<p>GitHub has updated its Copilot data usage policy. Starting April 24, interaction data from Free, Pro, and Pro+ users will be used to train AI models — and you’re opted in by default.</p>
<h2>What gets collected</h2>
<p>The data GitHub collects includes:</p>
<ul>
<li>User prompts and generated outputs</li>
<li>Code snippets and surrounding context</li>
<li>File names and navigation patterns</li>
<li>Feedback from active sessions</li>
<li>Repository structures and comments</li>
</ul>
<p>This applies even to code from private repositories, with an important caveat: static private repo content isn’t directly trained on, but code context sent through Copilot interactions may be. That’s a meaningful distinction that’s easy to miss.</p>
<p>Collected data may be shared with Microsoft and other corporate affiliates, but not with third-party AI providers.</p>
<h2>Who’s affected</h2>
<p>Copilot Business and Enterprise users are exempt — they have existing contractual agreements that prevent this. Individual users on Free, Pro, and Pro+ tiers are enrolled by default.</p>
<p>GitHub says users in paid organizations are also excluded from training data collection, though the policy language around this has caused some confusion.</p>
<h2>How to opt out</h2>
<p>Go to your GitHub account settings, find Copilot under Privacy settings, and disable interaction data collection. It’s not buried, but you do have to go looking for it.</p>
<h2>Why developers are unhappy</h2>
<p>The reaction from developer communities has been pretty negative, and the complaints are specific:</p>
<p><strong>Opt-out by default.</strong> Many consider this a dark pattern. The standard expectation for data collection of this kind is explicit consent, not silent enrollment.</p>
<p><strong>Asymmetry between tiers.</strong> Enterprise customers get protection that individual users don’t. The people with the least leverage get the least privacy.</p>
<p><strong>Proprietary code exposure.</strong> If you’re using Copilot on work code in a personal account, that code context could end up in training data. Whether individual users can even legally license employer code this way is an open question.</p>
<p><strong>GDPR concerns.</strong> GitHub is citing “legitimate interest” as its legal basis in some jurisdictions. Privacy researchers have flagged this as a stretch.</p>
<h2>GitHub’s position</h2>
<p>GitHub says the policy is industry-standard and points to improved model performance from using Microsoft employee interaction data as evidence the approach works. With 26 million+ Copilot users, the training signal would be substantial.</p>
<p>That’s probably true. It’s also not really the point of the criticism.</p>
<h2>What to do</h2>
<p>If you use Copilot and don’t want your interactions used for training, opt out now — before April 24. If you want to avoid this kind of policy change entirely, self-hosted Git platforms like Gitea or Forgejo give you full control over your data, and AI coding tools that support bring-your-own-key or local model execution via Ollama sidestep the vendor training question altogether.</p>


Collections

GitHub is updating its Copilot data usage policy starting April 24, automatically enrolling Free, Pro, and Pro+ users in interaction data collection for AI model training. Collected data includes prompts, generated outputs, code snippets, file names, and repository structures — even from private repos (via interaction context). Business and Enterprise users are exempt due to existing contracts. Developers are criticizing the opt-out default as a dark pattern, the tier-based privacy asymmetry, potential exposure of proprietary work code, and GitHub's use of 'legitimate interest' as GDPR basis. Users who want to opt out must do so in GitHub account Privacy settings before April 24.

GitHub will use Copilot interaction data to train AI models by default starting April 24