Evidence: Further notice

Claims and grades

1. "In August 2024 Microsoft excluded EEA consumer data from Copilot training 'until further notice.'"

Grade: CONFIRMED. Primary: Microsoft Copilot blog, 16 Aug 2024. The exclusion list of that period covered roughly 40 countries including all EEA states, the UK and Switzerland (contemporaneous documentation of the then-current privacy FAQ, Nov 2024).

2. "Microsoft's current exclusion list is six countries: Brazil, China (excluding Hong Kong), Israel, Nigeria, South Korea, Vietnam, plus users under 18 and users who opted out. The EEA is absent."

Grade: CONFIRMED. Primary: Microsoft Copilot Privacy FAQ, pulled fresh 1 Sep 2026 (re-pull on ship day; screenshot archived). Bracket on the change date: a third-party comparison of 23 Mar 2026 still described EU Copilot training as disabled by default, so the removal occurred between late March and August 2026. Wayback snapshots of both states linked below.

3. "Meta trains on public posts of EU adults since 27 May 2025, objection-based."

Grade: CONFIRMED. Primary: Irish Data Protection Commission statement, 21 May 2025. The objection route is an Article 21 form requiring the connected account, a contact email and country; some versions ask for a stated reason.

Flagged dispute, stated openly: one legal-analysis camp holds that Meta honors objections unconditionally, beyond Article 21's requirements; Meta's own consumer-facing language describes individual review with approval not guaranteed. The panel and post carry only the undisputed core (objection-based, form required).

4. "OpenAI's Europe Terms of Use, updated 16 January 2026: consumer plans train by default, opt-out toggle in Data Controls."

Grade: CONFIRMED. Primary: openai.com/policies/eu-terms-of-use, which carries the update date and a link to the previous version on the page itself. Clause wording re-read on ship day.

5. "GitHub Copilot flipped from opt-in to opt-out for Free, Pro and Pro+ interaction data. Published 25 Mar 2026, enforced 24 Apr 2026. Business and Enterprise excluded."

Grade: CONFIRMED. Primary: GitHub changelog, 25 Mar 2026. Scope note: repository content "at rest" is not trained on; interaction data generated while working in a repository can be. The change applied globally; no European exception was created.

6. "Every step above is GDPR compliant."

Grade: CONFIRMED as stated. The EDPB opinion of December 2024 opened the legitimate-interest path for AI training; the DPC statement of 21 May 2025 executed it for Meta. "Compliant" describes legal basis, not desirability; the post's closing claim ("GDPR did not change. Their estimate of it did.") is the author's interpretation, labeled as such.

Archived states

• https://web.archive.org/web/20260901063929/https://support.microsoft.com/en-us/microsoft-copilot/privacy-faq-for-microsoft-copilot
• https://web.archive.org/web/20240818104333/https://www.microsoft.com/en-us/microsoft-copilot/blog/2024/08/16/transparency-and-control-in-consumer-data-use/
• https://web.archive.org/web/20241115062939/https://www.microsoft.com/en-us/microsoft-copilot/for-individuals

Note on the panel title

The panel's title, "GDPR protects EU.", is quoted and subtitled as a common belief under test. It is not a claim of this page. The page's claims are items 1 to 6 above; the panel's red line ("No EU countries on the list.") is claim 2.

Scope fence

Everything on this page concerns consumer products. Enterprise and API tiers at all four vendors are contractually excluded from training by default. Microsoft 365 Copilot (commercial) is a different product with a different 2026 story (processing location and routing, not training) and is deliberately not mixed into this page.

Excluded

Grok: excluded from the analysis, unverified. Google: no EEA-specific training exception was found in any period checked; Google is therefore not an event on the timeline.