Is consent required for GitHub Gist or Button embeds?

No, but with caveats. GitHub embeds serve a functional purpose — displaying code and repository stats. They do not perform advertising tracking. However, logged-in GitHub users have their identity disclosed to GitHub on every embed load, so strict EU environments may require consent.

What data does a GitHub embed transmit?

GitHub Gist and Button embeds send the visitor's IP address, user agent, referrer URL, and any GitHub session cookies (_gh_sess, user_session, _octo) to github.com. Logged-in users have their GitHub identity transmitted with every request to github.com or ghbtns.com.

How does ConsentStack categorize GitHub embeds?

ConsentStack classifies GitHub as functional. Gist and Button embeds are not blocked by default as they serve a presentational purpose without advertising profiling. Operators in strict EU compliance environments can optionally gate them on functional consent.

What tracker domains does GitHub use?

ConsentStack has catalogued tracker domains for GitHub including github.com, buttons.github.io and mreq.github.io, among 53 in total. These are the network destinations GitHub's scripts contact, which a consent platform blocks until a visitor agrees.

GitHub (buttons.github.io) - Developer Embed Consent & Privacy Profile

Back to Vendor Library

Overview

GitHub is the world's largest software development platform, owned by Microsoft. On third-party websites, GitHub appears through embedded Gist code snippets, GitHub Buttons (star/fork/follow widgets), GitHub Badges, and repository statistics widgets. These embeds load JavaScript directly from github.com or buttons.github.io, which in turn may set GitHub cookies in the visitor's browser and transmit data to GitHub/Microsoft servers.

What This Script Does

GitHub Gist Embeds

A Gist embed inserts a <script src="https://gist.github.com/{user}/{gist-id}.js"> tag. This script dynamically injects a styled <div> containing the Gist's code content. When the script loads, GitHub's servers receive the visitor's IP address, user-agent, and referrer, and any GitHub session cookies present in the browser are sent along with the request.

GitHub Buttons

The GitHub Buttons library (buttons.github.io/buttons.js) renders interactive star, fork, and follow count widgets. It loads an iframe from ghbtns.com that communicates with the GitHub API to display real-time repository statistics. The iframe context may read GitHub session cookies.

GitHub Stats Badges

Some sites embed GitHub stats images or dynamic SVG badges that make requests to github.com or third-party GitHub stat services. These are typically not JavaScript-based and set no cookies.

Cookies Set

GitHub does not set new tracking cookies via embeds on third-party sites, but if the visitor is logged into GitHub, the following cookies are sent with requests to github.com:

_gh_sess — Third-party session cookie on github.com. GitHub's session authentication cookie. Duration: session.
user_session — Third-party persistent cookie on github.com. Stores the persistent GitHub login session. Duration: 2 weeks.
dotcom_user — Third-party persistent cookie on github.com. Stores the current GitHub username. Duration: 1 year.
logged_in — Third-party persistent cookie on github.com. Boolean flag indicating whether the user is signed in. Duration: 1 year.
_octo — Third-party persistent cookie on github.com. GitHub's telemetry and analytics cookie. Duration: 1 year.

Domains Contacted

gist.github.com — Gist embed JavaScript served from here.
github.com — Repository data and API requests for button widgets.
ghbtns.com — GitHub Buttons iframe CDN.
buttons.github.io — GitHub Buttons JavaScript library.

Data Collected Per Interaction

Referrer URL (the page embedding the GitHub widget)
Visitor IP address
Browser user-agent and language
GitHub account identity if the visitor is logged into GitHub (GitHub session cookies are sent with every request to github.com)
Repository interaction events (star, fork, follow) if the user is authenticated and clicks a button widget

Consent & Compliance

GDPR / ePrivacy: GitHub Gist and Button embeds cause the visitor's browser to make requests to github.com, which transmits the visitor's IP address and any GitHub session cookies. Under GDPR, transmitting a logged-in user's GitHub identity to GitHub's servers — even as a side effect of loading an embedded widget — constitutes personal data processing by GitHub as a data controller. The German DSK and other EU DPAs have addressed the principle that third-party resource embeds which transmit personal data require a lawful basis. For embeds loaded on every page view, consent is typically required.

