Federal Trade Commission 

Privacy Impact Assessment 

Github 

May 2019 

Reviewed March 2023

1 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

SECTION 1.0 – SPECIFIC PURPOSE OF THE FTC’S USE OF APPLICATION 

1.1 – What is the specific purpose of the agency’s use of the application, and how does 

that use fit with the agency’s broader mission? 

The Federal Trade Commission (FTC or Commission) uses GitHub, a platform for sharing code 

and collaborative content, as a repository of open source code from submissions to FTC contests 

and challenges. Specifically, the FTC uses the GitHub online community built for government: 

government.github.com. Consumers do not have to be registered users of GitHub to view this 

content. 

Official FTC GitHub accounts will be denoted in the GitHub and Government community, 

registered in the federal government’s Social Media Registry, linked from the agency’s Social 

Media webpage, and otherwise promoted through other official FTC channels. FTC accounts will 

be created under an “organization” account, which enables the FTC to establish teams with special 

permissions, host a public profile, and track activity of the FTC account. 

FTC GitHub profiles and repositories will be publicly visible. Authorized FTC staff may control 

access by collaborators (users with the ability to add or edit code), open up opportunities to edit 

repositories, or approve them on an as needed basis. 

1.2 – Is the agency’s use of the application consistent with all applicable laws, 

regulations, and polices? 

Yes. 

Former President Obama’s January 21, 2009 memorandum on Transparency and Open 

Government and the OMB Director’s December 8, 2009 Open Government Directive call on 

federal departments and agencies to harness new technologies to engage with the public. Using 

tools like GitHub helps the FTC to meet the federal guidance outlined in the directive and 

memorandum including the goals of transparency, participation, and collaboration. 

With respect to the information that the FTC will disseminate through its GitHub accounts, the 

FTC Act authorizes the FTC to prevent unfair and deceptive acts and practices in interstate 

commerce and, in furtherance of this mission, to gather, compile, and make information available 

in the public interest. See 15 U.S.C. 45, 46(a), (f). 

In accordance with federal guidance, if the FTC links to GitHub accounts from an FTC website, 

the FTC will inform consumers (i.e. via an exit script) that they are leaving the FTC site and that 

the Commission’s privacy policy no longer applies. The FTC also posts a privacy notice on 

GitHub, as feasible. 

2 
 

 

 

 

 

 

 

 

 

 

SECTION 2.0 – IS THERE ANY PII THAT IS LIKELY TO BECOME AVAILABLE TO 

THE AGENCY THROUGH THE USE OF THE APPLICATION? 

2.1 – What PII will be made available to the FTC? 

The FTC may, read, review, or rely upon information that GitHub users make available to the 

public or to the FTC as authorized or required by law. The privacy impact of the FTC’s use of 

this platform is low, as the FTC does not routinely use Github to solicit, collect, maintain, or 

disseminate PII from members of the public. In specific circumstances, the FTC may collect 

limited information (e.g. usernames or handles) about members of the public (e.g., if messages 

or posts directed to the FTC or its employees on Github are deemed as threatening or violent, or 

where the content may reveal some other potential law enforcement violation). The FTC may 

also occasionally produce reports or summaries of its use of this social media platform that 

include PII posted publicly (i.e., usernames): for instance, it may do so if needed to comply with 

social media records retention guidelines from the National Archives and Records 

Administration (NARA). In such instances, the collection of PII in these summaries will be 

reduced as much as is feasible. 

2.2 – What are the sources of PII? 

The sources of PII made available to the FTC via GitHub are GitHub users who make PII 

available to the public and/or to the FTC on the platform. See also 2.1 above. 

2.3 – Do the FTC’s activities trigger the Paperwork Reduction Act (PRA) and, if so, how 

will the agency comply with the statute? 

Per the OMB memorandum, Social Media, Web-Based Interactive Technologies, and the 

Paperwork Reduction Act, the FTC’s use of GitHub as outlined in Section 1.1 does not trigger the 

PRA. 

SECTION 3.0 THE FTC’S INTENDED OR EXPECTED USE OF PII 

Section 3.1 – Generally, how will the agency use the PII described in Section 2.0? 

