GitHub’s latest transparency report covers activity from January through December 2022, tracking everything from government requests for user data to DMCA takedowns and appeals. The report is the ninth in a series that aims to give developers a clear picture of how the platform handles content moderation and legal pressures on user information.

The company says it continues to follow the Santa Clara Principles on Transparency and Accountability in Content Moderation and the United Nations’ guidance on platform content regulation. To that end, GitHub open-sources its site policies, notifies users when content is restricted, publishes DMCA and government takedown requests in real time, and offers an appeal process. New this year, GitHub is also releasing structured data files for the transparency report itself, with plans to gradually backfill data from previous years.

GitHub’s approach to content removal is deliberately narrow. It aligns its Acceptable Use Policies with international human rights law restrictions such as hate speech, gives users a chance to fix or remove specific content before a whole repository is blocked, and uses geoblocking to restrict content only where it is illegal rather than removing it worldwide. When it comes to alleged copyright circumvention under Section 1201 of the US DMCA or similar laws, GitHub says it reviews both legal and technical claims carefully and sponsors a Developer Defense Fund to support developers facing legal challenges to their code.

Requests to disclose user information

In 2022, GitHub received and processed 432 requests to disclose user information, up from 335 in 2021. That total breaks down as follows:

  • 274 subpoenas (265 criminal or from government agencies; 9 civil)
  • 97 court orders
  • 22 search warrants
  • 39 cross-border data requests (discussed separately below)

The figures represent every request received, regardless of whether GitHub disclosed information. The one exception: national security letters and orders, where GitHub is legally barred from stating exact numbers.

The vast majority of requests (97.9%) came from law enforcement or government agencies; the remaining 2.1% were civil requests from litigants seeking information about another party.

Pie chart showing the different types of legal requests for user information processed: criminal or government agency subpoena (61.3%; 265 requests), criminal court order (22.5%; 97 requests), cross-border request (9.03%; 39 requests), criminal search warrant (5.09%; 22 requests), and civil subpoena (2.08%; nine requests).

Disclosure and notification rates

GitHub did not disclose information in response to every request. Some were too vague and were withdrawn after GitHub asked for clarification; others were overly broad and were narrowed. When GitHub does disclose information, it never shares private content — such as content in private repositories — except in response to a search warrant. For all other request types, it limits disclosures to non-content data, which covers basic account info like usernames and email addresses, metadata about account usage, and log data.

Of the 432 requests, GitHub disclosed information in response to 350: 250 subpoenas (244 criminal, 6 civil), 77 court orders, and 22 search warrants. Those disclosures affected 2,363 accounts.

Pie chart showing the user information disclosed by different types of legal requests: criminal or government agency subpoena (69.7%; 244 requests), criminal court order (22%; 77 requests), criminal search warrant (6.29%; 22 requests), civil subpoena (1.71%; 6 requests), and cross-border (0.286%; 1 request).

Table showing the number of total requests for disclosure of user information processed (432), accounts affected (2,363), total requests where information was disclosed (350), and percentage of requests where information was disclosed (81%).

GitHub notifies users when it discloses their information, unless a law or court order prohibits it. In practice, gag orders are common: of the 350 disclosures, users were notified only six times. Gag orders applied in 342 cases, and the remaining two were handled under exigent circumstances, where GitHub delayed notification to prevent death or serious harm or because of an ongoing investigation.

Combined bar chart of user notifications of legal request disclosures broken out by notification sent, gag order (no notification sent), and exigent circumstances (also no notification sent) over time. The 2022 bar shows 342 gag orders, 6 notifications, and 2 exigent circumstances. Note: prior to 2021, we tracked exigent circumstances requests as part of requests where we disclosed but could not notify.

The rising share of requests with gag orders correlates with the rising share of criminal requests processed — law enforcement often asserts that notification would interfere with an investigation. Civil matters, by contrast, are usually public record and the target is often a party to the litigation, so gag orders are rare there. In 2022, only one of the six civil requests carried a gag order, meaning GitHub notified the affected users in all but that one case.

The link between civil request volume and notification ability is consistent with past years:

  • 2.7% notified / 2.4% civil requests in 2021
  • 3.3% notified / 3.0% civil requests in 2020
  • 3.7% notified / 3.1% civil requests in 2019
  • 9.1% notified / 11.6% civil requests in 2018
  • 18.6% notified / 23.5% civil requests in 2017
  • 20.6% notified / 8.8% civil requests in 2016
  • 41.7% notified / 41.7% civil requests in 2015
  • 40% notified / 43% civil requests in 2014

National security requests

GitHub is highly limited in what it can disclose about national security letters and Foreign Intelligence Surveillance Act (FISA) orders, so it reports these figures in ranges of 250, starting at zero. For July to December 2022, GitHub reports it received 0–249 national security notices affecting 250–499 accounts.

Table of national security and orders received (0-249) and affected accounts (250-499).

