GitHub's decision to train AI models on Copilot interaction data from Free, Pro, and Pro+ users, starting April 24, with an opt-in by default, is a misstep that prioritizes the company's model improvement over its users' trust. The policy collects code snippets, inputs, outputs, and navigation patterns from active sessions, including private repositories. That last detail is the one that should give every developer pause.
Let's be clear about what this means in practice. If you are a Free, Pro, or Pro+ user, your work inside Copilot, including code you may consider proprietary, will be fed into training pipelines unless you take affirmative steps to opt out. GitHub frames this as a default participation model, which is a polite way of saying they are betting most people will not change the setting. The Business and Enterprise tiers are excluded, but that carve-out only reinforces the pattern: organizations that can pay for protection get it; individual developers and small teams do not. That is not a progressive approach to data management. It is a tiered system of privacy that rewards budget over principle.
Community concerns about dark patterns, IP exposure, and GDPR compliance are not theoretical. A default opt-in for training on private repository data places the burden squarely on the user to understand and navigate a policy change buried in terms of service updates. For developers working on client projects, internal tools, or anything under non-disclosure, the risk is immediate and tangible. Even if GitHub applies filters or anonymization, and the announcement does not detail how thoroughly, the perception that a company can absorb your private code into its models without explicit consent erodes the trust that makes collaborative tools work.
Our view is straightforward: data governance should be transparent and user-controlled by design, not by default. GitHub could have led with a clear opt-in, a detailed explanation of what is collected and how it is protected, and a simple interface for managing consent. Instead, they chose a path that forces users to act defensively. The message to developers is clear: read every update carefully, and be ready to adjust your settings or your toolchain. That is not empowerment. It is a liability shift.