A Year of Unprecedented Demand
GitHub’s latest transparency report covers a year shaped by extraordinary external events. The global pandemic, social justice movements, and election cycles all left their mark on platform activity. Reports of hate speech and discriminatory content saw an uptick, often tied directly to movements like Black Lives Matter and the political climate in the US, as well as the renaming of the default branch of GitHub repositories. In anticipation of the 2020 elections and the onset of COVID-19, GitHub also introduced a new restriction on misinformation and disinformation in its Acceptable Use Policies.
While this policy was applied in very few cases, it did lead GitHub to contact repository owners in a few instances to request clarification or disclaimers, such as with respect to do-it-yourself respirators. Hacktoberfest also proved notable for enforcement teams, as a third-party video at the start of October triggered a massive uptick in reports, particularly for spam and behavior disrupting others’ experiences.
A Focus on Developer Rights
Content moderation is a delicate balance. To that end, GitHub continues to align its policies with international human rights law and the UN’s recommendations on platform content regulation. The company emphasizes minimizing disruption to software projects and restricting content as narrowly as possible. This means offering users the chance to remediate specific content rather than blocking entire repositories, and using geoblocking to restrict access only in jurisdictions where content is illegal rather than removing it globally.
Before removing content for alleged circumvention of copyright controls (under Section 1201 of the US DMCA or similar laws), GitHub says it carefully reviews both legal and technical claims. It also gives users the option to seek independent legal advice funded by GitHub. Policy development itself is open sourced, so users can track changes and provide input. All DMCA and government takedown requests are posted publicly in real time in a public repository.
Transparency is vital given the potential impacts on privacy, access to information, and the ability to dispute decisions affecting user content. GitHub has published these reports since 2014 to inform the developer community about content moderation and disclosure of user information.
New Reporting for 2020
Copyright-related takedowns remain particularly relevant to GitHub because so much content is software code eligible for copyright protection. Still, only a tiny fraction of repositories—under two in ten thousand—are subject to a DMCA notice. This year’s report expands transparency into several new areas:
- DMCA takedowns based on alleged circumvention of a technical protection measure.
- For legal requests for user information, a breakdown by type for requests where information was disclosed, not just requests received.
- Account and content reinstatement, including due to appeals, related to Acceptable Use Policies violations. Previously this data was part of DMCA counter notices only.
- Appeals of account restrictions due to trade sanctions laws—a brand new category in 2020, expected to decline in 2021 after GitHub’s January announcement of a new license to offer services for developers in Iran.
The Numbers Behind the Requests
The report details statistics across four main categories. For requests to disclose user information, GitHub tracks subpoenas, court orders, search warrants, national security letters and orders, and cross-border data requests. Government requests to remove or block content are classified as either under local law or under the company’s Terms of Service. DMCA takedown notices are divided between content that allegedly infringes copyright and content that allegedly circumvents a technical protection measure. Finally, appeals data covers both Acceptable Use Policies violations and trade sanctions compliance.
Throughout, the emphasis remains on developer education and clear communication. GitHub seeks to notify users when content needs to be restricted and to provide the reasons when possible. Users retain the ability to appeal removals, and the company continues to explain its reasoning for policy decisions. As always, the full terminology and definitions used in the report are available in the GitHub Glossary.
Information Disclosure Requests: How GitHub Responded
GitHub’s policy for handling legally authorized requests for user data is outlined in its Guidelines for Legal Requests of User Data. The company states that it adheres to the law and requires the highest legal standards for such requests. The types of legal instruments used to compel data disclosure vary in their review requirements. Subpoenas and national security letters, for instance, do not require judicial review, while search warrants, court orders, and national security orders do require approval from a judge or magistrate (such as the Foreign Intelligence Surveillance Court).
GitHub categorizes the types of information it will release based on the legal standard met. A subpoena is required for basic account information like a name, email address, or IP address. A court order or search warrant is necessary for all other data, including user access logs and private repository content. The company notifies affected users about requests for their information unless prohibited by law or a court order.
Request Volume and Processing
In 2020, GitHub fielded 303 requests to disclose user information, up from 261 in 2019. These requests broke down into 155 subpoenas (134 criminal, 21 civil), 117 court orders, and 23 search warrants, with eight of these requests originating as cross-border data requests. The vast majority (93.1%) of these requests came from law enforcement, with the remaining 6.9% from civil litigants.
This count includes all requests for user information, even those that led to no disclosure. The only exception is national security letters and orders, for which GitHub is legally barred from confirming receipt or volume.
