022

What happened to this policy https://github.blog/2020-12-17-no-cookie-for-you/ ?

I guess it's a bit like Microsoft ❤️ Linux....

@Nllii
Copy link

@Nllii Nllii commented Aug 4, 2022

Hahah , Github Marketing and HR is finally turning developers into consumers.

All the data coming from individuals , tracking and fingerprinting users over the years on Github, has been collecting dust.

I am sure majority of developers/programers don't even care enough to interact with GitHub itself. It was only a matter of time before Github gets to utilize that personal information from our job and school using their enterprise server.

Github already has our internal/private IP address and system information, now it's time to get the person behind the screen.

We are getting closer to GitHub becoming a social media platform.

@afkvido
Copy link

@afkvido afkvido commented Aug 4, 2022

True, but very unfortunate

@homelyseven250
Copy link

@homelyseven250 homelyseven250 commented Aug 4, 2022

Minecraft, Github, Windows 11... whats next?

@gruselhaus
Copy link

@gruselhaus gruselhaus commented Aug 4, 2022

Minecraft, Github, Windows 11... whats next?

we all, the developers

@parpok
Copy link

@parpok parpok commented Aug 4, 2022

Dear MS
Please let your companies operate on their own

@GoldenretriverYT
Copy link

@GoldenretriverYT GoldenretriverYT commented Aug 4, 2022

😐
My normal comment was deleted lmao - how poorly can olholder handle critical comments? There were no insults, no personal attacks, nothing.

@r00ster91
Copy link

@r00ster91 r00ster91 commented Aug 4, 2022

https://sourcehut.org/
https://github.com/r00ster91/shifting#github-alternatives-code-hosting-platforms

@BlueSkyClouds
Copy link

@BlueSkyClouds BlueSkyClouds commented Aug 4, 2022

very unfortunate

@skystash
Copy link

@skystash skystash commented Aug 4, 2022

GDPR / The Cookie Law states that consent must be obtained and freely given without coercion (e.g. blocking access to Github) before they can use non-essential cookies / PII (personal identifiable info). This sounds kinda illegal to force through in EU countries no?

See: https://gdpr.eu/cookies/ > "Cookie compliance"

  • Receive users’ consent before you use any cookies except strictly necessary cookies.
  • Allow users to access your service even if they refuse to allow the use of certain cookies

@gruselhaus
Copy link

@gruselhaus gruselhaus commented Aug 4, 2022

GItHub marketing team rn
giphy

@zzo38
Copy link

@zzo38 zzo38 commented Aug 4, 2022

GDPR / The Cookie Law states that consent must be obtained and freely given without coercion (e.g. blocking access to Github) before they can use non-essential cookies / PII (personal identifiable info).

Hopefully, if such cookies are only applicable for the enterprise marketing pages, and it is clear which ones those are, then such a message can be added on those pages only without disrupting the rest of GitHub. Then, users can still use GitHub even if they refuse the non-essential cookies. Then such "cookie popups" will not be needed on most of the GitHub; they are only in one section which hopefully most users will not need.

tejusp
tejusp approved these changes Aug 4, 2022
@SawyerHopkins
Copy link

@SawyerHopkins SawyerHopkins commented Aug 5, 2022

As a California resident I am unable to find your CCPA contact info. What is the correct contact at GitHub/Microsoft to have this information deleted? I believe legally there is a requirement to have at least 2 easily accessible methods for submitting these requests.

Copy link

@e-coders e-coders left a comment

I hope these changes are good, approving is good.

@TheMaverickProgrammer
Copy link

@TheMaverickProgrammer TheMaverickProgrammer commented Aug 5, 2022

We need to get a YouTuber in here to read these comments. That's the only way to get the right thing done these days.

@Sooraj-s-98
Copy link

@Sooraj-s-98 Sooraj-s-98 commented Aug 5, 2022

what about this policy https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement#githubs-global-privacy-practices

@Alex-Sour
Copy link

@Alex-Sour Alex-Sour commented Aug 5, 2022

what is the reason for this change? who does it benefit

@gruselhaus
Copy link

@gruselhaus gruselhaus commented Aug 5, 2022

what is the reason for this change? who does it benefit

GitHub obviously

@stamminator
Copy link

@stamminator stamminator commented Aug 5, 2022

So let me get this straight... you're introducing marketing cookies for enterprise — i.e. paying — customers? That has the same energy as Google Workspace accounts being way worse than free Google accounts. Why would you do that to people who are paying you money?

@afkvido
Copy link

@afkvido afkvido commented Aug 6, 2022

what is the reason for this change? who does it benefit

GitHub obviously

Microsoft more than Gh

@afkvido
Copy link

@afkvido afkvido commented Aug 6, 2022

GitHub ain't evil, yknow, It's Microsoft that's a fuckin dawg

@GoldenretriverYT
Copy link

@GoldenretriverYT GoldenretriverYT commented Aug 6, 2022

GitHub ain't evil, yknow, It's Microsoft that's a fuckin dawg

Microsoft doesn't do a lot with it subsidiaries. For example, a mojang dev said:

Marketplace? Mojangs Idea
Chat Report System? Mojangs Idea

Its probably not gonna be different on GitHub

@afkvido
Copy link

@afkvido afkvido commented Aug 6, 2022

pal, i just don't know why i would trust megacorps, but honestly, i'm just sad that GitHub is losing its authenitc "we aren't evil"

@dragonDScript
Copy link

@dragonDScript dragonDScript commented Aug 6, 2022

The reactions of this PR show what people think. Please don't merge.

@EduApps-CDG
Copy link

@EduApps-CDG EduApps-CDG commented Aug 7, 2022

The reactions of this PR show what people think. Please don't merge.

It's already on the main page, you know what's going to happen...

@afkvido
Copy link

@afkvido afkvido commented Aug 7, 2022

unfortunate

@steven9463912
Copy link

@steven9463912 steven9463912 commented Aug 7, 2022

What leaves me speachless is that there are still people not using https://privacybadger.org/ and https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/

@dragonDScript
Copy link

@dragonDScript dragonDScript commented Aug 7, 2022

What leaves me speachless is that there are still people not using https://privacybadger.org/ and https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/

The good thing about Firefox is Total Cookie Protection. It's the only reason I'm still using it. I hope chromium based browsers also get this feature OR firefox gets more adoption (unlikely)

@dragonDScript
Copy link

@dragonDScript dragonDScript commented Aug 7, 2022

Yeah, sure. And the UWP based version is also Mojang's idea. Microsoft is known to ruin their subsidiares by making the wrong choices. Like a helicopter parent.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet