> GitHub Pages and the GDPR: IP address logging by GitHub, transfers to the United States, whether consent is needed and how to host a static site compliantly. > > Canonical: https://www.flowconsent.com/en/services/hosting/github-pages Hosting # GitHub Pages Unclassified GitHub Pages is a free static site hosting service provided by GitHub (a Microsoft subsidiary) that serves websites directly from a GitHub repository. The hosting platform itself sets no tracking cookies and requires no user consent by default. However, IP addresses are logged on US-based GitHub infrastructure, and any third-party scripts added to the site (analytics, chat, advertising) will require their own consent handling under GDPR. [Block GitHub Pages until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=hosting) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Hosting](https://www.flowconsent.com/en/services/hosting) - Consent Unclassified - Prior consent Not required - Documented cookies 1 - Third-party domains 3 - Servers United States (GitHub/Microsoft Azure infrastructure, fastly CDN) Overview ## What does GitHub Pages do? ## **What is GitHub Pages?** GitHub Pages is a free static website hosting service offered by GitHub, which is owned by Microsoft. It allows developers and organisations to publish websites directly from a GitHub repository, supporting static HTML, CSS, and JavaScript as well as sites built with Jekyll or other static site generators. GitHub Pages is widely used for open-source project documentation, developer portfolios, and small business websites. The platform serves content via GitHub's global CDN infrastructure, which is based primarily in the United States and operated by Fastly. ## **What data does GitHub Pages collect?** GitHub Pages itself sets no tracking cookies on visitors. The hosting infrastructure collects standard server-side access logs including visitor IP addresses, request timestamps, browser user agents, and pages accessed. This data is processed by GitHub on US-based infrastructure and is subject to GitHub's privacy policy. If the website hosted on GitHub Pages includes third-party scripts such as Google Analytics, a live chat widget, or advertising tags, those third parties will collect additional data and set their own cookies, requiring separate consent handling. ## **GDPR implications** GitHub Pages has a relatively simple GDPR compliance profile. The platform processes IP addresses as server-side access logs, which is standard for any web hosting service and can rely on legitimate interest under GDPR Article 6(1)(f) for network security and infrastructure management. No consent banner is required for the hosting platform itself. The main GDPR considerations are the US data transfer (GitHub is a US company subject to FISA 702 and other US surveillance laws) and the disclosure obligation to inform visitors of the hosting provider in the privacy policy. ## **Consent requirements** GitHub Pages itself does not require a cookie consent banner. Consent is only required if additional third-party scripts or cookies are loaded on the site. Organisations hosting on GitHub Pages should audit all scripts included in their site and determine which require consent. Common scripts that require consent include Google Analytics, Facebook Pixel, Intercom, Hotjar, and any advertising or retargeting tools. The GitHub Pages hosting itself can be disclosed in the privacy policy without a separate consent mechanism. ## **Data transfers outside the EU** GitHub is a Microsoft subsidiary headquartered in the United States. Server access logs including IP addresses are processed on US-based infrastructure. GitHub's Data Processing Agreement and Standard Contractual Clauses apply for EU customers under GDPR. Organisations should reference GitHub's DPA in their Records of Processing Activities and disclose GitHub as a hosting provider and data processor in their privacy policy. ## **Practical compliance steps** To use GitHub Pages compliantly: disclose GitHub as your hosting provider in your privacy policy, describing the server-side IP logging and US transfer; reference GitHub's SCC-based DPA as the transfer safeguard; audit all third-party scripts on your site and implement a consent management platform for any non-essential cookies; document GitHub as a processor in your RoPA; and consider whether your site collects personal data through forms or user interactions that require additional GDPR measures beyond the hosting layer. Compliance ## GitHub Pages and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) for server-side access logging. GitHub Pages itself sets no tracking cookies by default. If custom analytics or third-party scripts are added to the site, those require consent under the ePrivacy Directive. - Risk level low - Applicable regulations GDPR, ePrivacy Directive, UK GDPR ### Impact assessment (DPIA) A DPIA is generally not required for basic GitHub Pages deployments. The risk profile is low as the platform sets no tracking cookies and collects only server-side access logs. A DPIA may become relevant if the site hosted on GitHub Pages processes large volumes of personal data through forms, user accounts, or third-party integrations. ### Sample text for your banner > This website is hosted on GitHub Pages (GitHub Inc., a Microsoft subsidiary). GitHub logs server access data including your IP address on US-based infrastructure. No tracking cookies are set by the hosting platform itself. Any additional services on this website are listed separately in our cookie policy. Cookies and trackers ## What GitHub Pages sets and contacts - Tracking method Static file hosting via GitHub CDN, server-side IP logging, optional Jekyll or custom build toolchain - Server location United States (GitHub/Microsoft Azure infrastructure, fastly CDN) - Cookieless mode available Yes - Data transferred outside the EU GitHub Pages is hosted by GitHub (a Microsoft subsidiary) on US-based infrastructure with global CDN distribution. Server logs including visitor IP addresses are processed in the United States. GitHub's DPA and Standard Contractual Clauses