"GitHub presents a high-risk privacy profile (68/100) comparable to mainstream tech platforms like Google and Microsoft. The service collects extensive personal data including code, behavioral patterns, location inferences, and demographic information, then shares identifiers and inferences with advertising networks and data analytics providers for targeted advertising and profiling. Critical concerns include indefinite data retention for legal purposes without guaranteed deletion, broad sharing with Microsoft affiliates and third-party integrators, and use of personal data for AI/ML model training with limited user opt-out mechanisms."
github Privacy Concerns & Scorecard
GitHub shares personal data with advertising networks, data analytics providers, and unspecified partners for marketing and targeted advertising purposes—going beyond standard service provider sharing.
GitHub collects and uses personal data for AI and machine learning model training without explicit per-user opt-in mechanism described in the provided policy segments. Users have limited visibility and control over how their data is used for AI/ML purposes.
GitHub uses multiple cross-device and cross-site tracking technologies including web beacons in emails, flash cookies, mobile identifiers, and third-party pixels to track user behavior for targeted advertising purposes.
GitHub does not provide clear data deletion mechanisms. While users can request erasure under specific conditions (GDPR/CCPA), account deletion does not guarantee deletion of all associated data, particularly content stored in repositories or used for legal defense.
GitHub's use of personal data for AI and machine learning model training is disclosed but without clear opt-out mechanisms or transparency about which models or training datasets include user content.
GitHub collects children's data despite stating it does not intentionally target users under 13, creating potential COPPA compliance risk.
No recommended actions at this time.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account creation, authentication, communication, identity verification
Payment processing, billing, subscription management
Service localization, abuse detection, compliance, advertising targeting
Service compatibility, performance optimization, abuse detection, analytics
Service delivery, collaboration, abuse detection, AI/ML model training
Service improvement, personalization, marketing, analytics, targeted advertising
Analytics, targeted advertising, market research, service personalization
Marketing, engagement measurement, communication preferences
Targeted advertising, profiling, personalization, service improvement
Account linking, enhanced functionality, analytics
Cross-Platform Tracking
GitHub tracks you across multiple services using web beacons in emails (tracking opens and device type), cookies that advertising partners read across websites, mobile identifiers on mobile apps, and flash cookies that persist across browser sessions. Your browsing history on GitHub and inferred location are shared with advertising networks and analytics providers for cross-platform profiling and retargeting. VS Code telemetry is collected by default and synced across your devices.
Tracking Methods:
Web Beacons / Pixel Tags
Invisible 1x1 pixels embedded in marketing emails that report when emails are opened, which email client is used, device type, IP address, and which links are clicked. Third-party web beacons allow external companies to track the same user across different websites.
Cookies & Similar Technologies
Session and persistent cookies store user preferences, authentication, and tracking data. Flash cookies (Local Shared Objects) are harder to delete and may re-spawn standard cookies. Non-essential cookies used for interest-based advertising and analytics. Advertising partners set their own cookies that track users across websites.
Mobile Advertising Identifiers
Advertising IDs on iOS (IDFA) and Android (Google Advertising ID) allow GitHub and third-party partners to track users across mobile apps and websites for profiling and targeted advertising.
VS Code Telemetry
Automatically collects IDE usage patterns, extension usage, feature adoption, crashes, and errors. Data synced across user's devices if Settings Sync is enabled. Can be disabled in VS Code preferences but is enabled by default.
Third-Party Analytics & Advertising Pixels
Third-party analytics and advertising network pixels on GitHub pages allow external companies to track user interactions, build behavioral profiles, and serve targeted ads across websites and apps over time.
AI & Data Training
github uses your content to train AI
Below is what's used and how (if at all) you can object.
What Content Is Used
Code in Repositories
Code in public and private repositories is used for AI and machine learning model training, including training for GitHub Copilot and other AI features.
User Behavioral Data
Behavioral patterns, IDE usage, code editor interactions, and inferred preferences are used for AI/ML model training and service improvement.
How to Object
No opt-out available
This service does not currently provide a public way to opt out of AI training.
Why We Analyzed github
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.