Copilot's April 24 Data Policy: What Changes and How to Opt Out

On March 25, 2026, GitHub announced that starting April 24, 2026, interaction data from Copilot Free, Pro, and Pro+ users will be used to train GitHub's AI models. The setting is enabled by default. If you don't actively opt out, your prompts, code snippets, and Copilot session context become training material.

The deadline is four days away. Here's what you need to know and do.

What "Interaction Data" Actually Means

GitHub's phrasing is deliberate. They're not scraping your repositories wholesale. "Interaction data" refers specifically to what passes through Copilot during active sessions. According to the official blog post, the data they may collect includes:

• Outputs you accept or modify from Copilot suggestions
• Inputs sent to Copilot, including code snippets shown to the model
• Code context surrounding your cursor position
• Comments and documentation you write
• File names, repository structure, and navigation patterns
• Interactions with Copilot features (chat, inline suggestions, etc.)
• Your feedback on suggestions (thumbs up/down ratings)

That last bullet is easy to miss. It's not just your code. It's the structure of your project, how you navigate it, and how you rate what Copilot gives you.

What It Does NOT Include

GitHub draws a specific line here. The program does not use:

• Interaction data from Copilot Business or Enterprise plans
• Data from users who opt out in their settings
• Content from issues, discussions, or private repositories "at rest"

That "at rest" qualifier matters. GitHub's FAQ explicitly states: "Copilot does process code from private repositories when you are actively using Copilot. This interaction data is required to run the service and could be used for model training unless you opt out." So your private repo code isn't being bulk-scraped, but any snippet that touches a Copilot session is fair game for training unless you flip the switch.

How to Opt Out (Step by Step)

The opt-out process is straightforward once you find it. Multiple community members in the GitHub Community discussion (146 participants and counting) noted that GitHub's own notification email didn't include a direct link to the setting. Here's where to go:

1. Go to github.com/settings/copilot/features
2. Scroll to the bottom of the page to find the Privacy section
3. Find "Allow GitHub to use my data for AI model training"
4. Set it to Disabled

One confusing detail: the toggle's wording says "You won't have access to the feature" when set to Disabled. That sounds like you'll lose Copilot access entirely. You won't. As community member Markldngit pointed out, the wording should say something like "Disabling this will not affect your Copilot access; it only prevents your data from being used for AI model training." GitHub hasn't fixed this yet.

If you previously opted out of the older "prompt and suggestion collection" setting, your preference carries over. No action needed.

Who's Affected (and Who Isn't)

The policy targets individual users on Copilot Free, Pro, and Pro+ plans. Copilot Business and Enterprise users are excluded because their contracts prohibit it.

Students and teachers who access Copilot Pro for free through GitHub Education are also excluded.

But here's where it gets tricky for teams.

The Organization Member Edge Case

GitHub's FAQ states that if a user's account is a member of or outside collaborator with a paid organization, their interaction data is excluded from training. That's reassuring, but it raises questions that community members have already asked: what happens when a developer uses a personal Copilot license on a locally cloned org repo? The FAQ says they exclude data from paid organization repos "regardless of whether a user is working in that repo with a Copilot Free, Pro, or Pro+ subscription." That's the stated policy, at least.

One Business plan user in the community thread reported that every user on their plan still had the "Allow GitHub to use my data for AI model training" toggle set to Enabled, requiring manual opt-out. If you're a team lead on a Business plan, it's worth double-checking each seat.

Where the Data Goes

GitHub says the collected data may be shared with "GitHub affiliates," which in practice means Microsoft and its subsidiaries. Third-party AI model providers (like Anthropic or OpenAI, who power some Copilot functionality) are explicitly excluded from receiving this data for their own training. They can only process it on GitHub's behalf under contract.

GitHub also says they apply automated filtering to detect and remove API keys, passwords, tokens, and PII before training. Access is limited to authorized personnel working on model improvement and safety, with logging and auditing in place.

The Community Response

The reaction has been overwhelmingly negative. GitHub's own FAQ discussion thread has 107 comments, 135 replies, 146 participants, and 275 thumbs-down reactions on the announcement post itself. For context, it got 12 upvotes.

The criticism falls into a few recurring themes.

"Opt-out is the wrong default." The most-upvoted reply (114 upvotes) argues that if GitHub genuinely wanted consent, they'd require opt-in. User eriklharper put it directly: "The way to 'proudly ask for consent' would be to require the user to opt-in instead of notifying them that this feature will be turned on at a future date."

"Dark patterns in the notification." User burnhamup (64 upvotes) pointed out that the email notification didn't link directly to the opt-out settings page. Others found the setting buried at the bottom of the Copilot Features page with no anchor link. One commenter called it "hard to opt out because they want it to be."

"Paying to provide training data." Several users noted the irony of paying for Copilot Pro while also contributing free training data. User kinduff suggested GitHub should "at least offer a discount." Another proposed following OpenAI's approach of giving free tokens to users who opt in to data sharing.

"No per-repo controls." A highly-upvoted thread (26 upvotes, 37 +1 reactions) asked for per-project opt-out. A developer working as a contractor with both personal and client repos has to make a single all-or-nothing choice. User brandon-fryslie laid out a detailed case for repo-level toggles: "If someone is a contractor with private repos who also does some personal projects, the choices are 'risk exposing customer data,' 'disable data collection and double-check every day,' or 'find a different provider than GitHub.'"

The Sensitive Codebase Problem

If you're using Copilot with proprietary code on an individual plan, the implications are real. Even though GitHub isn't scraping repos at rest, every prompt you send, every suggestion you accept, and every file your cursor touches during a Copilot session could become training data.

For freelancers and contractors, this creates a real compliance headache. Many client contracts include confidentiality clauses that prohibit sharing code with third parties. If your Copilot session context gets fed into Microsoft's model training pipeline, you might technically be in breach even if the code is never "exposed" in the traditional sense.

Community member trusktr raised a pointed analogy: "If I hired a human to work in my free private repo, their NDA will prevent them from spilling my code outside. But if I pay an AI to work in my free private repo, there's no such protection?"

GitHub says they filter out API keys, passwords, and PII. But there's no public documentation on the accuracy or coverage of those filters. And the FAQ's language uses "may collect" throughout, leaving ambiguity about exactly when collection happens.

GitHub's Reasoning

GitHub's stated rationale is that Copilot was originally built on publicly available data and hand-crafted samples. After incorporating interaction data from Microsoft employees, they saw "meaningful improvements, including increased acceptance rates in multiple languages." They want to extend that to the broader user base.

They also position it as industry-standard, pointing to similar approaches by Microsoft, Anthropic, and JetBrains. The FAQ includes links to each company's respective data use policies.

The counterargument writes itself: "industry standard" doesn't mean popular. As community member mattwhitlock wrote, "Just because the whole industry is doing opt-in by default doesn't make it less shitty."

What You Should Do Before April 24

If you're comfortable contributing your interaction data to improve Copilot's models, you don't need to do anything. GitHub's post makes a reasonable case that more diverse real-world data produces better suggestions.

If you're not comfortable with it, go to Settings > Copilot > Features and disable the model training toggle now. Don't wait.

If you're a team lead, check every individual-plan user on your team. The Business plan exclusion should cover organization repos, but the toggle defaulting to Enabled on some Business accounts (as reported in the community thread) means verification is worth five minutes of your time.

If you're a contractor or freelancer working with client code on a personal Copilot license, opting out isn't optional. It's a contractual obligation for most of you. Do it today.