GitHub gave developers 30 days notice. On March 25, it announced that starting April 24, 2026, interaction data from Copilot Free, Pro, and Pro+ users will be used to train GitHub and Microsoft AI models — by default. Opt-out is required to prevent it.
The announcement was quiet. The developer reaction was not.
What the Policy Actually Covers#
The updated policy collects the following when you use Copilot in an opted-in account:
- Code completions accepted or modified — the code you accepted from Copilot suggestions
- Inputs and code snippets — what you sent to Copilot
- Surrounding code context — the files open around your cursor when you invoked Copilot
- Comments and documentation — inline comments, docstrings, any text context
- File names and repository structure — metadata about how your project is organized, including in private repositories
- Navigation patterns — how you move through the codebase
- Chat interactions — full prompts and responses from Copilot Chat
- Feedback signals — thumbs up/down ratings you gave suggestions
To be precise: this applies to individual plan users (Free, Pro, Pro+). Copilot Business and Enterprise accounts are not affected. Students and teachers are exempt.
The data is used to improve model performance. GitHub CPO Mario Rodriguez cited Microsoft’s existing precedent of training on interaction data to justify it.
Why the Opt-Out Default Is the Story#
The technical scope of what’s collected is less interesting than the framing of how it’s collected: opt-out by default.
GitHub’s own community discussion thread shows 59 thumbs-down and 3 rocket emojis — with essentially no endorsement beyond GitHub’s own VP of developer relations. Hacker News and Reddit generated sustained negative discussion. The criticisms cluster around a few real problems:
The employer problem. Individual users cannot license their employer’s proprietary code for AI training. But the opt-out is enforced at the user level, not the organization level. A developer using a personal Pro account to work on company code — a common pattern for engineers doing exploratory work on their own machines — cannot prevent that code from entering GitHub’s training pipeline on behalf of their employer. The policy doesn’t address this.
The mobile problem. At launch, the opt-out toggle is not available in GitHub’s mobile app. Users who primarily access settings via mobile have no mechanism to opt out at launch. This is not a small edge case — the mobile app has a large user base.
The model collapse problem. A thread on Reddit with 1,000+ upvotes raised the feedback loop concern: if Copilot generates code, that code is accepted by users, and then fed back into training data, you get a model trained increasingly on its own outputs. Model collapse through recursive self-training is a well-documented failure mode in machine learning. GitHub hasn’t published methodology around how it intends to prevent this.
The verification problem. There is no enforceable guarantee that toggling the opt-out does anything verifiable. You are trusting GitHub’s implementation of its own privacy toggle. There is no audit mechanism, no third-party verification, and no way to confirm your data is not being used after you opt out.
How to Opt Out#
The opt-out is available in Settings → Privacy on the GitHub web interface. Set it before April 24 if you want to prevent any data collection from the start.
The process:
- Sign in to github.com
- Navigate to Settings → Privacy
- Find the “Allow GitHub to use my data to improve AI models” toggle
- Disable it
Note: as of this writing, the mobile app toggle is not yet available. Set it from the web.
What This Means for Copilot Relative to Alternatives#
This is worth placing in context of the broader market.
Copilot Business and Enterprise — the paid tiers designed for professional developer use — are explicitly excluded. GitHub is drawing a line: free and personal-plan users are the product; enterprise customers are the customers. That’s a coherent business model, but it makes the opt-out default on personal plans feel more like a boundary-push than a genuine oversight.
The comparison to Anthropic is instructive. Claude Code does not train on user code. Anthropic’s API terms explicitly prohibit training on user inputs unless users specifically opt into feedback programs. The transparency asymmetry between GitHub and Anthropic on this question is significant.
Cursor’s privacy model is more opaque — training data usage depends on tier and policy version — but Cursor Business offers explicit no-training guarantees for enterprise customers. Windsurf (now under Cognition) has similar tiered privacy protections.
The pattern across the industry is the same: free and personal tiers fund model improvement through data; enterprise tiers buy data protection. GitHub’s April 24 change is consistent with that pattern, but the implementation — opt-out by default, no mobile toggle, no verification mechanism — is worse than industry norms.
The Deeper Question#
There is a more fundamental tension in GitHub Copilot’s business model that this policy change makes explicit.
GitHub Copilot is a tool that generates code. That code gets committed into repositories. GitHub hosts those repositories. Now GitHub wants to use that committed code — and the prompts and completions that produced it — to train the models that generate more code. The flywheel is real and makes business sense.
But it also means that every developer using a free or personal Copilot plan is, by default, a contributor to GitHub’s AI training pipeline. Not a customer. A contributor.
The distinction matters. Customers have negotiated relationships with service providers. Contributors have terms of service they may or may not have read, opted out of by default, and no independent way to verify their preferences are honored.
GitHub is a dominant platform. Developers don’t easily leave. That makes the opt-out default more aggressive than it might be from a smaller vendor — the power asymmetry is high.
The April 24 deadline is in three weeks. If you use Copilot Free, Pro, or Pro+ on personal accounts that touch employer or client code, the time to check your settings is now.
Sources: GitHub Blog: Updates to Copilot Interaction Data Usage Policy, The Register: GitHub Going to Train on Your Data After All, InfoQ: GitHub Will Use Copilot Interaction Data for AI Training, Help Net Security: GitHub Copilot Data Privacy Policy Update, Hacker News Discussion