Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement prohibits posting another person's personal information without their consent, characterizing such conduct as a privacy violation subject to enforcement under the AUP.
This analysis describes what GitHub's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a consent-based standard for posting third-party personal information, which has operational significance for repositories that include user-generated data, research datasets, or scraped data that may contain personal identifiers.
Interpretive note: The definition of 'personal information' and the scope of the consent requirement varies across jurisdictions, and the provision's interaction with applicable data protection law depends on the location of the data subject and the nature of the information posted.
Under this clause, posting personal information about another person without their consent is prohibited on GitHub. This restriction applies to all content hosted on GitHub's platform, including repositories, issues, comments, and wiki pages.
How other platforms handle this
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
If you live in Nevada, you can opt out of the sale of your personal information by completing the privacy request form here.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
Monitoring
GitHub has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"You may not violate the privacy of any third party, such as by posting another person's personal information without their consent.Excerpt from GitHub's Acceptable Use Policies
1) REGULATORY LANDSCAPE: This provision engages GDPR for EU-based users and data subjects, CCPA for California residents, and various US state privacy laws. Posting personal information without consent may constitute unlawful processing under GDPR Article 6 or a violation of CCPA's personal information protections. Enforcement authorities include EU national data protection authorities and state attorneys general. 2) GOVERNANCE EXPOSURE: Medium. The prohibition is stated in general terms and cross-references a subsidiary doxxing and invasion of privacy sub-policy. Organizations hosting datasets, research outputs, or logs that include personal identifiers should assess whether their content practices comply with both this provision and applicable data protection law. 3) JURISDICTION FLAGS: EU and EEA users face the highest compliance exposure under GDPR, where unauthorized disclosure of personal data may trigger notification obligations and regulatory penalties. California residents benefit from CCPA protections. Illinois (BIPA) is relevant where biometric data is involved. 4) CONTRACT AND VENDOR IMPLICATIONS: Organizations publishing research, security disclosures, or operational data to GitHub repositories should review data minimization and pseudonymization practices to avoid inadvertent personal information exposure. Vendor assessments should confirm that GitHub's privacy practices for hosted content align with applicable data protection obligations. 5) COMPLIANCE CONSIDERATIONS: Legal and compliance teams should audit repository content, issue trackers, and wiki pages for personal data exposure. Data processing agreements with GitHub should be reviewed to confirm that personal data hosted on the platform is covered by appropriate contractual protections, particularly for EU-based organizations.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes a consent-based standard for posting third-party personal information, which has operational significance for repositories that include user-generated data, research datasets, or scraped data that may contain personal identifiers.
Under this clause, posting personal information about another person without their consent is prohibited on GitHub. This restriction applies to all content hosted on GitHub's platform, including repositories, issues, comments, and wiki pages.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by GitHub.