Is GitHub Copilot safe with your data?

Opt-out does not reach the main content licence

Section J.3 grants a training opt-out for Inputs and Outputs but states the opt-out "does not apply to the license granted in Sections D.4-D.8." Section D.4 independently licenses Your Content "for the purpose of training, developing, and improving artificial intelligence and machine learning models and technologies of GitHub and our Affiliates" and to "share it with other Users."

Ad sharing has only a US-state opt-out

The policy admits it "shared" identifiers and network activity data "to or with advertising networks, data analytics providers, and social networks" for marketing and audience measurement. The "Do Not Share My Personal Information" link and GPC sit inside the US State Specific Information section, so users outside those states get no opt-out.

Legal bases are EEA and UK scoped only

The mapping of purposes to legal bases appears under the heading "Lawful Bases for Processing Personal Data (Applicable to EEA and UK End Users)." Users elsewhere are given no equivalent statement of the grounds for processing.

Retention and minimization stay vague

Retention runs "as long as your account is active and as needed to fulfill contractual obligations" with no stated number of days, and the data minimization claim names no mechanism. The 90-day deletion timeline carries a legal-requirements carve-out plus residual encrypted backups.