Hacker News new | ask | show | jobs
by pred_ 80 days ago
What is the legal basis of this in the EU? Ignoring the fact they could end up stealing IP, it seems like the collected information could easily contain PII, and consent would have to be

> freely given, specific, informed and unambiguous. In order to obtain freely given consent, it must be given on a voluntary basis.
2 comments
rennokki 80 days ago
It breaks GDPR easily: GDPR enforces you to comply with opt-out by default, no workaround by prefilling before hitting submit.

While some think this applies only to personal data, then yes. But it takes only one line of code to use my phone number for testing while I test locally a register form in the application I'm developing.

Once it gets sent to Copilot I can threaten with legal action if they are not taking it down.

link
pred_ 80 days ago
Based on https://github.blog/changelog/2026-03-25-updates-to-our-priv..., it looks like they are going to go for “legitimate interest” which seems clearly overridden by data subject interests in this case, hence not lawful.

If you don't want to wait until your PII inevitably gets sent through, you can already now file a complaint to your local supervisory authority: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

link
edelbitter 78 days ago
Has there ever been a GDPR fine that actually exhausted all applicable legal challenges within a sufficiently short delay from initial violation to actually matter?
link
port11 77 days ago
https://www.enforcementtracker.com/

Short delay: depends on your DPA, I doubt any country is fast enough. On the other hand, this is the legitimate interest of GitHub, so it would require investigation, maybe even litigation.

link
LadyCailin 80 days ago
I actually don’t seem to have this option on my GitHub settings page, which leads me to wonder if this only applies to Americans.
link
LauraMedia 80 days ago
I actually did have to manually disable this from Germany, so it might be a different reason you don't have it?
link
LadyCailin 78 days ago
Dunno! I would have expected Germany and Norway to be the same.
link
spartanatreyu 80 days ago
I have the setting in Australia.

I'd be curious to see which countries are affected

link