Phase 3: Profit — The GitHub Story
_Part of the ongoing_ _Big Tech’s War on Users_ _series._
Earlier this past week, GitHub announced that starting April 24th, your Copilot interaction data will be used to train Microsoft’s AI models. By default. Unless you find the setting and turn it off.
It’s worth pausing on that word — _default_.
Because in 2018, when Microsoft acquired GitHub for $7.5 billion, developers were nervous. This was Microsoft — the company that called Linux “a cancer,” bundled Internet Explorer to kill competition, and had spent decades treating developers as a captive audience. Handing them the world’s largest code host felt like handing the keys to the commons over to a landlord.
Satya Nadella knew exactly what he was walking into. So he made a promise. Specific, public, on the record — from the official Microsoft blog:
> “We are committed to being stewards of the GitHub community, which will retain its developer-first ethos, operate independently and remain an open platform.”
And then he invited accountability — his exact words:
> “When it comes to our commitment to open source, judge us by the actions we have taken in the recent past, our actions today, and in the future.”
Okay. Let’s do that.
## Phase 1: Collect Underpants (2018)
The acquisition announcement was a carefully managed reassurance campaign. Nat Friedman — a respected open source figure, founder of Xamarin — was installed as CEO specifically to signal continuity. The message was consistent across every channel: GitHub would remain independent. Developer-first. A neutral commons. Not a Microsoft product.
It worked. Developers who had started migrating to GitLab came back or stayed. The GitHub community largely gave Microsoft the benefit of the doubt. Nadella had spent years rehabilitating Microsoft’s relationship with open source and this felt like the logical extension of that goodwill.
The trust was real. It was also load-bearing.
## Phase 2: ??? (2025)
Seven years later, in August 2025, GitHub CEO Thomas Dohmke announced he was stepping down. Microsoft did not announce a replacement. Instead, GitHub was folded into Microsoft’s CoreAI division under Jay Parikh, executive vice president.
No fanfare. No “we’re evolving the structure.” Just a reorganization that ended GitHub’s operational independence and positioned it explicitly as a component of Microsoft’s AI infrastructure.
The independence promise didn’t expire with an announcement. It just quietly stopped being true.
## Phase 3: Profit (2026)
On March 25th, GitHub announcedthat starting April 24th, interaction data from Copilot Free, Pro, and Pro+ users will be used to train and improve Microsoft’s AI models. By default. Unless you find the setting and turn it off.
What counts as interaction data is worth reading carefully:
* Inputs sent to GitHub Copilot
* Outputs accepted or modified by you
* Code context surrounding your cursor position
* Comments and documentation you write
* File names, repository structure, and navigation patterns
* Interactions with Copilot features
* Feedback — thumbs up/down ratings
And who gets it? GitHub, and its affiliates. Which, as they specifically note in their updated privacy statement, includes Microsoft.
If you’re on Copilot Business or Enterprise, none of this applies to you. Your corporate contract prohibits it. You’re protected.
If you’re an individual developer — open source contributor, indie hacker, someone who touches their employer’s codebase from a personal account — you’re in until you opt out. The responsibility to do so is entirely yours.
## The Reversal Is Documented
This isn’t a new policy being introduced. It’s an old promise being broken.
In November 2025 — four months ago — a GitHub maintainer answered this exact question in the community forums:
> “By default, GitHub, its affiliates, and third parties do not use your data (prompts, suggestions, code snippets) for AI model training. This setting cannot be enabled — it’s off and stays off.”
Cannot be enabled. Off and stays off.
That answer is now wrong. As of April 24th, for 26 million users, it’s on and stays on unless you turn it off yourself.
## The Windows Connection
Here’s where the timing becomes something more than coincidence.
Five days before the GitHub announcement, on March 20th, Windows president Pavan Davuluri published what I called a landmark “we hear you” post — promising to fix Windows 11. Less Copilot. Fewer ads. Movable taskbar. A calmer OS. Same week. Different audience. Different message.
The developer and enthusiast community responded cautiously but positively. Microsoft was listening. Things were changing.
Same week. Same company. One hand pulling Copilot back from the Start menu. The other hand quietly routing your code into the Copilot training pipeline.
I wrote in that post that a calmer cage is still a cage. I didn’t know quite how literal that was going to get, quite that fast.
The consumer audience gets the soothing blog post. The developer audience gets the policy update. Different pressure release valves for different communities — but the same direction of travel underneath.
## The Class System Nobody Is Talking About Enough
GitHub’s own FAQ explains the individual/enterprise split plainly: business and enterprise customers have contracts that prohibit this use of their data. Those agreements are honored.