Foreign government requests

GitHub received 40 requests directly from foreign governments in 2022, up from 18 requests from five countries in 2021. Requests came from 12 countries: Argentina (1), Brazil (4), Bulgaria (1), Estonia (1), France (4), India (22), Republic of San Marino (1), Spain (1), Switzerland (1), and Ukraine (1).

For each of these requests, GitHub referred the government to the US Department of Justice (DOJ) to use the mutual legal assistance treaty (MLAT) process, consistent with the Guidelines for Legal Requests of User Data. When the DOJ subsequently sends a subpoena, court order, or search warrant, GitHub processes it like any other US government request. None of the legal requests processed in 2022 originated as cross-border requests.

Government takedown requests

GitHub received six government takedown requests from Russia in 2022, none of which resulted in a takedown. This is a substantial drop from 2021, when GitHub processed 26 takedowns affecting 69 projects from Russia, China, and Hong Kong.

An additional six requests from governments asked GitHub to remove content as a Terms of Service violation in 2022, affecting 17 accounts, 15 repositories, and seven GitHub Pages sites. These requests concerned misinformation (Australia) and GitHub Pages violations (Russia).

When GitHub does take down content at a government's request, it aims to limit the block to the jurisdiction(s) where the content is illegal and publishes the official request in the public government takedown repository. Before acting, GitHub confirms the request came from an official government agency, that an official sent an actual notice identifying the content, and that the official specified the source of illegality in that country.

Structured data files for government takedown requests are available in the transparency data repo.

DMCA takedown notices

Most content removal requests GitHub receives are submitted under the Digital Millennium Copyright Act (DMCA). GitHub's DMCA Takedown Policy is designed to limit disruption for legitimate projects. When a valid notice alleges that only part of a repository is infringing, or alleges circumvention of a technical protection measure, GitHub first gives users a chance to address the specific claims. If the user removes or remediates the identified content, no content needs to be disabled.

Each valid takedown notice is redacted to remove personal information and posted to the public DMCA repository. GitHub does not currently track how many incomplete or insufficient notices it receives.

Notices processed and content restored

In 2022, GitHub received and processed 2,321 valid DMCA takedown notices. It also processed 36 valid counter notices, one reversal, and seven retractions — 44 notices in total that resulted in content being restored. GitHub received no notice of legal action filed related to a DMCA takedown request during this reporting period.

Table of DMCA notice totals by number of takedown notices and counter notice reversals (2,321), counter notices, retractions, and reversals (44), and notices of legal actions filed (0).

Content taken down can be restored through:

  • Counter notice: the person whose content was removed submits information alleging the takedown was a mistake or misidentification.
  • Retraction: the party who filed the takedown withdraws the request.
  • Reversal: GitHub later receives information that invalidates a seemingly complete takedown request and reverses its original decision.

Monthly totals for takedown notices ranged from 134 to 267; counter notices, retractions, and reversals combined ranged from zero to eight per month.

Combined bar chart of DMCA takedown notices processed and retractions, reversals, and counter notices processed by month.

Projects affected

A single takedown notice can cover multiple projects — repositories, gists, and GitHub Pages sites. In 2022, GitHub took down 25,501 projects and reinstated 114, meaning 25,387 stayed down. Monthly reinstatement totals ranged from zero to 58 projects, with counter notices, retractions, and reversals making up from less than one to more than five percent of monthly DMCA notices.

That 25,387 figure is less than 0.02% of the more than 200 million repositories on GitHub in 2022. It also includes projects still up after a user made changes in response to a notice; because the reported content stayed down, those projects are counted in "stayed down" even if the rest of the project remains visible.

Combined bar chart of DMCA projects taken down and reinstated by month.

Circumvention claims

GitHub looks separately at takedown notices alleging circumvention of a technological protection measure under section 1201 of the DMCA. These notices require additional information to be complete and actionable, as detailed in the circumvention claims section of the DMCA Takedown Policy.

By searching processed notices for relevant keywords, GitHub estimates that 365 of the 2,321 notices processed in 2022 — 15.7% — related to circumvention. The proportion has increased significantly since 2021:

  • 2022: 365 notices, 15.7%
  • 2021: 92 notices, 5%
  • 2020: 63 notices, 3%
  • 2019: 49 notices, 2.78%
  • 2018: 33 notices, 1.83%
  • 2017: 25 notices, 1.81%
  • 2016: 36 notices, 4.74%
  • 2015: 18 notices, 3.56%

Pie chart breaking out takedown notices received by copyright infringement only (84.3%; 1,956 notices) and circumvention (15.7%; 365 notices).

GitHub says it is exploring what led to this uptick and points readers to its DMCA repository, which can be analyzed using a Codespace pre-configured with Jupyter.

DMCA notice volume has generally tracked repository growth over recent years, and 2022 continued that trend: GitHub processed more notices affecting more projects than in 2021. The number of notices processed per month increased by roughly 1.7 on average, while projects taken down increased by 24 per month on average, excluding youtube-dl and one other outlier.