Disclosure Rates and Impacted Accounts
After vetting each request, GitHub did not disclose information in all cases; some requests were withdrawn after clarifying questions or were narrowed in scope. When GitHub does share information, it never provides private content data (e.g., repository contents) unless responding to a search warrant. Non-content data shared in response to other request types includes basic account information, metadata, and log data.
Of the 303 processed requests, GitHub produced information for 206 of them: 133 subpoenas (120 criminal, 13 civil), 52 court orders, and 21 search warrants.
These 206 disclosures affected 11,909 user accounts. A significant concentration was tied to a few large-scale log requests: 12 requests account for 11,309 of these accounts, and three of those requests each affected over 9,000 accounts. For the remaining 291 disclosures, the impact was roughly two accounts on average.
Large requests often concern access to a specific piece of content or a shared IP address rather than individual targets. In these cases, GitHub aims to minimize the data produced. For instance, it may hash data or limit the information disclosed to usernames, IP addresses, and log metadata (user agent, URL path, referrer) associated with access from a specific IP address or to a specific URL. These accounts are labeled "minimally affected" because no broader personal information, such as contact details, membership, or browsing history outside those log entries, is shared.
User Notification and Gag Orders
GitHub typically informs users when their data has been disclosed in response to legal requests, unless a court order (a gag order) prohibits it. In 2020, GitHub was able to notify users in only 14 of the 206 disclosure instances; the remaining 192 requests included gag orders.
The high rate of gag orders correlates with the number of criminal requests, as law enforcement often asserts that notification would impede an investigation. In contrast, civil requests usually don't involve such secrecy, and all civil requests processed in 2020 resulted in user notifications (6.9% of all requests). This reflects a historical trend where the ability to notify users closely tracks the percentage of civil requests:
- 3.7% notified and 3.1% civil requests in 2019
- 9.1% notified and 11.6% civil requests in 2018
- 18.6% notified and 23.5% civil requests in 2017
- 20.6% notified and 8.8% civil requests in 2016
- 41.7% notified and 41.7% civil requests in 2015
- 40% notified and 43% civil requests in 2014
National Security and Cross-Border Requests
Reporting on national security letters and Foreign Intelligence Surveillance Act (FISA) orders is strictly limited by US Department of Justice guidelines, which permit aggregate reporting only in ranges of 250. In 2019, GitHub could only confirm receiving 0–249 such notices, affecting 0–249 accounts.
For requests originating from foreign governments, GitHub directs those governments to the US DOJ to assess compliance with US legal protections, typically via a mutual legal assistance treaty (MLAT). Once the DOJ issues a valid subpoena, court order, or search warrant, GitHub processes it like a standard US request. In 2020, two court orders were identified as originating from such cross-border requests. Separate from the DOJ channel, GitHub received eight direct requests from foreign governments (Germany and India), referring each one to the DOJ for the MLAT process, matching the volume and origin countries from 2019.
How GitHub handled DMCA requests in 2020
GitHub’s DMCA process is designed to favor developers. The company’s DMCA Takedown Policy lets copyright holders request removal of content they believe infringes, while giving the affected user an opportunity to dispute via a counter notice if the takedown was a mistake or misidentification. Before acting on a valid notice that points to only part of a repository — or any valid notice alleging circumvention of a technical protection measure — GitHub gives the user a chance to address the specific claims first. If the user removes or fixes the identified content, no content is disabled at all. Each valid notice is posted to the public DMCA repository with personal information and unreported URLs redacted. The policy also requires that submitters account for fair use.
Notices received and processed
In 2020, GitHub received and processed 2,097 valid DMCA takedown notices, plus 32 valid counter notices, two retractions, three reversals, one counter notice retraction, and one counter notice reversal — 2,136 notices total. The year also included one notice of legal action related to a takedown request. Monthly totals for takedown notices ranged from 125 to 232, while counter notices, retractions, and reversals combined ran from one to eight per month.
Content taken down can also be restored through three routes:
- Counter notice: the user whose content was removed submits sufficient information alleging the takedown was a mistake or misidentification.
- Retraction: the original filer requests withdrawal of the takedown.
- Reversal: after initially honoring a seemingly complete request, GitHub later receives information invalidating it and reverses the decision.
These same definitions apply to counter notices themselves — hence the one counter notice retraction and one counter notice reversal processed during the year.
Projects affected
A single takedown notice can target multiple projects — repositories, gists, and GitHub Pages sites. In 2020, GitHub took down 36,901 projects total. The significant spike in October traces back to a single request for youtube-dl, a project with over 12,000 forks at the time of processing (later reversed). Monthly totals for reinstated projects — via counter notice, retraction, or reversal — ranged from one to 46, representing less than one to roughly four percent of the monthly DMCA notices.
