GitHub states that users in applicable jurisdictions can request to access, correct, delete, or export their personal data, and can object to certain types of processing, by submitting a request through GitHub's privacy portal.
This analysis describes what GitHub's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy confirms data subject rights for users in applicable jurisdictions including GDPR rights for EU users and CCPA rights for California residents, with GitHub committing to respond in accordance with applicable law, though the specific timelines and scope of each right are not fully described in this provision.
Interpretive note: The policy does not specify response timelines, identity verification procedures, or how enterprise controller versus GitHub controller scenarios affect data subject request handling, creating operational uncertainty.
The updated terms now explicitly authorize GitHub to collect AI outputs generated within the platform alongside user-provided code and content, and to share personal data with Microsoft and other GitHub affiliates for purposes including training and improving artificial intelligence and machine learning technologies. The privacy statement indicates that aggregate and de-identified data will be used where feasible, but the updated language establishes broader authority for affiliate data sharing and AI model development than the previous version stated. The revised terms also remove specific disclosure of the conditions under which GitHub personnel may access private repositories, replacing that detail with a cross-reference to the Terms of Service, which means the scope of internal GitHub access to private repositories is now defined in a separate contract document rather than the privacy statement itself.
View change record →Contact method changed from direct email (privacy@github.com) to unspecified "privacy request portal," making the process less transparent.
View full change record →Users in the EU, UK, California, and other jurisdictions with applicable privacy laws can exercise rights to access, correct, delete, or port their personal data by submitting a request through GitHub's privacy contact page at https://support.github.com/contact/privacy.
How other platforms handle this
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
You may contact our privacy team with any requests of disclosure, correction, or deletion of your personal information. You may also request suspension of use or suspension of sharing of your personal information with certain third parties.
"Depending on your location, you may have certain rights with respect to your personal data, including the right to access, correct, delete, or port your data. You may also have the right to object to or restrict certain processing. To exercise these rights, please contact us through our privacy request portal. We will respond to your request in accordance with applicable law.Excerpt from GitHub's Privacy Statement
(1) REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 15-22 (data subject rights including access, rectification, erasure, restriction, portability, and objection), CCPA/CPRA rights to know, delete, correct, and opt out, and comparable rights under UK …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The policy confirms data subject rights for users in applicable jurisdictions including GDPR rights for EU users and CCPA rights for California residents, with GitHub committing to respond in accordance with applicable law, though the specific timelines and scope of each right are not fully described in this provision.
Users in the EU, UK, California, and other jurisdictions with applicable privacy laws can exercise rights to access, correct, delete, or port their personal data by submitting a request through GitHub's privacy contact page at https://support.github.com/contact/privacy.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by GitHub.