Chart of DMCA takedown notices processed as compared to projects affected over time, grouped by calendar year half. 2022 saw 25,387 projects affected by 2,321 notices. The number of notices processed in 2022 is greater than it was in previous periods. The number of projects affected is greater than it was in previous periods, with the exception of 2020.

Chart of DMCA takedown notices processed as compared to projects affected over time, grouped by month. The number of projects affected per month generally increases with the number of takedown notices per month, with a couple of outliers in September 2015 and October 2020.

Chart of DMCA takedown notices processed by month over time, with regression line showing increase of roughly 1.7 takedowns per month.

Chart of projects taken down due to DMCA takedown processed by month over time, with regression line showing an increase of 24 takedowns per month, excluding outliers in October 2020 and September 2015.

Automated detection of abusive content

GitHub uses automated scanning with the PhotoDNA tool to detect child sexual exploitation and abuse imagery (CSEAI) and terrorist and violent extremist content (TVEC), based on robust hash matching. The process includes human review to confirm initial detections, and users can appeal automated content moderation decisions.

In 2022, out of millions of images scanned, automated detection confirmed one account with CSEAI, which was reported to the National Center for Missing & Exploited Children (NCMEC). No scanned images contained TVEC. GitHub separately made six additional CSEAI reports to NCMEC based on other staff action.

Reinstatements and Appeals

Reinstatement is a core part of fairness on the platform. These actions undo earlier enforcement—such as disabling a repository, hiding an account, or suspending access—that was taken in response to a Terms of Service violation. While some reinstatements follow a formal appeal, many happen after a user removes violating content and commits to future compliance. This section covers reinstatements related to abuse (violations of Acceptable Use Policies, excluding spam, phishing, and malware) and trade controls.

Structured data for this section is available in the appeals and other reinstatements folder of the transparency data repo.

GitHub’s enforcement approach aims to restrict content in the narrowest way possible. When possible, a single repository is disabled instead of acting on the whole account. At the account level, enforcement may involve hiding a user's content while preserving their ability to log in, or restricting repository owner access while still letting others view shared content—a critical option for collaborative projects.

In 2022, GitHub hid 12,860 accounts and lifted the hide for 480. Access restrictions for repository owners were placed on 428 accounts and reinstated for 58. Both actions (hiding and restricting) were applied to 8,822 accounts, with full reinstatement for 115 and partial reinstatement for 25. At the project level, 4,507 repositories were disabled, with six later reinstated. DMCA-related actions are excluded from these figures.

Table showing the number of total restrictions and reinstatements for account hidden (12,860 restricted; 480 reinstated), account access restricted (428 restricted; 58 reinstated), account hidden and access restricted (8,822 hidden and restricted; 115 full reinstated; and 25 partially reinstated), projects disabled (4,507 disabled; six re-enabled).

Pie chart breaking out aggregated abuse-related restrictions and reinstatements by outcome: 23,175 remaining restricted (97.2%), 653 reinstated (2.74%), and 25 partially reinstated (0.105%).

Trade Controls Compliance

GitHub is not fully available in regions subject to US sanctions (Crimea, Donetsk and Luhansk separatist regions, Cuba, Iran, North Korea, and Syria). The company continues to advocate for broader access, citing the January 2021 license that made all services available to developers in Iran. Similar efforts are ongoing for Crimea and Syria, while Cuba has general access except for denied or blocked parties under US law.

Trade control restrictions differ from abuse actions in that they must always be applied at the account level. Appeals are possible, and accounts are frequently restored—for instance, when a user was only temporarily traveling to a restricted region or was flagged incorrectly. In 2022, 763 appeals were filed against trade-control-related restrictions, down from 1,504 in 2021. Of those, 603 were approved, 153 denied, and seven required more information. Another 212 appeals were excluded because the filers were not actually subject to trade controls.

Pie chart breaking out trade control appeal by outcome: approved (76.2%; 397 appeals), denied (22.6%; 118 appeals), and more information requested (1.15%; six appeals).

Appeals by region ranged from 253 for Crimea to 20 for the Luhansk People’s Republic. In 223 cases, the region could not be determined and was marked as “Unknown.”

Table showing the outcome of trade control appeals by region. Crimea: 251 approved, 38 denied, one other action taken. Donetsk People’s Republic: 96 approved, 72 denied, one other action taken. Luhansk People’s Republic: 20 approved, 18 denied, one other action taken. Syria: 224 approved, 25 denied, two other action taken. Unknown: 223 approved, 0 denied, two other action taken.

EU Monthly Active Users

Per the Digital Services Act, GitHub will now publish semi-annual figures for average monthly active users in the European Union. For the period from August 2022 through January 2023, that number was approximately 10-11 million. Structured data is available in the EU average monthly active users folder of the transparency repo.

Outlook

Transparency reporting gives developers insight into content moderation decisions and supports the broader goals of protecting free expression and limiting unnecessary data disclosure. GitHub intends to continue publishing these reports and invites suggestions for future additions via the site policy repository.