Of the 36,901 projects taken down, 120 were reinstated, leaving 36,173 considered “stayed down.” That figure is less than two one-hundredths of a percent of repositories on GitHub at the end of 2020. It’s also worth noting that many of those 36,173 projects are currently live: when a user modifies a project to address a takedown, GitHub counts it in the “stayed down” number because the reported content itself was removed, even if the rest of the project remains accessible.
Circumvention claims
New to this year’s reporting are takedown notices alleging circumvention of a technical protection measure under section 1201 of the DMCA. GitHub requires additional information for such notices to be complete and actionable. Searching processed notices for relevant keywords suggests that 63 of the 2,097 notices (3.0%) involved circumvention claims. That’s up from recent years:
- 49 or 2.78% of all notices in 2019
- 33 or 1.83% of notices in 2018
- 25 or 1.81% of notices in 2017
- 36 or 4.74% of notices in 2016
- 18 or 3.56% of notices in 2015
While circumvention-related notices have trended upward, they still represent a small slice of all takedown requests, fluctuating between roughly two and five percent over the period. Following the youtube-dl reinstatement, GitHub says it is working on better ways to track and report on circumvention data in future transparency reports.
Incomplete notices and long-term trends
The figures above cover only valid notices. GitHub also receives many incomplete or insufficient copyright complaints; those do not result in takedowns, and GitHub does not currently track how many arrive or how often users resolve issues without a formal notice.
Looking at compiled DMCA data from recent years, GitHub has seen DMCA notices grow in close correlation with overall repository growth, meaning the proportion of repositories affected by takedowns has stayed relatively steady. The pattern is clearer when the youtube-dl outlier is excluded from the dataset.
Reinstatement after enforcement
Alongside enforcement actions, GitHub also tracks when it reverses those actions. Reinstatements can occur in response to a user appeal, or when a user removes violating content and agrees to comply with the Terms of Service going forward. This year's report introduces reinstatement data for two categories: abuse-related violations and trade controls compliance.
Abuse-related reinstatements
GitHub's Acceptable Use Policies and Community Guidelines restrict discriminatory content, doxxing, harassment, sexually obscene content, incitement of violence, disinformation, and impersonation. When a violation is found, enforcement can range from disabling a single repository to acting at the account level. The approach is intended to restrict content in the narrowest way possible—disabling one project rather than an entire account when feasible. Account-level actions may involve either hiding a user's publicly posted content while leaving account access intact, or restricting the owner's access when the violation stems from interactions with other users. The latter option is important on a collaborative platform, since it leaves shared content accessible to other developers.
In 2020, GitHub hid 4,826 accounts and reinstated 415 of those. Access was restricted for 47 account owners, with reinstatement for 15. For 1,178 accounts, both hiding and access restriction were applied; 29 accounts were fully reinstated and 12 partially reinstated (one restriction lifted but not the other). At the project level, GitHub disabled 2,405 projects and reinstated four. These figures exclude DMCA-related actions, which appear in the copyright section of this report, and appeals related to spam or malware.
Trade controls compliance
US sanctions restrict GitHub's availability in Crimea, Cuba, Iran, North Korea, and Syria. GitHub states it continues to advocate for broader access; a license secured in early 2021 made all services fully available to developers in Iran, but reinstatements of affected accounts happened after the reporting period, so that change is not reflected in the 2020 numbers. Services are generally available to developers in Cuba outside of specially designated nationals, including certain government officials.
Users subject to trade-control restrictions can appeal, and GitHub works to restore accounts where legally possible—for instance, when a user was temporarily traveling in a restricted region or was flagged in error. Unlike abuse cases, trade controls always require account-level action, since the law restricts a user's access to GitHub itself.
GitHub began tracking sanctions-related appeals in July 2019. In 2020, 2,500 users appealed trade-control restrictions, compared with 1,495 in the second half of 2019. Of the 2020 appeals, 2,122 were approved, 316 denied, and 62 required further information. An additional 36 appeals were excluded from analysis because they came from users not actually subject to trade controls.
Appeals counts varied significantly by region: hundreds came from Crimea and Iran, while Cuba and North Korea saw single digits. In 104 cases, no region could be assigned from the data; these were marked "Unknown" in the table and excluded from regional totals in the chart.
Looking ahead
This year's report expands coverage to areas of particular interest to developers, including circumvention-related copyright takedowns and sanctions appeals. GitHub frames its transparency effort as part of a commitment to free expression and minimizing both data disclosure and content removal to the extent legally possible. The full policy development process is documented in the public site policy repository, and suggestions for future reports can be sent to [email protected].
