Can Your Employer Read GitHub Copilot Chats? When Content Is Collected
Copilot usage numbers for your account show up on your manager’s dashboard. Can the company also collect the prompts and responses you typed, and how would you know?
- An employer-provided license alone does not tell you whether conversation content is collected.
- GitHub's October 12 update separates identity capture from prompt, response and tool-content capture.
- Turning off content capture does not necessarily remove usage metadata.
Configured client telemetry can collect conversation content
Yes, when a supported client is configured to capture content and export it to an employer's collector. This is a different path from simply opening GitHub's Copilot usage dashboard.
Usage metrics describe adoption, activity and code generation. An administrator seeing those figures does not establish that they can read the original conversation. Equally, the absence of conversation text from a usage dashboard does not rule out collection through a separately configured OpenTelemetry destination.
Identifying a user does not automatically capture their prompts
The October 12 GitHub update introduced independent capture controls. The identity option attaches the authenticated Copilot account name, operating-system username and hostname. It does not turn on conversation capture.
Content has five separate classes: prompts, responses, toolArguments, toolOutput and policyDetail. Their scope extends beyond typed questions to such material as commands, tool results and raw policy paths. Each capture class is off by default; managed configuration determines what is enabled in an organization's deployment.
This also means “prompt capture is off” is not enough to establish that no source code is collected. Enabled tool output can contain file contents even when the prompt class is disabled.
VS Code's execution mode changes which controls apply
The managed-settings reference lists fine-grained content capture for Copilot CLI, the Copilot app and VS Code sessions using Agent Host. VS Code's local agent uses the legacy captureContent control rather than independently applying the five content switches.
That legacy control groups content capture together, without enabling identity. Before interpreting a configuration example, identify which client and execution mode it describes. A setting supported by one mode is not automatically an independent control in another.
Check capture settings and the destination together
The VS Code monitoring guide directs users to search Settings for copilot otel. Relevant entries include whether monitoring is enabled, content capture and the collector endpoint. Organization-managed settings also apply, so a local toggle alone is not a complete answer.
For a managed installation, ask which capture classes are enabled, where the data goes and who can access that destination. Without content capture, monitoring can still record metadata such as model names, token counts and durations. “Can someone read the conversation?” and “Is my usage recorded?” require separate answers.