Sourcegraph automatically tracks how you use its services, including what you click on and how often you use specific features, and links this activity to an internal identifier assigned to you.
This analysis describes what Sourcegraph Cody's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes collection of detailed behavioral data tied to a persistent user identifier, which may allow reconstruction of individual usage patterns over time even if the identifier is not directly linked to a name.
Sourcegraph collects click patterns and feature utilization frequency tied to an internally-generated user ID, which means detailed behavioral profiles may be maintained for each user of the Services even without association to a directly identifying name or email.
Cross-platform context
See how other platforms handle Automated Usage Analytics and Event Tracking and similar clauses.
Compare across platforms →Monitoring
Sourcegraph Cody has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"Event analytics data and metadata to better understand usage within the Services, including click patterns and length and frequency of feature utilization, tied to an internally-generated user ID number.— Excerpt from Sourcegraph Cody's Sourcegraph Privacy Policy
1) REGULATORY LANDSCAPE: Collection of behavioral data tied to persistent identifiers engages GDPR recital 30 and Article 4 definitions of personal data, under which pseudonymous identifiers are generally treated as personal data if re-identification is reasonably possible. CCPA similarly treats internal identifiers linked to behavioral data as personal information. The FTC and EU data protection authorities have both addressed the privacy implications of persistent behavioral tracking. 2) GOVERNANCE EXPOSURE: Medium. The policy does not specify the retention period for event analytics data or the scope of re-identification controls applied to internally-generated user IDs. This creates compliance uncertainty for organizations required to respond to data subject access or deletion requests, as the policy does not clarify whether event analytics records are included in deletion workflows. 3) JURISDICTION FLAGS: EU/EEA users have rights of access and erasure under GDPR that would apply to pseudonymous behavioral data if re-identification is reasonably possible. California residents have CCPA rights regarding categories of personal information including identifiers and inferences drawn from usage data. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should confirm that usage analytics data is subject to deletion and portability obligations under customer agreements. The policy does not specify whether event analytics data is shared with subprocessors beyond Sourcegraph's own analytics infrastructure. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that data subject request workflows include event analytics records tied to user IDs, and should assess whether the internally-generated user ID constitutes personal data under applicable law given the potential for re-identification.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision authorizes collection of detailed behavioral data tied to a persistent user identifier, which may allow reconstruction of individual usage patterns over time even if the identifier is not directly linked to a name.
Sourcegraph collects click patterns and feature utilization frequency tied to an internally-generated user ID, which means detailed behavioral profiles may be maintained for each user of the Services even without association to a directly identifying name or email.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Sourcegraph Cody.