541–550 of 634 posts
(GitHub CEO) Hi everyone, thanks for all the enthusiasm about this change. We are happy to have removed cookie banners from GitHub, and not to participate in third-party tracking of user behavior. Our privacy policies and subprocessor list will be updated next week following our customary 30 day user notice period. We do this in the open in a pull request, so you can see the changes now: https://github.com/github/sit…
Earlier quoted context omitted.
Came here to say this. Eliminating Google analytics is unequivocally a good thing. A strong B+ assessment. But the blog doesn't say anything about eliminating _tracking_. Personally, I can live with analysis that's used solely for product improvement. If that's all github is doing, then the score goes up to an A. But if they're siphoning off data for any other purposes - whether passing to the mother ship or otherwis…
This is all detailed in our updated privacy policy: https://github.com/github/site-policy/pull/336
You've stopped using cookies as a mechanism for marketing/tracking. But you're still doing it by other means.
Rationale:
1. You are still tracking and may share the data with 3rd parties. Justification: privacy statement [0] line 147. It states that data are "aggregated, non-personally identified" which might mean it's GDPR compliant. OTOH: you're presumably holding the non-aggregated data for aggregation purposes in the first place. IANAL but I think that needs consent. I don't know CCPA well enough to comment.
2. The sub-processors statement [2] says this includes Google (and Google Analytics specifically), LinkedIn and Eloqua (marketing analytics firm) among others.
3. Cookies and - possibly? - other client-side technologies are only used for running and improving the service. Justification: Line 238 in the privacy statement. (There's a typo in there btw: "complie" should be "compile" I think).
3. You respect DNT - line 244. Which, presumably, means you do not track user behaviour on any sites other than github? i.e. those in which you are a 3rd party.
4. However, the privacy statement line 31 [1] states: "GitHub may also collect User Personal Information from third parties." Interpretation: whilst you're not collecting 3rd party personal information using cookies, you are (or "may") do so through other means.
[0]: https://github.com/github/site-policy/pull/336/commits/fe1b6...
--
EDIT: clarified GDPR point.
[1]: https://github.com/github/site-policy/pull/336/commits/79a99...
[2]: https://github.com/github/site-policy/pull/336/commits/e98e3...
Earlier quoted context omitted.
if you agree to terms which request consent, you are giving consent. how they are displayed to you and whether or not they are explicit enough or too hidden is subjective you'll need a stronger arsenal than a content blocker to avoid modern fingerprinting, legal or otherwise
Mentioning user tracking in a TOS or privacy policy that is mandatory to accept in order to use the service is no longer legal. This article may help you understand what consent means under GDPR: https://www.privacypolicies.com/blog/gdpr-consent-examples/#...
There could be a standard header such as cookie-privacy-policy which would point to url containing the policy in standadrd format (html?) and the browser could show it in standard way (by user's settings). Personally I would be happy with just a little "privacy policy" icon in url bar, similar to https lock icon and reader view icon (in Safari).
Earlier quoted context omitted.
Mentioning user tracking in a TOS or privacy policy that is mandatory to accept in order to use the service is no longer legal. This article may help you understand what consent means under GDPR: https://www.privacypolicies.com/blog/gdpr-consent-examples/#...
it will appear legal if it is worded correctly, just the right side of ambiguity, proofread by a dozen lawyers and backed by a multi-million dollar body also, to contradict your own tangential claim (from your non-authoritative link): "You _should_ ask for consent where you are offering a genuine choice over a non-essential service. Typical examples include: -Using tracking/advertising cookies" this document may help…
And there is no room for ambiguity in the actual law:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%...
> Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.
Earlier quoted context omitted.
The pricing page [1] is linked further down, and from the sitemap at the bottom of the page. You have a point they should have made it more obvious though. https://usefathom.com/pricing
Thanks. Looks like they're only targeting large websites. I've never build a 100k/month traffic website, just lots of (maybe 300+) mom and pop websites. Wish there was a $12/yr plan for websites that are lucky to get 500 visits a month.
But I agree, it'd be nice with a smaller option.
Earlier quoted context omitted.
This would be woefully inaccurate for websites with a large amount of mobile traffic (because of CGNAT), or university traffic, or etc.
Don't universities have a huge number of IPs because they were the first to use internet ? Mine gives one public ipv4 per device that access the internet on the network (with some exceptions). Strategies varies but if you have a lot of addresses why not use them.
Earlier quoted context omitted.
Mentioning user tracking in a TOS or privacy policy that is mandatory to accept in order to use the service is no longer legal. This article may help you understand what consent means under GDPR: https://www.privacypolicies.com/blog/gdpr-consent-examples/#...
it will appear legal if it is worded correctly, just the right side of ambiguity, proofread by a dozen lawyers and backed by a multi-million dollar body also, to contradict your own tangential claim (from your non-authoritative link): "You _should_ ask for consent where you are offering a genuine choice over a non-essential service. Typical examples include: -Using tracking/advertising cookies" this document may help…
Not being able to get implicit consent by hiding some terms in a long legal document is the entire fucking point of the GDPR.
Somehow the rest of the internet was sold to the idea of "EU is forcing you to put cookie banners, these are nothing but annoyance" rhetoric. Whoever pulled that off, bravo! In reality, the idea was to make people aware that they are being tracked across the web and and give them options and somehow everyone pretended that "No tracking, no banners" is not an option. I am so glad that GitHub is coming forward and poin…
I think you mean "you don't need cookie banners if you have your own identifier" which they certainly do and affords them the luxury of this blog post.