Does GitHub train on your data?
GitHub uses your code, inputs and AI outputs to develop and train AI/ML models by default, with no self-serve opt-out stated in its privacy statement.
No opt-out found in this policy
Graded on the plan most people are on. The other plans are in the matrix below.
"We use Personal Data to develop and improve our products, services, and technologies, including artificial intelligence and machine learning technologies. This includes improving features, developing new offerings, enhancing safety and security capabilities, and training models."
- 1 May 2026
- 5 Oct 2026
- Individual accounts (all plans)
- global
- Internet Archive copy
- FBC97EB3…F69F
How we read it: The policy defines collected "User Content and Files" as "code, inputs, AI outputs, text, documents, images, or feedback," with no public/private repo distinction — but Copilot is never named in or near the training clause. A second training statement sits under Affiliates: Personal Data may be shared with Microsoft for "product development and improvement (including training and improving artificial intelligence and machine learning technologies)" — grade-neutral for a tier already without an opt-out. Private-repository access now points to "Section E (Private Repositories)" of the Terms of Service, not archived here. Outside the EU/UK, no self-serve opt-out is stated for this use.
opt out, object to, right to object, legitimate interest, restrict, settings
What the document does offer
- "The right to object to the processing of your Personal Data, as allowed by applicable law", in a list opening "Depending on your residence location" — exercised by emailing privacy@github.com, not by a setting
- "Visual Studio Code (GitHub Codespaces) ... some telemetry is collected by default ... To opt out, go to File > Preferences > Settings" — telemetry in Codespaces, not training
- "You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects", immediately disclaimed: "GitHub does not engage in such profiling ... so there's no need to opt out"
- access, deletion, correction and opt-out requests by email to privacy@github.com
Why none of it applies: This tier's claim is narrower than most on the site and survives because of it: no SELF-SERVE opt-out is stated, and none of the above is one. The VS Code setting is real but governs Codespaces telemetry. The objection right is a written request, conditioned on where you live. The profiling opt-out is disclaimed as inapplicable in the same breath it is granted.
This clause is real, but it doesn't resolve the training question - see the finding below.
"In such circumstances, GitHub functions as a Data Processor, adhering to the Data Controller's instructions regarding your Personal Data's processing. A Data Protection Agreement governs the relationship between GitHub and the Data Controller."
- 1 May 2026
- 5 Oct 2026
- Organization-provided accounts (Enterprise/Business)
- global
- Internet Archive copy
- FBC97EB3…F69F
Why this is still UNCLEAR: When a school or employer supplies your GitHub account, the privacy statement says that organization becomes the Data Controller and GitHub acts as a Data Processor under a Data Protection Agreement negotiated with that organization. The same paragraph adds a wrinkle: GitHub remains Data Controller "solely for specific processing activities" defined in that agreement, and "for those limited purposes, this Statement governs" — so part of org-account processing may fall under the very clause quoted on the Individual accounts tier, but the document never says whether AI/ML training is one of those "limited purposes" or one of the DPA-governed ones. We also checked GitHub's own publicly-linked standard Data Protection Agreement (the document this policy points readers to); it authorizes GitHub to provide, update, and troubleshoot the service and explicitly rules out using organization data for profiling, advertising, or data brokering, but it does not mention AI or machine learning model training in either direction — genuinely silent, not merely unread.
What each plan can refuse
The same questions, asked of every plan we could identify. Every cell comes from a quoted clause or a documented search - see the evidence above.
- None offered
- Not stated
- 86 / 100
- Qualified
- Unknown
- Not established
- Not stated
- —
- —
- Not established
How to opt out of GitHub AI training
Plan by plan, from what GitHub's own policy says about refusing. Where it publishes the steps, they're listed here with the limits they carry. Where there's nothing to switch off, or nothing graded, this says so instead of inventing a menu path.
Individual accounts (all plans)
No opt-out is stated in the policy on file for GitHub.
Organization-provided accounts (Enterprise/Business)
Not graded, so no route is pointed at. When a school or employer supplies your GitHub account, the privacy statement says that organization becomes the Data Controller and GitHub acts as a Data Processor under a Data Protection Agreement negotiated with that organization. The same paragraph adds a wrinkle: GitHub remains Data Controller "solely for specific processing activities" defined in that agreement, and "for those limited purposes, this Statement governs" — so part of org-account processing may fall under the very clause quoted on the Individual accounts tier, but the document never says whether AI/ML training is one of those "limited purposes" or one of the DPA-governed ones. We also checked GitHub's own publicly-linked standard Data Protection Agreement (the document this policy points readers to); it authorizes GitHub to provide, update, and troubleshoot the service and explicitly rules out using organization data for profiling, advertising, or data brokering, but it does not mention AI or machine learning model training in either direction — genuinely silent, not merely unread.
What this policy has done since we started watching
1 change detected since 2 Feb 2024. Each one is a diff between two archived copies, and each links to the passage that moved.
Everything we read
Vendor response
We haven't yet written to GitHub about this verdict, and they haven't disputed, clarified or announced a change to any clause quoted above. When either happens it's published here, word for word.
Report a wrong clause