Ever since Microsoft acquired GitHub for $7.5 billion in 2018, a question has hovered over the world's largest code host: what exactly can Microsoft do with the code you publish there? The short answer is: Microsoft does not claim ownership of your code ...but its terms grant Microsoft and its affiliates a broad license to use it, and since April 2026 that license extends by default to AI model training on your live Copilot sessions.
1. Public repositories: no ownership, but a broad license
You keep the copyright to anything you publish. But under GitHub's Terms of Service, posting public content grants GitHub and its corporate family (which includes Microsoft) a license to host, display, and analyze that content. In practice, public repositories have been treated as fair game for training GitHub Copilot and Microsoft's in-house models ...Copilot was originally trained on billions of lines of public GitHub code, without regard for open-source license terms requiring attribution.
In 2024 GitHub introduced a per-repository opt-out toggle ("Prevent use of my code in AI training"), but its protection is limited:
| Scenario | Opt-out respected? |
|---|---|
| GitHub Copilot / Microsoft models | Yes |
| Third-party models (CodeLlama, StarCoder, etc.) | No, they scrape GitHub independently |
| Forks of your repo | No, only the original repo's setting is honored |
| Code already used in past training runs | No, not retroactive |
| Private repositories | N/A, excluded from repo-level training by default |
2. The 2026 change: Copilot interaction data is opt-out, not opt-in
On March 25, 2026, GitHub announced that from April 24, 2026 onward, interaction data from Copilot Free, Pro, and Pro+ users ...prompts, outputs, code snippets, surrounding code context, accepted and rejected suggestions, even from sessions in private repositories... will be used to train and improve GitHub's and Microsoft's AI models, unless you opt out in your account settings.
"Unless you opt out, you grant GitHub and our affiliates a license to collect and use your inputs (e.g., prompts and code context) and outputs (e.g., suggestions) to develop, train and improve AI models." ...GitHub Terms of Service, Section J
Key caveats:
- Copilot Business and Enterprise are exempt ...their contracts prohibit training on organizational data.
- Data may be shared with GitHub's affiliates (i.e., Microsoft), but GitHub says it will not share your inputs/outputs with third-party AI model providers for their own training.
- GitHub distinguishes private code "at rest" (not used) from code actively sent to Copilot during a session (collectible unless you opt out).
- For EEA/UK users, GitHub relies on "legitimate interest" as the legal basis ...the same contested approach the Irish DPC accepted in the Meta AI case, which privacy regulators across Europe continue to scrutinize.
3. What the courts say: Doe v. GitHub (9th Cir., Sept. 2026)
The most significant independent documentation is the law itself. In Doe v. GitHub, anonymous developers sued GitHub, Microsoft, and OpenAI, arguing that Copilot reproduced their open-source code without attribution or license terms ...a violation of the DMCA's copyright-management-information rules, with statutory damages up to $25,000 per violation.
On September 16, 2026, the Ninth Circuit affirmed dismissal of the DMCA claim: Copilot creates new works rather than stripping attribution from copies of existing ones, so nothing was "removed." Crucially, the court declined to consider the plaintiffs' input theory ...the question of whether stripping license information during training data preparation is illegal remains undecided. Two breach-of-contract claims are still pending in the lower court. Translation: the legality of training on licensed code is still not settled law.
4. The FOSS community's own documentation
The Software Freedom Conservancy has run its "Give Up GitHub" campaign since June 2022, arguing that Copilot's training on GPL and other copyleft-licensed code violates those licenses, and ...most recently ...that GitHub joined an industry coalition opposing updates to California's AI transparency act on misleading licensing grounds. Independent analyses have also noted that GitHub published no verifiable benchmarks for its claim that training on user interaction data meaningfully improves models ..."trust us, it's better" is a marketing pitch, not documentation.
Bottom line
Microsoft does not own your code ...but its terms of service give it permission to use public code for AI development, and, since April 2026, to train on your Copilot sessions by default. The opt-out works within GitHub's own pipeline only, is not retroactive, and does not stop independent scrapers. The one major legal test so far ended in GitHub's favor on a technicality, without deciding the core training question. If you publish open-source code and care about how it is used: check your repo's AI-training settings, opt out of Copilot interaction-data training if you are on Free/Pro/Pro+, and follow the still-evolving case law.
Sources and further reading
GitHub / Microsoft (official)
- Updates to GitHub Copilot interaction data usage policy... GitHub Blog
- Updates to our Privacy Statement and Terms of Service... GitHub Changelog
- GitHub Terms of Service (Section J)
- FAQ: Privacy Statement update on Copilot data use... GitHub Community
Courts and legal analyses
- Doe v. GitHub, No. 24-7700... Ninth Circuit opinion (PDF)
- Doe v. GitHub summary... Justia
- Ninth Circuit Clarifies Limits of DMCA Liability for AI-Generated Code... Gibson Dunn
Independent journalism and community
