# Can you license your company's GitHub repositories to AI companies? URL: https://sellmydatatoai.net/data-rights/github Reviewed: 2026-11-08 Covers: GitHub repositories, issues and pull requests Section D.3 of the GitHub Terms of Service says "You own Your Content," and we found no clause stopping you licensing your own private repositories for AI training. The limits come from the code itself: open-source dependencies, contributor rights, the inbound=outbound rule for licensed repositories and secrets in commit history. Confirm your position with your own counsel before licensing. ## GitHub data rights at a glance | Data available | Export method | Plan needed | AI-training restriction in the terms | | --- | --- | --- | --- | | Private repository code and history | git clone or mirror | Any plan, read access | No: no AI clause on your own content. Terms D.3: "You own Your Content" | | Repositories with issues, pull requests and metadata | Organization migrations REST API archive | Organization owner | No: no AI clause found. Archives are deleted after seven days | | Code contributed under a repository license | Part of the clone | Any plan | Unclear: Terms D.6: "you license that Content under the same terms" as the repository license | ## Who owns your code under GitHub's terms? Your company owns the code it writes and stores on GitHub. Section D.3 of the [GitHub Terms of Service](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service) (effective April 27, 2026) says "You own Your Content," and you are responsible for content you post that you did not create. Section E.3 says "You control access to the content of your private repositories," and GitHub will not use private repository content to develop the service unless you send it to AI features as input. If you are on the GitHub Customer Agreement, read it alongside the Terms of Service. Ownership against GitHub is the easy part. Our guide on [whether you can legally sell company data](https://sellmydatatoai.net/guides/can-you-legally-sell-company-data-for-ai) covers employee, contractor and client rights in code. ## What can you export from GitHub, and how? Code leaves GitHub easily. A git clone or mirror gives you full history, and the [organization migrations API](https://docs.github.com/en/rest/migrations/orgs) packages one or more repositories into an archive. - Only authenticated organization owners can use the migrations endpoints, and not with fine-grained personal access tokens - Options such as exclude_attachments, exclude_releases and exclude_metadata control what goes in - Migration archives are automatically deleted after seven days Buyers of [source code datasets](https://sellmydatatoai.net/buy-ai-training-data/source-code-datasets) commonly ask for issues and pull request discussions alongside code. Pull them with the REST API and keep them linked to the commits they discuss. ## Do GitHub's terms restrict AI training on your code? GitHub's terms do not restrict an owner licensing its own repository content for AI training, based on the documents we reviewed. Section H limits API use for spamming and rate-limit evasion, and section 7 of the [Acceptable Use Policies](https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies) bans using information from the service for spam or "selling personal information, such as to recruiters, headhunters, and job boards." The current terms also include section D.9, an access reciprocity clause. A party with 700 million or more monthly active users that uses automated means to collect public GitHub content for a commercial AI system waives its own terms that would restrict GitHub's access to its public data. That affects some large buyers, not your right to license private code. The real limits sit in the code. Section D.6 says when you add content to a repository with a license notice, "you license that Content under the same terms," so outside contributions to licensed repositories arrive under that license, and open-source dependencies keep their own licenses. ## Which GitHub plan and roles do you need? Any plan can clone what a user can read. Organization-wide archives need an organization owner. - Organization owner role for the migrations API - A token type the migrations endpoints accept, since fine-grained personal access tokens and GitHub App tokens are not supported - Enough storage and a plan to download within seven days ## What personal data is in a GitHub export? Code looks impersonal but is not. Commit history carries author names and email addresses, issues and pull requests hold usernames and comments, and test fixtures or logs sometimes contain real customer records. ### The US position In the US, start with California. The CCPA defines a sale as making personal information available "for monetary or other valuable consideration" (Cal. Civ. Code § 1798.140(ad)(1)), and a license fee from an AI buyer fits that wording on its face. Employee and business-contact data have been in scope since January 1, 2023, when the temporary exemptions expired. Data counts as deidentified under § 1798.140(m) only if you take reasonable measures so it "cannot be associated" with a person, publicly commit to keep it that way and contractually bind every recipient. Our [de-identification guide](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) explains how to meet that standard, and our [guide to the CCPA and state privacy laws](https://sellmydatatoai.net/guides/gdpr-and-selling-data-for-ai-training) covers the other states. Other comprehensive state privacy laws, including those in Virginia, Colorado and Texas, define sales and exemptions in their own words, and several treat employee data differently from California. Map where the people in your export live before you rely on any one state's rules. Repositories for health or fintech products can hold sample patient or account data, so scan for HIPAA or GLBA-covered records before export. HHS recognizes two de-identification methods under 45 CFR 164.514(b), Expert Determination and Safe Harbor, which removes 18 types of identifiers. The FTC says financial institutions under the Gramm-Leach-Bliley Act must explain customers' right to opt out of certain sharing with nonaffiliated third parties. Your own privacy promises still bind you. FTC staff wrote on February 13, 2024 that adopting more permissive data uses, such as AI training, through a "surreptitious, retroactive amendment" to terms or a privacy policy could be unfair or deceptive. Check the privacy notice, employee handbook and customer contracts in force when the data was collected. ### If you hold UK or EU data UK GDPR and EU GDPR treat names, email addresses and message content about identifiable people as personal data. Licensing it for AI training is a new purpose, so you need a lawful basis under Article 6 and a compatibility assessment under Article 6(4), which the ICO covers in its guidance on compatibility and the reuse of personal information. This page is general information, so confirm your position with your own counsel. ## What third-party content is in a GitHub export? Most company repositories include code your company did not write. Vendored dependencies, copied snippets, forks of open-source projects and contractor commits all need checking, and secrets such as API keys must be purged from history. Confirm employee and contractor IP assignments and record each dependency's license. Our guide to [selling source code to AI companies](https://sellmydatatoai.net/guides/sell-source-code-to-ai-companies) covers the full review. ## How do you prepare a licensable GitHub export? Preparing a GitHub export for a buyer starts with the extraction route and ends with a manifest. Work through these steps in order. 1. **Inventory repositories and contributors**: List each repository, its license file, outside contributors and whether it was ever public. 2. **Scan for secrets and personal data**: Run secret scanning across full history and remove keys, credentials and customer records before export. 3. **Export code with context**: Clone with history and pull issues and pull requests through the REST API, or download a migration archive within seven days. 4. **Remove third-party content**: Take out client code, vendored dependencies with incompatible licenses and contractor work without an IP assignment unless the other party has agreed in writing, and keep privileged legal material out entirely. 5. **De-identify and test**: Replace names, user IDs and email addresses across the GitHub export, then run a re-identification test on a random sample, as our [de-identification guide](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) describes. 6. **Write the manifest**: Record record counts, date ranges, systems, exclusions and the export method in a [data manifest](https://sellmydatatoai.net/guides/how-to-build-a-data-manifest) that matches what you deliver. 7. **Get counsel's sign-off**: Ask your own counsel to review the GitHub terms, your order form and your privacy notices together before any buyer sees a sample. If you want a view on whether your GitHub data is licensable and what buyers might pay, start with a [data valuation](https://sellmydatatoai.net/data-valuation). We are a broker, not a law firm, so take independent legal advice before you sign any license. ## Frequently asked questions ### Does GitHub own the code in my private repositories? No. Section D.3 of the GitHub Terms of Service says "You own Your Content," and section E.3 says you control access to your private repositories. GitHub staff do not access private repository content without consent except for security, support, service integrity or legal reasons. Ownership against GitHub leaves the rights of contractors, clients and open-source authors to check separately. ### Can open-source code in my repository go into an AI training license? It depends on each license, and you should treat it separately from your own code. Section D.6 of the GitHub Terms of Service says content added to a licensed repository is licensed under the same terms, and dependencies keep their own licenses. Some licenses impose attribution or share-alike conditions that a buyer may not accept. Record each license and ask your own counsel which code to include. ### Does GitHub train AI on my private repositories? Section E.3 of the GitHub Terms of Service says GitHub will not use private repository content to develop or improve the service, unless you provide it as input to AI features. In that case GitHub may use the input to develop and improve AI features, subject to the opt-out described in section J.3. Check your account settings and your GitHub Customer Agreement, if you have one. ### What should I remove from a repository before licensing it? Remove secrets such as API keys and credentials from the full history, real customer or employee records in fixtures and logs, client-owned code, and dependencies whose licenses you cannot meet. Check commits from contractors without IP assignments. Then document what you removed in a manifest, because buyers will check the history for anything you missed. ## Sources - [GitHub Terms of Service](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service), GitHub Docs, accessed November 2026 - [GitHub Acceptable Use Policies](https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies), GitHub Docs, accessed November 2026 - [REST API endpoints for organization migrations](https://docs.github.com/en/rest/migrations/orgs), GitHub Docs, accessed November 2026 - [California Consumer Privacy Act of 2018, Civil Code section 1798.140](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf), California Privacy Protection Agency, accessed November 2026 - [California Consumer Privacy Act employee and B2B exemptions expire January 1, 2023](https://www.morganlewis.com/pubs/2022/10/california-consumer-privacy-act-employee-and-b2b-exemptions-expire-january-1-2023), Morgan Lewis, accessed November 2026 - [AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), Federal Trade Commission, accessed November 2026 - [Guidance Regarding Methods for De-identification of Protected Health Information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), U.S. Department of Health and Human Services, accessed November 2026 - [Gramm-Leach-Bliley Act](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act), Federal Trade Commission, accessed November 2026 - [Compatibility and the reuse of personal information](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/compatibility-and-the-reuse-of-personal-information/), Information Commissioner's Office, accessed November 2026 - [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), EUR-Lex, accessed November 2026 --- Get a data valuation: https://sellmydatatoai.net/data-valuation