The FTC will use GitHub to post open source code and other content to collaborate with the public on 

GitHub. See also 2.1 above. 

Section 3.2 – Provide specific examples of the types of uses to which the PII may be subject. 

For example, the FTC used GitHub to create a repository of code for a robotics competition. When the 

competitors posted code or comments on the GitHub page, their usernames, which may identify them, 

were also included as part of their posts. See also 3.1 and 2.1 above. 

3 
 

 

SECTION 4.0 SHARING OR DISCLOSING OF PII 

Section 4.1 – With what entities or persons inside or outside the agency will the PII be 

shared, and for what purposes will the PII be disclosed? 

PII posted on the FTC’s GitHub pages is available publicly. See also 2.1 above, since in limited 

instances, PII posted on GitHub may need to be specifically provided to others at the agency, to 

other law enforcement agencies, or to NARA. 

Section 4.2 – What safeguards are in place to prevent expansion of use beyond those 

authorized under law and described in this PIA? 

Only authorized FTC staff members have administrative access to manage the FTC’s GitHub 

accounts. Each staff member responsible for managing a social media account must sign and 

comply with the Commission’s internal Rules of Behavior, prior to beginning account 

administration. 

The FTC’s GitHub accounts are registered using official FTC email accounts. Administrators 

are not permitted to use personal accounts to manage FTC GitHub accounts. Furthermore, FTC 

staff are directed to use official government devices to manage accounts when possible. 

SECTION 5.0 - MAINTENANCE AND RETENTION OF PII 

Section 5.1 – How will the FTC maintain the PII, and for how long? 

In general, this does not apply, as the FTC does not routinely use Github to solicit, collect, 

maintain, or disseminate PII from members of the public. In the limited instances in which the 

FTC does so (see 2.1 above), any PII collected will be securely stored in accordance with FTC 

policy. See, for instance, the GSS Privacy Impact Assessment. 

Section 5.2 – Was the retention period established to minimize privacy risk? 

In general, this does not apply, as the FTC does not routinely use Github to solicit, collect, 

maintain, or disseminate PII from members of the public. In the limited instances in which the 

FTC does so (see 2.1 above), any PII collected will be retained and disposed of in accordance with 

NARA’s General Records Schedule (GRS) 6.4, item 020, Public Comments and Communications 

Not Requiring Formal Action, or other records schedules that may apply. 

4 
 

 

 

 

 

 

 

SECTION 6.0 – HOW THE AGENCY WILL SECURE PII 

Section 6.1 – Will the FTC’s privacy and security officials coordinate to develop methods of 

securing PII? 

In general, this does not apply, as the FTC does not routinely use Github to solicit, collect, 

maintain, or disseminate PII from members of the public. Regarding the limited instances in 

which the FTC does so (see 2.1 above), privacy and security officials routinely coordinate to 

develop methods to secure all agency PII. 

SECTION 7.0 – IDENTIFICATION AND MITIGATION OF OTHER PRIVACY RISKS 

Section 7.1 – What other privacy risks exist, and how will the agency mitigate those risks? 

The privacy impact of the FTC’s use of this platform is low, as the FTC does not routinely use 

Github to solicit, collect, maintain, or disseminate PII from members of the public. 

GitHub, itself, is a third-party service that may use cookies or other tracking technology. In an 

effort to help consumers understand how their information is used by GitHub, the FTC posts 

notices on its GitHub accounts indicating that GitHub’s policy rather than FTC policy applies on 

the site. Furthermore, if the FTC links to GitHub accounts from an FTC website, the FTC will 

inform consumers (i.e., via an exit script) that they are leaving the FTC site and that the 

Commission’s privacy policy no longer applies. The FTC encourages members of the public to 

read GitHub’s privacy statement to understand what information GitHub may be collecting from 

them. 

SECTION 8.0 – CREATION OR MODIFICATION OF A SYSTEM OF RECORDS 

Section 8.1 – Will the FTC’s activities create or modify a “system of records” under the 

Privacy Act of 1974? 

No. The FTC does not collect PII from GitHub in a manner that would require the FTC to create 

or modify a system of records under the Privacy Act of 1974. 

5