GitHub Copilot Opt-Out Guide: Stop Your Code From Training AI

GitHub Copilot has trained on billions of lines of public repository code, but many developers remain unaware that their contributions may be used to generate code suggestions for paying customers. This comprehensive guide walks through every available opt-out mechanism, from repository-level settings to organization-wide policies. The opt-out landscape is more complex than GitHub acknowledges publicly. Individual developers must navigate account settings, repository configuration files, and license declarations to meaningfully limit how their code is used. Even after opting out, previously ingested code remains in Copilot training datasets with no mechanism for retroactive removal. Open source maintainers face a particular dilemma: their code is public by design, but the commercial use of that code to train a paid AI product was never part of the open source social contract. The Free Software Foundation and Electronic Frontier Foundation have both issued guidance questioning whether Copilot training constitutes fair use or a license violation. Developers using copyleft licenses like GPL argue that Copilot-generated code derived from their work should carry the same license obligations, a position GitHub disputes but courts have not yet definitively resolved.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.