gdpr
Is using Gists on GitHub Pages a GDPR violation?
<p>I'm using GitHub pages to serve <a href="https://mu88.github.io/" rel="nofollow noreferrer">my little blog</a>. On some posts, I'm embedding Gists to nicely render little code snippets, e. g. <a href="https://mu88.github.io/2022/07/29/Git-hook-conventional-commit.html" rel="nofollow noreferrer">here</a>:
<a href="https://i.stack.imgur.com/ygosa.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ygosa.png" alt="enter image description here" /></a></p>
<p>Now the <a href="https://privacybadger.org/" rel="nofollow noreferrer">Privacy Badger browser extension</a> reports that gist.github.com tries to set a third-party cookie that is blocked:
<a href="https://i.stack.imgur.com/cW3Ga.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/cW3Ga.png" alt="enter image description here" /></a></p>
<p>Is using Gists a problem from the GDPR's perspective?</p>
<p>Thanks in advance 👋🏻</p>

<p>You are responsible for everything that happens on your website. When you embed third party content, you're causing the personal data of your visitors to be disclosed to such third parties. This is not necessarily illegal, though.</p>
<ul>
<li><p>Either, that third party acts as your “data processor”, and is contractually bound to only use the data as instructed by you.</p>
</li>
<li><p>Alternatively, the third party acts as its own “data controller”, and you'd need a legal basis for sharing your visitor's data with this third party.</p>
</li>
</ul>
<p>What legal bases can you consider?</p>
<ul>
<li><p>There might be a <em>legitimate interest</em> for such embedding. But, this legitimate interest would have to be weighed against the rights and freedoms of your visitors, and the embedding would be necessary for that interest. Here, your interest is likely “show syntax-highlighted code snippets”. But embedding GitHub Gists is not necessary for that purpose. For example, you could also provide syntax highlighting through your site builder/CMS, or via a (self-hosted!) JavaScript library. The 2022 “Google Fonts” ruling (LG München I, 20.01.2022 - 3 O 17493/20) highlighted the general lack of a legitimate interest in such cases.</p>
</li>
<li><p>You could ask for <em>consent</em> before loading the third party content. Typically, the embedded content would be replaced by a placeholder that explains necessary information in order to obtain consent. When the visitor clicks on the placeholder to give consent, the actual content is loaded. At least in Germany, such an approach has been common for over a decade e.g. for Facebook like buttons, tweets, or YouTube videos.</p>
</li>
</ul>
<p>In your particular case, both the website and the embedded content are hosted by GitHub. Thus, it might be tempting to argue that GitHub is not a third party and that none of this matters. However, hosting the site and providing the script for embedded code snippets are separate processing activities. GitHub has <a href="https://docs.github.com/en/pages/getting-started-with-github-pages/about-github-pages#data-collection" rel="nofollow noreferrer">brief but explicit privacy commitments regarding the Pages product</a> (my <a href="https://law.stackexchange.com/a/40813">earlier answer</a> is outdated since the privacy notice was changed). I can't find comparable commitments regarding the Gists embedding script. Thus, it might indeed be appropriate to treat that script as a (potential) tracker.</p>
<p>In conclusion, it's not definitely a GDPR violation, but embedding GitHub Gists like this raises all kinds of question marks. It is likely that your blogging engine has better ways to render code snippets, and it might be worth using them simply for peace of mind. For example, the Jekyll blogging engine supports syntax highlighting by default.</p>
