Policy Refresh and a Faster Feedback Loop

GitHub is rolling out a substantial update to its core site policies, with changes spanning the Terms of Service, Privacy Statement, and several related agreements. The revisions are designed to clarify language, align terms across documents, and account for new products and features. These updates go into effect on November 16, following a 30-day comment period.

The updated documents include the Terms of Service, Privacy Statement, Corporate Terms of Service, Enterprise Subscription Agreement, Enterprise Service Level Agreement, Acceptable Use Policies, and Community Guidelines. The discussion and revision process is happening in the open, via pull requests in the site-policy repository, where the policies themselves are maintained as open source documents.

Key Changes in the Fine Print

The bulk of the revisions fall into a few broad categories:

  • Consistent language: Terms across the main service documents and enterprise agreements have been harmonized, particularly around how users are notified of changes and how GitHub handles access to private content.
  • Clarified usage rights: The policies now explicitly state that providing the service includes using it to improve the service. Third-party contractors may also use content in connection with the Archive Program. Additionally, the inbound=outbound license model is clarified to cover issues and comments when repository changes are made in response to them.
  • Updated acceptable use rules: The Acceptable Use Policies and Community Guidelines now include provisions related to disrupting other users' experience on the platform.
  • Data and API rules: The section on information usage is clarified to cover both scraping and use of data obtained through the API.
  • New scanning terms: The policies now account for scanning for child sexual exploitation and abuse imagery, as well as terrorist or violent extremist content.
  • Service and app updates: Service level agreements have been adjusted to better reflect reliability expectations, and the terms now address third-party terms that may apply to mobile app users.

A Shift Away from Semiannual Reviews

Perhaps the most notable change is procedural. Previously, GitHub grouped policy updates into a semiannual review with a 30-day comment period. The company found that meaningful feedback tends to arrive quickly after a proposal is posted, and the extended window delayed shipping useful updates without much benefit.

Starting now, most policy proposals will be left open for just 24 hours before going into effect. However, material changes to the Privacy Statement, Terms of Service, Acceptable Use Policies, Corporate Terms of Service, and Enterprise Subscription Agreement will still carry a 30-day notice period, consistent with what those documents require. The comment process remains the same as any open source project—reviews and commentary on the pull requests are welcome at any time.

Why Open Source Policies Matter

Maintaining policies in the open provides a few distinct advantages beyond simple transparency:

  • Clear diffs: Users can review changes as tracked differences in the text, making it easy to see exactly what has been altered.
  • Collaboration: The public repository allows users to engage with and fork the documents, adapting them for reuse. All content is licensed under CC0.
  • Democratic process: The model incorporates public notice-and-comment directly into the policy development cycle.
  • Education: The project offers a non-technical entry point for policymakers and the public to engage with open source practices.

The comment window for these updates is open now and closes on November 16 at 5 pm PT. GitHub will review all submitted comments before merging the changes and putting the new policies into effect.