I just checked my cookies on the Github website and had several tracking cookies (including Google Analytics).

Then I realized I should probably clear all the cookies for Github, and start over with a fresh session. So I deleted all cookies that Github had given me (which was 12) and refreshed the page. As expected, I was now logged out and Github immediately issued you me 4 new cookies.

  • _gh_sess (a fresh session cookie)

  • _octo (not sure what this is, might have something to do with cache-busting? Looks like it contains something resembling a version id/string)

  • logged_in (my logged in status, now false)

  • tz (my timezone)

All of these are valid cookies (assuming that _octo is for cache busting) that would not require a cookie banner.

So then I logged in. I now have 10 cookies. None of them appear to be tracking cookies.

  • __Host-user_session_same_site (14 day session token)

  • device_id (this contains a random string to differentiate this device. Initially I was concerned with this, thinking it might be a fingerprint. But it is far too short for that, and it appears to be a flash cookie. It expires as soon as it is issued, so it only lasts one request. This is likely used to improve your experience in the case that you are logged in across multiple devices to differentiate which device is making a request within the current session)

  • gh_sess (same as before, session)

  • _octo (same as before, presumably cache-busting)

  • dotcom_user (contains a string with my github username)

  • has_recent_activity (boolean value, likely used to display "unseen notifications" on the front-end)

  • logged_in (same as before, except now true)

  • tz (same as before, timezone for frontend time displays)

  • tz (now have 2 timezone cookies. Both are currently the same timezone, although I assume the first one is a timezone gathered from my system clock and the new one is a timezone gathered from my github settings which they now have since I logged in. This is probably a bug where they expect to overwrite the first one, but since one is set to the github.com domain and the other is set to all github subdomains then it didn't overwrite)

  • user_session (yet another session token with 14 day expiration. However the session token in this cookie and the __Host-user_session_same_site cookie are the same. Not sure reason for the duplication)

So those are all the cookies that Github now gives you. 2 of these seem to have duplicates. Meaning the same could be done with 8 cookies instead of 10. But regardless, all cookies seem to check out. None of these are tracking your usage and are there to improve your logged in experience. Tracking things like your username and recent activity boolean are most likely being used to save making the same database queries for every request. The others are just tracking sessions, which is something that users definitely do want. The 14 day expiration is a good middle ground between convenience and security.

At the beginning I mentioned that I had two tracking cookies before I cleared my cookies. These are gone after the refresh. So it looks like github has in fact stopped issuing tracking cookies altogether. They also seem to have removed Google Analytics entirely as I don't see the script on their website at all.

So all-in-all this definitely checks out. I don't see any GDPR violations here or reason to display a cookie banner anymore.

I assume they still have analytics, but the analytics are all happening server-side which provides them basics like pageviews and visitors. And since you have to be logged in to do almost anything in github they don't need cookies to track what you do while logged in, thats all going through their servers and databases anyway.

I know plenty of people here have problems with Github, but I think it is exciting to see a large company like Github (Microsoft) take this step.