California residents can request to know what personal data GitHub holds about them, ask for it to be deleted or corrected, and opt out of GitHub sharing their personal information with third parties, all through GitHub's privacy portal.
This analysis describes what GitHub's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy confirms California residents have enforceable rights under CCPA and CPRA including the right to opt out of data sharing with third parties, which is practically significant given the policy's disclosure that data may be shared with advertising and analytics partners.
The updated terms now explicitly authorize GitHub to collect AI outputs generated within the platform alongside user-provided code and content, and to share personal data with Microsoft and other GitHub affiliates for purposes including training and improving artificial intelligence and machine learning technologies. The privacy statement indicates that aggregate and de-identified data will be used where feasible, but the updated language establishes broader authority for affiliate data sharing and AI model development than the previous version stated. The revised terms also remove specific disclosure of the conditions under which GitHub personnel may access private repositories, replacing that detail with a cross-reference to the Terms of Service, which means the scope of internal GitHub access to private repositories is now defined in a separate contract document rather than the privacy statement itself.
View change record →New California-specific privacy rights section providing explicit recognition of CCPA/CPRA compliance, reflecting state-level regulatory requirements.
View full change record →California residents can exercise CCPA/CPRA rights to access, delete, correct, and opt out of the sharing of their personal information by submitting a request at https://support.github.com/contact/privacy; exercising these rights cannot result in discriminatory treatment according to the policy.
How other platforms handle this
When you use them, we'll validate your request by verifying your identity (for example, by confirming that you're signed in to your Google Account).
Not be Discriminated Against by us for exercising your privacy rights.
You may contact our privacy team with any requests of disclosure, correction, or deletion of your personal information. You may also request suspension of use or suspension of sharing of your personal information with certain third parties.
"If you are a California resident, you have specific rights under the California Consumer Privacy Act and California Privacy Rights Act. These rights include the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information, the right to correct inaccurate personal information, and the right to non-discrimination for exercising these rights. To exercise these rights, California residents can submit a request through our privacy portal.Excerpt from GitHub's Privacy Statement
(1) REGULATORY LANDSCAPE: This provision directly engages the California Consumer Privacy Act and the California Privacy Rights Act.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The policy confirms California residents have enforceable rights under CCPA and CPRA including the right to opt out of data sharing with third parties, which is practically significant given the policy's disclosure that data may be shared with advertising and analytics partners.
California residents can exercise CCPA/CPRA rights to access, delete, correct, and opt out of the sharing of their personal information by submitting a request at https://support.github.com/contact/privacy; exercising these rights cannot result in discriminatory treatment according to the policy.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by GitHub.