Does GitHub Copilot Steal Your Code?

The short answer is no, not in the way most people mean when they ask. But the longer answer is more interesting, more uncomfortable, and more relevant to you if you ship software for a living. The question "does GitHub Copilot steal your code" has shifted from a philosophical debate about training data to a concrete policy dispute: as of April 2026, GitHub uses your Copilot interaction data to train its models by default unless you opt out. That includes prompts, code snippets, surrounding context from private repos, and accept/reject signals. Whether that constitutes "stealing" depends on your definitions. Whether it matters to your business doesn't depend on definitions at all.

Key Takeaways

• Since April 24, 2026, GitHub trains on Copilot interaction data from Free, Pro, and Pro+ users by default. You must actively opt out. Business and Enterprise tiers are exempt.
• The data collected goes well beyond your completions: it includes prompts, chat messages, code surrounding the cursor, file names, navigation patterns, and feedback signals, even from private repositories.
• The Doe v. GitHub class action is now before the 9th Circuit, with the unresolved DMCA question (whether stripping license headers from AI-suggested code violates copyright management information rules) carrying real legal exposure for companies shipping Copilot-assisted code.
• Opt-out is structurally fragile. Some users have reported the opt-out toggle re-enabling itself, and no independent audit mechanism exists to verify compliance.
• Privacy in Copilot is tiered by price: free and individual paid users subsidize model improvement with their code, while enterprise customers buy contractual exemptions. Privacy as a feature gate, not a baseline.

What Changed in the April 2026 Policy Update?

GitHub reversed its prior default. Before April 2026, training on individual user data required explicit opt-in consent. The March 25, 2026 changelog update flipped that: Copilot Free, Pro, and Pro+ users are now opted in by default. The policy took effect April 24, 2026, giving users roughly 30 days to find and change the setting.

Business and Enterprise accounts are carved out. Their data remains governed by a separate Data Protection Agreement and is not used for AI training. The update also does not change how private repository source code stored on GitHub (as opposed to code flowing through Copilot sessions) is treated. But the distinction between "code stored in your repo" and "code that passes through a Copilot interaction" is thinner than you might expect.

What Data Does GitHub Actually Collect From Copilot Sessions?

More than completions. According to WaveSpeed's analysis of the policy, the "interaction data" bucket includes: prompts and chat messages you send, code surrounding your cursor at the time of a suggestion, the suggestions and completions themselves, code snippets generated during sessions (including from private repos), file names, navigation patterns within your editor, and your accept/reject feedback on each suggestion.

That last category is interesting. Your editorial judgment on what constitutes good code is itself training signal. Every time you tab-accept or escape-dismiss a suggestion, you are labeling data.

Does the Opt-Out Setting Actually Work?

GitHub provides a toggle in your Copilot policies settings to disable data collection for training. The mechanism exists. Whether it is reliable is a separate question.

Some developers have reported the opt-out toggle re-enabling itself after they had previously disabled it. There is no independent audit mechanism, no third-party verification, no cryptographic proof that your data was excluded from a training run after you flipped the switch. You are trusting a settings page.

This is the structural weakness of opt-out consent models. Opt-in requires affirmative action before data flows. Opt-out means data flows unless you intervene, and your intervention depends on the collector honoring it indefinitely, across every policy update, product change, and settings migration. The Register noted that this approach follows US industry norms rather than the opt-in standard more common under European privacy regulation. Norm-following is not the same as trustworthy.

Can Copilot Reproduce Someone Else's Code in Your Project?

Yes, occasionally. GitHub's own documentation has acknowledged that roughly 1% of the time, a suggestion may contain code snippets longer than about 150 characters that match training data. One percent sounds small. Over millions of suggestions per day across roughly 20 million users, it is not small.

GitHub does offer a setting to block suggestions matching public code. When enabled, it checks suggestions plus roughly 150 characters of surrounding code against public GitHub repositories and suppresses close matches. This helps. It does not cover code from private repos that entered the training set, and it does not help with partial matches or structural reproductions that fall below the detection threshold.

What Is the Legal Status of the Copilot Copyright Lawsuit?

The Doe v. GitHub class action, filed against GitHub, Microsoft, and their AI training partners, is now before the 9th Circuit Court of Appeals. Oral arguments were held on February 11, 2026.

The core question on appeal is narrow but consequential. The district court dismissed the majority of claims in an August 2025 ruling. But the DMCA Section 1202 question survived: does Copilot's process of ingesting open-source code, stripping license headers and attribution, and then emitting modified versions of that code constitute removal of "copyright management information"?

The district court held that because Copilot's outputs were modifications rather than exact copies, the CMI removal claims required identical (verbatim) copying to proceed. The plaintiffs are arguing on appeal that this standard is wrong. If the 9th Circuit agrees, any company shipping code generated by Copilot could face downstream liability for distributing code with stripped license attribution, regardless of whether the code is a verbatim match.

Why Should Technical Founders Care About This Specifically?

Most coverage of the Copilot IP question focuses on individual developers worried about their open-source contributions being used without credit. That is a real concern. But if you are a founder or CTO, the liability vector points in the other direction.

Your company is the one shipping product. If your engineers accept Copilot suggestions that contain fragments of GPL-licensed code, and those fragments end up in your proprietary codebase without the required license headers, your company is the entity distributing code in potential violation of those licenses. The developer who hit tab-complete may not even know the suggestion had upstream provenance.

The BakerHostetler analysis of the case makes this point clearly: the legal question is not just "did an AI copy code," but "who is liable when AI-assisted code strips open-source license information before it reaches production." That liability sits with the company that ships the binary, not with GitHub.