Individual users — the open source contributors, the hobbyists, the people who _built the community that made GitHub worth $7.5 billion_ — get opted in by default.
One commenter on Hacker News framed it generously: this is standard B2B SaaS practice. Enterprise DPAs include ML training carve-outs that free users don’t get. That’s true. It’s also exactly the point. The community that was promised stewardship and independence is getting consumer-tier treatment. The enterprise customers paying the big contracts get the protection that stewardship actually looks like.
The people who made this platform worth buying are not the people being protected by it.
## What The Developer Community Is Doing
Migration guides to Codeberg and Forgejo started appearing within hours of the announcement. Not rage-tweets. Documentation. Step-by-step instructions for moving repositories, redirecting links, rebuilding CI pipelines.
This matters because the switching cost is genuinely high. These aren’t casual users threatening to delete an app. These are people with years of commit history, issue threads, CI configurations, and public presence tied to GitHub. When developers with that much to lose start writing exit documentation rather than filing angry issues, that’s a meaningful signal.
Worth noting: a significant chunk of the GitHub open source community is already on Linux or Mac. The Windows “we hear you” post wasn’t aimed at them and didn’t land for them. The Microsoft goodwill tour doesn’t apply to the audience most affected by this policy change. They were already skeptical. This confirms it.
## The Private Repository Sleight of Hand
GitHub draws a careful distinction between data “at rest” and active interactions. Your private repository contents, sitting on their servers, are not used for training.
But if you’re actively working in that private repository with Copilot enabled — your code context, your cursor position, your comments, your file structure — that’s interaction data. That’s in scope. Unless you opt out.
If you’re an individual developer working on a personal account who sometimes touches your employer’s proprietary codebase, that’s worth sitting with for a moment.
## The Opt-Out Friction Problem
Community reaction on Reddit and Hacker News has been pointed, with a consistent complaint beyond the policy itself: the opt-out instructions are confusing and inconsistent across different GitHub documentation pages.
The setting is at: GitHub Account Settings → Copilot → Privacy → “Allow GitHub to use my data for AI model training” → Disabled.
If you use multiple GitHub accounts, you need to do it for each one separately.
Data retention if you don’t opt out: up to five years, though often shorter per GitHub’s FAQ.
## Nadella Said Judge Them By Their Actions
Eight years of receipts:
* 2018: GitHub will operate independently, retain developer-first ethos, remain open platform
* 2021: Nat Friedman steps down, Thomas Dohmke takes over — independence maintained on paper
* 2025: Dohmke out, GitHub absorbed into CoreAI, independence ends without announcement
* 2026: Individual developer code routes into Microsoft AI training by default
The promise was load-bearing. The trust it bought was real, and it’s been spent. Twenty-six million developers are on a platform whose terms just materially changed.
Nadella said judge them by their actions. He was right to invite that. It’s the only honest standard.
## What To Do
**Opt out now** if you haven’t: GitHub Settings → Copilot → Privacy → disable “Allow GitHub to use my data for AI model training.” Do it for every account.
**Consider your architecture.** GitHub as a primary with no alternative is a single point of trust failure that just demonstrated it can fail. GitHub as a mirror to a self-hosted Gitea or Forgejo instance, or to Codeberg for public repos, is a different relationship entirely — you’re using their infrastructure as a utility without depending on their goodwill.
For what it’s worth, my setup is self-hosted Gitea as the actual source of truth — my NixOS configs and other bits live there, with GitHub as a mirror mostly for shareability and discoverability. I’d already flipped the opt-out before writing this. But I’m now actively looking for a different public-facing home, and rethinking how I handle private repos entirely. I’ll cover what I actually decided to do in an upcoming home server post — but the short version is that this policy change is the thing that finally pushed me to treat private code like any other sensitive data on my infrastructure rather than something I hand to a third party and hope for the best.
If you want to go the self-hosted route, Part 11 of my home server series covers setting up Gitea. If Codeberg is more your speed — hosted, nonprofit, EU-based, no VC money — there’s a solid practical migration guide on DEV written this week by someone who just did it. And if you want to self-host Forgejo specifically, this walkthrough covers the full process including CI setup via Forgejo Actions. The official Codeberg migration docs are also worth bookmarking — built-in GitHub import handles issues, PRs, labels and releases with checkboxes, not command line gymnastics.
**Watch the policy.** It changed once with 30 days notice. The precedent is set.
The commons was never really free. It was subsidized by developer trust that accumulated over decades and has now been drawn down in service of a $7.5 billion acquisition’s AI strategy.
Judge them by their actions. Nadella’s words. Still good advice.
_Find me on Mastodon at_ _@ppb1701@ppb.social_
_Part of the ongoing_ _Big Tech’s War on Users_ _series._