apply for EU customers. ### Cookies set (1) | Name | Type | Duration | Purpose | | ---------- | ------- | -------- | ------------------------------------------------------------------------------------------------------------- | | \_gh\_sess | session | Session | GitHub session cookie set only when visitors access github.com directly, not set by GitHub Pages hosted sites | ### Third-party domains contacted (3) - `github.io` - `pages.github.com` - `github.github.com` Questions ## Frequently asked questions about GitHub Pages Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does GitHub Pages set cookies? No. GitHub Pages itself does not set any tracking cookies. The hosting infrastructure only processes server-side access logs. If your site includes third-party scripts (analytics, chat, advertising), those tools set their own cookies and require separate consent handling. ### Does GitHub Pages require a GDPR consent banner? Not for the hosting itself. GitHub Pages does not set cookies, so no consent banner is required for the platform. However, if your site loads third-party scripts that set cookies or track users, those require a consent management platform. The hosting provider should still be disclosed in your privacy policy. ### What is the legal basis for using GitHub Pages? Legitimate interest under Article 6(1)(f) GDPR applies to the server-side IP address logging inherent to any web hosting service. This is standard infrastructure processing necessary for network security and site operation. No separate consent is required for this processing, but it must be disclosed in your privacy policy. ### Does GitHub Pages transfer data outside the EU? Yes. GitHub is a Microsoft subsidiary based in the United States. Server access logs including IP addresses are processed on US-based infrastructure covered by GitHub's Data Processing Agreement and Standard Contractual Clauses. This transfer should be documented in your Records of Processing Activities. ### Do I need a DPIA for GitHub Pages? Generally no, for basic static site hosting. The risk profile is low since no tracking cookies are set and only standard server access logs are collected. A DPIA may become necessary if your GitHub Pages site processes substantial personal data through forms, user authentication, or integrated third-party services. ### How do I make my GitHub Pages site GDPR compliant? Disclose GitHub as your hosting provider in your privacy policy with a description of the IP logging and US transfer. Reference GitHub's SCC-based DPA. Audit all third-party scripts on your site. Implement a consent management platform for any analytics or tracking tools. Ensure any contact forms have appropriate privacy notices. Document GitHub in your RoPA as a hosting processor. ### Are there EU-hosted alternatives to GitHub Pages? Yes. GitLab Pages can be deployed on self-managed GitLab instances hosted in the EU. Netlify and Vercel both offer EU region deployments for static sites. Cloudflare Pages has EU data processing options. For full data sovereignty, self-hosted static site servers on EU infrastructure (OVHcloud, Hetzner) eliminate all third-country transfer concerns. ### How do I disclose GitHub Pages in my privacy policy? Add a section covering your web hosting provider. State that your website is hosted on GitHub Pages (GitHub Inc., a Microsoft subsidiary, San Francisco CA USA), that GitHub processes server access logs including visitor IP addresses, that the legal basis is legitimate interest for infrastructure security, that the transfer to the US is covered by Standard Contractual Clauses under GitHub's DPA, and provide a link to GitHub's privacy policy at docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement. Same category ## More services: Hosting [See the whole category](https://www.flowconsent.com/en/services/hosting) ### [Amber](https://www.flowconsent.com/en/services/hosting/amber) [Amber is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Amber supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Amber ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/hosting/amber) [Hosting](https://www.flowconsent.com/en/services/hosting/amber) · ### [Glitch](https://www.flowconsent.com/en/services/hosting/glitch) [Glitch is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Glitch supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Glitch ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/hosting/glitch) [Hosting](https://www.flowconsent.com/en/services/hosting/glitch) · ### [Windows Server](https://www.flowconsent.com/en/services/hosting/windows-server) [Windows Server is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Windows Server provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Windows Server ensures optimal performance at scale.](https://www.flowconsent.com/en/services/hosting/windows-server) [Hosting](https://www.flowconsent.com/en/services/hosting/windows-server) · ### [Brimble](https://www.flowconsent.com/en/services/hosting/brimble) [Brimble is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Brimble integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Brimble helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/hosting/brimble) [Hosting](https://www.flowconsent.com/en/services/hosting/brimble) · ### [Tiiny Host](https://www.flowconsent.com/en/services/hosting/tiiny-host) [Tiiny Host is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Tiiny Host provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Tiiny Host ensures optimal performance at scale.](https://www.flowconsent.com/en/services/hosting/tiiny-host) [Hosting](https://www.flowconsent.com/en/services/hosting/tiiny-host) · ### [Google Cloud](https://www.flowconsent.com/en/services/hosting/google-cloud) [Google Cloud is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Google Cloud provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Google Cloud ensures optimal performance at scale.](https://www.flowconsent.com/en/services/hosting/google-cloud) [Hosting](https://www.flowconsent.com/en/services/hosting/google-cloud) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)