FYI, I asked an upstream maintainer about this.

Thanks. Just noting that this website seems to be similar to the issue in T7899#160971.

@Owen The maintainer claims no data is collected. Is it enough to take their word for it? If not, how else are we supposed to confirm that?

It's a github.io site. As far as data collection goes, it's going to be on GitHub's end unless something like analytics is put in the header.

You can confirm via a quick read of the html.

As mentioned above, as far as I can see (should be double checked) there's no analytics in the header and the owner claims they do not collect data. GitHub has been reviewed for the purpose of the checklist and there's no issues there. I would recommend approval as long as the header is double checked for extra analytics.

(Note: there is a cloudfront.net which part of AWS however there's no indication that any analytics are collected through that? Alternatively, AWS has already been reviewed in T7895 and that task was ultimately declined for other reasons than that AWS didn't pass the review)

In T8003#174946, @RhinosF1 wrote:

It's a github.io site. As far as data collection goes, it's going to be on GitHub's end unless something like analytics is put in the header.

You can confirm via a quick read of the html.

My understanding is GitHub owns and operates the github.io domain, for their projects' hosted GitHub Pages.

As mentioned above, as far as I can see (should be double checked) there's no analytics in the header and the owner claims they do not collect data. GitHub has been reviewed for the purpose of the checklist and there's no issues there. I would recommend approval as long as the header is double checked for extra analytics.

@Reception123 Wouldn't any domains from external trackers need to be whitelisted against the CSP as well? Or, do you mean direct GitHub, Inc.-operated analytics tools? If that, I think this is probably fine, as GitHub maintains a GDPR-compliant Privacy Policy where users can either request removal of tracking data or even opt out of tracking. Can users outside the European Economic Area and UK opt out of any ad tracking analytics?

Also, for "Does the site clarify their security measures to protect collected user data? Can the site assure measures are being taken to protect code injection into the loaded external resources? Yes, see PP"

Can you link to the specific section referenced in the privacy policy?

Thanks

In T8003#175387, @Dmehus wrote:

In T8003#174946, @RhinosF1 wrote:

It's a github.io site. As far as data collection goes, it's going to be on GitHub's end unless something like analytics is put in the header.

You can confirm via a quick read of the html.

My understanding is GitHub owns and operates the github.io domain, for their projects' hosted GitHub Pages.

As mentioned above, as far as I can see (should be double checked) there's no analytics in the header and the owner claims they do not collect data. GitHub has been reviewed for the purpose of the checklist and there's no issues there. I would recommend approval as long as the header is double checked for extra analytics.

@Reception123 Wouldn't any domains from external trackers need to be whitelisted against the CSP as well? Or, do you mean direct GitHub, Inc.-operated analytics tools? If that, I think this is probably fine, as GitHub maintains a GDPR-compliant Privacy Policy where users can either request removal of tracking data or even opt out of tracking. Can users outside the European Economic Area and UK opt out of any ad tracking analytics?

Also, for "Does the site clarify their security measures to protect collected user data? Can the site assure measures are being taken to protect code injection into the loaded external resources? Yes, see PP"

Can you link to the specific section referenced in the privacy policy?

Thanks

I don't think the analytics would need to be whitelisted separately.

Here is the security section in the PP: https://docs.github.com/en/github/site-policy/github-privacy-statement#how-github-secures-your-information

This can be approved.