Why GitHub Dropped Cookies: Implications for Web Privacy and GDPR

When you first log into most websites, a large banner asks for cookie consent.

Cookies are small text files stored on a user's device that help sites retain visitor information, often encrypted, to identify users and personalize interactions.

The concept originated in 1993 when Netscape employee Lou Montulli used cookies to preserve shopping‑cart history, and all browsers now support them.

Websites use cookies to improve navigation, analyze user habits, deliver personalized content, enhance social features, and support marketing; accepting them may share personal data with social networks, advertisers, and analytics partners.

On December 17, GitHub announced it would eliminate all unnecessary cookies across its platform, removing the consent banner and simplifying the user experience for new devices.

This move aligns with the EU's GDPR, enacted in May 2018, which imposes stricter data‑privacy obligations, requiring companies to explain automated decisions and assume greater responsibility for user data collection.

By dropping most cookies, GitHub no longer sends any information to third‑party analytics or advertising services. However, the site still tracks aggregate performance metrics without cookies and transmits usernames, unique IDs, device data, and visited pages to its own collector endpoint.

GitHub CEO Nathaniel Friedman explained that protecting developer privacy and eliminating intrusive cookie prompts were key motivations for this change.

While many news sites have also abandoned cookies for simplicity, GitHub’s situation is unique due to its mix of paid memberships and privacy‑focused users.

Reference: GitHub Blog – No Cookie For You