CCPA / CPRA: GitHub (Microsoft) may receive personal information (IP, GitHub identity) from visitors to third-party sites via Gist or Button embeds. Operators should disclose GitHub in their privacy policy if using these embeds.

EU-US Data Privacy Framework: GitHub/Microsoft is certified under the EU-US DPF. Microsoft's standard SCCs apply to GitHub data processing.

Consent Category: Functional. GitHub embeds serve a presentational purpose (displaying code, repository statistics) rather than advertising or behavioral profiling.

Should You Block This Without Consent?

No. GitHub embeds serve a functional purpose — displaying code snippets or repository statistics. They do not perform advertising profiling or behavioral tracking. While IP address and session data are transmitted to GitHub's servers, this is incidental to the functional embed rather than a tracking purpose. However, operators in strict EU compliance environments may wish to self-host Gist content or use static code blocks to avoid any third-party network requests to GitHub, particularly since logged-in GitHub users have their identity disclosed to GitHub on every embed load.

Is GitHub GDPR compliant?

GitHub typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So GitHub can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads GitHub, not on GitHub itself.

Visit website

Consent Categories

Functional

Also Known As

GitHub Gist embedGitHub buttonsgithub.com scriptbuttons.github.ioGist cookieGitHub embed privacy

Industries

Programming and Developer SoftwareComputers Electronics and Technology

Tracked Domains (53)

GitHub's trackers are rarely seen, seen on under 1% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

github.comEssential

github.com is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.

buttons.github.ioEssential

buttons.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

mreq.github.ioEssential

mreq.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

kenwheeler.github.ioEssential

kenwheeler.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

purecatamphetamine.github.ioEssential

purecatamphetamine.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

fluorescent.github.ioEssential

fluorescent.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

googleads.github.ioEssential

googleads.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

hatscripts.github.ioEssential

hatscripts.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

hammerjs.github.ioEssential

hammerjs.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

mindmup.github.ioEssential

mindmup.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

theajack.github.ioEssential

theajack.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

gitcdn.github.ioEssential

gitcdn.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

tufts-technology-services.github.ioEssential

tufts-technology-services.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

servicesem.github.ioEssential

servicesem.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

wet-boew.github.ioEssential

wet-boew.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

malsup.github.ioEssential

malsup.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

kodir2.github.ioEssential

kodir2.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

vli-platform.github.ioEssential

vli-platform.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

touhidul002.github.ioEssential

touhidul002.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

twitter.github.ioEssential

twitter.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

s9e.github.ioEssential

s9e.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

owlcarousel2.github.ioEssential

owlcarousel2.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

ewwwin.github.ioEssential

ewwwin.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

frantisekfr.github.ioEssential

frantisekfr.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

yubinbango.github.ioEssential

yubinbango.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

htmlxm.github.ioEssential

htmlxm.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

afarkas.github.ioEssential

afarkas.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

malihu.github.ioEssential

malihu.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

kjur.github.ioEssential

kjur.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

highcharts.github.ioEssential

highcharts.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

thurnix01.github.ioEssential

thurnix01.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

fbhs-outdoors-digital.github.ioEssential

fbhs-outdoors-digital.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

verinice.github.ioEssential

verinice.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

liveperson-pmi.github.ioEssential

liveperson-pmi.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

artemsedin74.github.ioEssential

artemsedin74.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

atugatran.github.ioEssential

atugatran.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

classroomjq.github.ioEssential

classroomjq.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

dialogintelligens.github.ioEssential

dialogintelligens.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

embl-communications.github.ioEssential

embl-communications.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

flutter.github.ioEssential

flutter.github.io is an essential domain operated by GitHub, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

+ 13 more tracked domains, shown by how common they are across scanned sites.