GitHub

Overview

GitHub is the world's largest software development platform, owned by Microsoft. On third-party websites, GitHub appears through embedded Gist code snippets, GitHub Buttons (star/fork/follow widgets), GitHub Badges, and repository statistics widgets. These embeds load JavaScript directly from github.com or buttons.github.io, which in turn may set GitHub cookies in the visitor's browser and transmit data to GitHub/Microsoft servers.

What This Script Does

GitHub Gist Embeds

A Gist embed inserts a <script src="https://gist.github.com/{user}/{gist-id}.js"> tag. This script dynamically injects a styled <div> containing the Gist's code content. When the script loads, GitHub's servers receive the visitor's IP address, user-agent, and referrer, and any GitHub session cookies present in the browser are sent along with the request.

GitHub Buttons

The GitHub Buttons library (buttons.github.io/buttons.js) renders interactive star, fork, and follow count widgets. It loads an iframe from ghbtns.com that communicates with the GitHub API to display real-time repository statistics. The iframe context may read GitHub session cookies.

GitHub Stats Badges

Some sites embed GitHub stats images or dynamic SVG badges that make requests to github.com or third-party GitHub stat services. These are typically not JavaScript-based and set no cookies.

Cookies Set

GitHub does not set new tracking cookies via embeds on third-party sites, but if the visitor is logged into GitHub, the following cookies are sent with requests to github.com:

• _gh_sess — Third-party session cookie on github.com. GitHub's session authentication cookie. Duration: session.
• user_session — Third-party persistent cookie on github.com. Stores the persistent GitHub login session. Duration: 2 weeks.
• dotcom_user — Third-party persistent cookie on github.com. Stores the current GitHub username. Duration: 1 year.
• logged_in — Third-party persistent cookie on github.com. Boolean flag indicating whether the user is signed in. Duration: 1 year.
• _octo — Third-party persistent cookie on github.com. GitHub's telemetry and analytics cookie. Duration: 1 year.

Domains Contacted

• gist.github.com — Gist embed JavaScript served from here.
• github.com — Repository data and API requests for button widgets.
• ghbtns.com — GitHub Buttons iframe CDN.
• buttons.github.io — GitHub Buttons JavaScript library.

Data Collected Per Interaction

• Referrer URL (the page embedding the GitHub widget)
• Visitor IP address
• Browser user-agent and language
• GitHub account identity if the visitor is logged into GitHub (GitHub session cookies are sent with every request to github.com)
• Repository interaction events (star, fork, follow) if the user is authenticated and clicks a button widget

Consent & Compliance

GDPR / ePrivacy: GitHub Gist and Button embeds cause the visitor's browser to make requests to github.com, which transmits the visitor's IP address and any GitHub session cookies. Under GDPR, transmitting a logged-in user's GitHub identity to GitHub's servers — even as a side effect of loading an embedded widget — constitutes personal data processing by GitHub as a data controller. The German DSK and other EU DPAs have addressed the principle that third-party resource embeds which transmit personal data require a lawful basis. For embeds loaded on every page view, consent is typically required.

CCPA / CPRA: GitHub (Microsoft) may receive personal information (IP, GitHub identity) from visitors to third-party sites via Gist or Button embeds. Operators should disclose GitHub in their privacy policy if using these embeds.

EU-US Data Privacy Framework: GitHub/Microsoft is certified under the EU-US DPF. Microsoft's standard SCCs apply to GitHub data processing.

Consent Category: Functional. GitHub embeds serve a presentational purpose (displaying code, repository statistics) rather than advertising or behavioral profiling.

Should You Block This Without Consent?

No. GitHub embeds serve a functional purpose — displaying code snippets or repository statistics. They do not perform advertising profiling or behavioral tracking. While IP address and session data are transmitted to GitHub's servers, this is incidental to the functional embed rather than a tracking purpose. However, operators in strict EU compliance environments may wish to self-host Gist content or use static code blocks to avoid any third-party network requests to GitHub, particularly since logged-in GitHub users have their identity disclosed to GitHub on every embed load.