Fedora Linux is a community-developed Linux distribution (Workstation, KDE Plasma, Server, Cloud, IoT, CoreOS and the Atomic Desktops such as Silverblue and Kinoite) governed by the elected-plus-appointed Fedora Council and sponsored primarily by Red Hat, Inc., which has been a unit of IBM since its 2019 acquisition; Red Hat hires the Fedora Project Leader, funds the community budget and owns the Fedora trademarks. Installing and using the OS requires no account, and the only project-originated data flow from an installed system is DNF's 'countme' installation counter — a coarse weekly age-bucket flag added to a routine repository-metadata request, designed without any UUID or machine identifier and switchable off in dnf.conf. Red Hat's 2023 proposal to add opt-out desktop telemetry to Fedora Workstation was withdrawn after community pushback and its opt-in successor was formally DROPPED, so no usage-metrics client ships. Caveats: the Fedora Privacy Statement (last amended 2018) covers Fedora accounts and websites — which set a unique audience-estimation cookie — rather than the OS; Workstation ships Firefox with Mozilla's own defaults and preinstalls disabled third-party repositories (Google Chrome, Flathub, RPM Fusion) that users can enable; and the project publishes no financial statements of its own. Fedora runs an open CVE and embargo process with Red Hat Product Security; the March 2024 xz-utils backdoor reached Fedora 40 beta and Rawhide before being reverted, and no independent third-party audit of Fedora Linux was found in this research.
TIMELINE
1 ENTRY
[2026-08-30] · NEW RECEIPTS
17 new sources on file for Fedora Linux.
Fedora Linux's file gained 17 new sourced claims since its last review.
The Fedora Project's Privacy Statement (last amended May 25, 2018; contact address 'Fedora Legal c/o Red Hat, Inc.') describes personal-data collection only in the context of Fedora's online services — it says Fedora collects personal data when a person creates a Fedora account, answers surveys, enters promotions or submits questions — and does not describe any data collection by the installed operating system itself; installing and using Fedora Linux requires no Fedora account.
Fedora's accepted 'DNF Better Counting' change (targeted at Fedora 32, owner Fedora Project Leader Matthew Miller) is the OS's installation-counting mechanism ('countme'): the proposal states the project wants to count systems rather than track them, explicitly rejects using /etc/machine-id or any UUID as an identifier, and commits to an easy opt-out — the counting rides on a weekly-reset variable attached to routine repository-metadata requests.
The follow-up 'Opt-In Metrics for Fedora Workstation' change proposal (owners Allan Day, Michael Catanzaro and the Fedora Workstation Working Group; targeted at Fedora Linux 43) — which would have deployed the Azafea metrics system with collection defaulting to off and enabled only via an on/off prompt in initial setup — carries the status DROPPED / CLOSED WONTFIX (page last updated 2026-04-12), so as of this research Fedora Workstation ships no usage-metrics client beyond countme.
Red Hat's own explainer on Fedora vs. Red Hat Enterprise Linux describes the Fedora project as the upstream community distribution of RHEL and names Red Hat as the project's primary sponsor alongside thousands of independent contributors — corroborating the 'Fedora is sponsored by Red Hat' footer on fedoraproject.org.
Red Hat's July 9, 2019 press release records that IBM closed its acquisition of all outstanding Red Hat shares for approximately $34 billion, with Red Hat operating as a distinct unit within IBM — completing the ownership chain Fedora Project → sponsor Red Hat, Inc. → parent IBM.
Fedora Legal's 'License of Fedora Linux' page states that Fedora Linux is a compilation of packages each under its own license, that since Fedora 22 the compilation itself is under the MIT license, and that included code must conform to Fedora's published license-approval guidelines — the whole OS is source-available under approved free/open licenses.
Fedora's Trademark Guidelines state that Red Hat retains and reserves all rights to the Fedora trademarks and logos, polices them on the community's behalf, and enlists the Fedora Council to oversee the guidelines — i.e., the brand is corporate-owned even though the distribution is community-governed.
Fedora's published Council charter states the Fedora Council is the project's top-level governance body, composed of elected community representatives plus named roles appointed by Red Hat; the same page states the Fedora Project Leader is hired by Red Hat with the Council's advice and consent, the Fedora Operations Architect is employed full-time by Red Hat, and the community budget comes through the Red Hat Open Source Program Office.
The Fedora Privacy Statement states that, absent consent, Fedora will not process or share personal data except in the enumerated cases: publicly-visible Fedora-account fields (which the account holder can hide), service provision and e-mail hosting, legal requirements such as subpoenas, and aggregated statistical research; it names no advertising partners or data-broker recipients.
Fedora Workstation preinstalls a set of third-party software repositories — Flathub, Google Chrome, PyCharm, and RPM Fusion's NVIDIA-driver and Steam repos — but the Workstation Working Group's documentation states they are disabled until the user enables them (via initial setup or the Software app), so any data flow to those third-party repository operators is a user choice rather than a default.
Fedora's Security Bugs page documents an open vulnerability-handling process: security bugs come from public reports in Red Hat's Bugzilla or from Red Hat Product Security responding to CVEs, embargoes are kept short, and the project states support for full public disclosure done responsibly; no independent third-party privacy or security audit of Fedora Linux was found in this research.
In March 2024 the xz-utils supply-chain backdoor (CVE-2024-3094) reached Fedora's pre-release channels: Red Hat's alert states Fedora Linux 40 (beta) users may have received xz 5.6.0 and Rawhide users 5.6.0 or 5.6.1, told Rawhide users to stop using affected instances, and reported that reverting updates were pushed through the normal update system; no stable Fedora release was affected and no Fedora-held user data was breached.
Fedora's Security SIG documentation states the SIG was founded after the 2024 XZ Utils incident to spread security practice across the community, that it complements but does not replace Red Hat Product Security, and that it replaced the earlier Fedora Security Team — a documented process response rather than a formal audit or funded bounty.
The DNF configuration reference documents the 'countme' option shipped in Fedora: when enabled, one randomly selected repository-metadata request per week carries a 'countme=N' URL flag where N is one of four coarse system-age buckets derived from the machine-id file's modification time; the docs state this is not an out-of-band request and carries no unique identifier, and the option is a boolean the user can turn off.
On the website side, the Fedora Privacy Statement discloses that Fedora's online services capture IP addresses and set cookies, including a per-browser unique cookie used to estimate audience size and distinguish repeat, registered and unregistered visitors, and that cookies may be used to personalize content, banners and promotions — first-party analytics rather than a disclosed third-party tracker.
In 2023 the Red Hat Display Systems Team proposed 'Privacy-preserving Telemetry for Fedora Workstation' — an opt-out (not opt-in) deployment of the Endless OS metrics stack on Fedora-run infrastructure, with the proposal stating it would not depend on Google Analytics or other third-party services; the wiki page records that the proposal was withdrawn and obsoleted by a newer (opt-in) version, so no opt-out telemetry shipped.
Privacy Guides lists Fedora Linux (and, separately, Fedora Atomic Desktops) on its Desktop/PC recommendations page (last updated July 9, 2026), whose stated criteria include being free and open source, receiving regular software and kernel updates, avoiding X11, supporting full-disk encryption at install time and being a larger project likely to persist.