If the 9th Circuit rules that non-verbatim reproductions can still violate DMCA Section 1202, the compliance surface area for every company using AI code assistants expands significantly. You would need a process to audit AI-suggested code for license provenance, not just for security vulnerabilities.

What About Security Risks From Copilot-Generated Code?

The IP question gets the headlines. The security question is arguably more immediate.

GitGuardian's research found that in a sample of roughly 20,000 repositories with Copilot active, over 1,200 (about 6.4%) had leaked at least one secret. API keys, database credentials, tokens. Copilot does not generate these secrets from training data in most cases; what happens is that Copilot uses surrounding context (which may include hardcoded credentials in adjacent files) to generate suggestions that propagate or expose those secrets in new locations.

Separately, research cited in enterprise evaluations found that 29.1% of Python code generated by Copilot contains potential security weaknesses requiring human review. Not all of these are exploitable vulnerabilities. Many are code smells or patterns that would fail a security audit. But the review burden is real, and it scales with adoption.

An 81% majority of developers in Stack Overflow's 2025 survey reported concerns about security and data privacy when using AI coding agents. Those concerns are not irrational.

Is Privacy a Feature Gate or a Baseline?

Look at the tier structure. Free users: data used for training by default. Pro users ($10/month): data used for training by default. Pro+ users: data used for training by default. Business users ($19/user/month): exempt. Enterprise users ($39/user/month): exempt.

The pattern is plain. Privacy is a paid upgrade. The cheaper tiers subsidize model improvement with user code, and the expensive tiers buy a contractual guarantee that your data stays out of the training pipeline.

This is not unusual in the industry. Most cloud AI products follow a similar model. But it is worth naming clearly, because the marketing for individual tiers does not foreground this tradeoff. You are not just paying for features at the Business tier. You are paying for a data protection agreement.

For a five-person startup, the difference between Pro ($10/user) and Business ($19/user) is $45/month. That is the price of a contractual guarantee that your proprietary code is not training a model that your competitors also use. Whether that is cheap or expensive depends on what you are building.

What About Shadow AI and Unsanctioned Tool Use?

The Copilot policy debate assumes your team is using sanctioned tools with known data policies. Enterprise surveys tell a different story. Microsoft's own research found that 78% of AI users now bring their own unsanctioned tools to work. A Gartner survey found 69% of organizations suspect employees are using prohibited AI tools. And 38% of employees in enterprise surveys have admitted to sharing confidential company data with unapproved AI systems.

This is the part that keeps CTOs up at night. You can set your Copilot policy to Business tier, configure the opt-out, enforce it via org settings. And then an engineer pastes your authentication logic into a consumer chatbot to debug a race condition. The policy work is necessary. It is not sufficient.

Does Copilot Access Your Private Repos?

This question comes up repeatedly in GitHub's community forums, and the answer has layers.

Copilot accesses code in your current editor context to generate suggestions. If you are working in a private repo, the code around your cursor, your open files, and your prompts all flow to the model. Under the new policy, for Free/Pro/Pro+ users, that interaction data can be used for training unless you opt out.

GitHub has stated that the policy change does not alter how private repository source code stored on GitHub is treated. The distinction is between code at rest in your repo (not used for training, same as before) and code that passes through a Copilot interaction (now subject to the new training policy). If you write a line in a private repo and Copilot is active, the context sent to generate a suggestion is interaction data, even though the underlying repo is private.

For individual users asking whether their private code trains models, the answer is: your repo itself, no. Your interactions while editing that repo, yes, unless you opt out.

What Are the New Surfaces Expanding Data Exposure?

GitHub shipped several new Copilot surfaces in 2026. Copilot CLI brings an AI agent directly into your terminal. Organization custom instructions let teams define persistent context that shapes suggestions. Copilot Spaces create shared workspaces with file-level access controls. Each of these is a new surface where code and context pass through Copilot's infrastructure.

More surfaces mean more interaction data. More interaction data under an opt-out training policy means more of your workflow potentially entering the training pipeline. The convenience gains are real. So is the expanding attack surface for data exposure, and the expanding scope of what "interaction data" covers.

So Does Copilot "Steal" Your Code?

"Steal" implies taking something from you such that you no longer have it. That is not what happens. You keep your code. What GitHub does, under the current policy, is use your interactions (including code context) to improve models that serve all users, including your competitors. Whether that feels like theft depends on your expectations. Whether it creates legal risk depends on the 9th Circuit. Whether it is a problem for your business depends on what your code is worth.

The more precise framing: GitHub has made your Copilot interactions into training data by default, reversed a prior opt-in policy to do so, and provided an opt-out mechanism with no independent verification. Business and Enterprise users are contractually exempt. Everyone else is trusting a toggle.

For individual developers writing open-source code, the practical impact may be minimal. For startups writing proprietary systems, the calculus is different. Your novel algorithm, your business logic, your competitive advantage, all of that passes through Copilot's context window when you use it. Under the current policy, it can train the model that serves everyone.

You can mitigate this. Upgrade to Business tier. Enable the public-code filter. Opt out of training data collection and check the setting periodically. Audit your team's use of unsanctioned AI tools. These are reasonable steps. They are also a nontrivial operational burden to maintain something that could simply be the default: not training on your code without affirmative consent.

We built Selina around a different premise. Your data is yours. Content is encrypted at rest. Memory is not end-to-end encrypted (a slice of each request reaches a frontier provider at inference), but we do not train on your conversations, and we do not flip that policy with 30 days' notice. Different product, different category, but the same principle: the baseline should be privacy, not the upgrade.

Start a free 7-day trial, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io