Meanwhile more and more websites are adding “legitimate interest” controls to ads and analytics, as a way to keep them activated. It’s so absurd from a user perspective, they even have separate controls for normal and legitimate interest ads.

I wouldn’t be surprised if the sales teams at Google, criteo etc told them to do so off the record.

Every time I see the banner I think is it really necessary to visit the website? So I’m also quite happy about this move by GitHub.

I think you mean "you don't need cookie banners if you have your own identifier" which they certainly do and affords them the luxury of this blog post.

That's the idea. You visit GitHub and github knows about it, not Facebook, not your local advertisement agency, not the data brokers. Also, these identifiers are not forged in the fire of Mordor, you can have your identifier too.

And add to that, they have paying customers.

I am pretty sure that they are still tracking you - but Microsoft can easily afford to do tracking in-house...

>We use Usage Information and Device Information to better understand how our Users use GitHub and to improve our Website and Service.

https://docs.github.com/en/free-pro-team@latest/github/site-...

Doing "tracking in-house" does not exempt you from GDPR requirements. The requirement is exactly the same: explicit and freely given consent is required to collect extra private information not specifically necessary to provide the service requested.

In this case, is github uncompliant now? They say they're not doing third-party tracking but the blog post seems to hint that they're doing their own tracking.

That depends on what personal data they're collecting and for what purpose, in the case that a person hasn't explicitly opted-in by giving consent freely. I don't think it's possible for us to figure those details out exhaustively merely by observation from the outside.

Yes, and it's not like the EU is going to send surprise inspections to go dig into Microsoft's code and databases to check whether they are violating this or not?

They don't send surprise inspections to your house to check if you're engaging in criminal activity, either.

My point is that you're moving the goalposts. Law enforcement generally always requires a complaint that justifies an investigation, and people and organisations get away with breaking the law all the time. However that has nothing to do with whether or not GitHub put their website behind a "consent" wall, or whether or not they're doing in-house as opposed to contracted-out analytics.

I'm not moving the goalposts. Aren't you aware that some businesses get regular inspections, which do not require any complaints?

Sure, but it's also likely that Microsoft's lawyers allowed the Github team to do this if they didn't think that Github was still in compliance.

What "private information", though? If GH is putting in a database the order of clicks that you made to navigate around their site, is that "private information"?

If there's an identifier that can be tied to you (like an IP address), then yes?

There is a lot of wiggle room in "provide the service requested"

> There is a lot of wiggle room in "provide the service requested"

There is, but it is so in any law, because laws can't be specified as precisely as computer code, and an attempt to do so would make them so rigid as to be unenforceable, and hence ignored. But it seems that companies aren't even trying to use this wiggle room, just ignoring it or plastering the damned cookie banners, so I think that it's a good thing for future privacy-oriented laws—when given even the most generous possible leeway, businesses would still rather track their users than attempt to colour within the lines.

What do you mean by in house tracking?

Across Microsoft services like Github, Office365, Bing, LinkedIn, Windows...

yes but what does it mean tracking? having an account? keeping a tab of last time you used it?

Some identifier tied to a time and "place" (service)?

To do what exactly?

Learn at what moment your defenses are down so that they can sell you stuff, presumably. Isn't that the general assumption about tracking?

Or sell your data to interested parties. Maybe if you liked certain GitHub repos, you are more likely to vote Democrat or whatever.

I'm not sure that the GDPR really cares what is being done with that information? It cares more about who that information is being shared with, and about your consent.

they are an annoyance because they are redundant, out of band, and pass the burden onto individuals who have no authority.

They are like CA Prop 65 lead warnings: useless spam that everyone ignores.

>"EU is forcing you to put cookie banners, these are nothing but annoyance" rhetoric

I came to the conclusion myself. I personally see no real need for laws like GDPR and see humanity dealing with cookie banners every day and lost ability for websites to be profitable as pure negatives.