Copilot Training Data Sources: What Code Was Used and Who Consented

GitHub Copilot was trained on a massive corpus of publicly available code, but the composition and consent framework of that training data remains opaque. Independent researchers have mapped Copilot training sources to include code from repositories with restrictive licenses, including GPL, AGPL, and proprietary licenses that were briefly public due to misconfiguration. The training dataset, based on publicly available information, encompasses virtually all public GitHub repositories as of the training cutoff date. This includes code written by hobbyists, students, professionals, and organizations ranging from solo developers to Fortune 500 companies. None of these authors were individually notified or asked to consent to commercial AI training use. The consent question is particularly thorny because GitHub Terms of Service grant GitHub a license to host and share public code, but whether that license extends to training commercial AI products is legally contested. The Apache Software Foundation, Linux Foundation, and Software Freedom Conservancy have all issued statements questioning whether the GitHub ToS adequately covers AI training use. Developers who contributed to public projects under the assumption that their code would be freely available for human reading and use did not necessarily anticipate or agree to machine learning training. The situation creates a consent gap that no amount of retroactive policy changes can fully address.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.