Microsoft Copilot Contractors Can See Uploaded Photos and Prompts, Investigation Finds

A September 2026 investigation reported that contractors assessing Microsoft Copilot image edits could see the uploaded photo, the user’s prompt and two AI-generated alternatives. A contractor said faces in the photos were not blurred. The reviewers’ job was to compare the edits—not simply decide whether a request was appropriate. 192

What contractors could see and how they rated edits

In the reported review tasks, contractors were shown the original image and prompt alongside two Copilot-generated edits. They judged which version better followed the instruction, preserved parts of the image that were meant to stay unchanged, avoided visual defects and looked better overall. 15

That distinction matters: the reported task was a quality comparison, not necessarily a content-moderation decision. So a reviewer’s assessment of which edit best fulfilled a request should not be read as evidence that the request was approved as appropriate. 1113

Reports included sexual requests and upskirt photos

The investigation described sexual image-editing requests, including requests involving upskirt photos and edits that sexualized people in images. 193 Those examples raise concerns about consent, but the reporting does not establish whether the people shown in any particular photo agreed to its upload or editing.

Microsoft’s terms say users should not share or capture images that include other people without their consent. 48 That is a stated rule; it does not answer whether consent was present in the individual cases described by the investigation.

Face-blurring statements refer to specific features

Microsoft documentation describes face blurring in particular contexts, including Copilot in Bing’s Visual Search and Copilot Studio’s prompt builder. 3843 Those statements concern those features and their image-processing workflows. They do not establish that the original photos shown to contractors in the reported consumer Copilot image-edit reviews were blurred. The investigation, citing a reviewer, reported that faces in those review tasks were visible. 192

The available information therefore describes different contexts rather than proving that one account covers every Copilot image workflow. Product and feature distinctions matter when interpreting privacy statements.

Training controls are not the same as a human-review opt-out

Microsoft’s Copilot privacy information describes controls for uses such as personalization and model training, while also listing service-related purposes for using conversations, such as troubleshooting, preventing abuse and improving performance. 3435 Those controls should not be treated as proof that a user can exclude an image edit from the contractor quality-review process described in the investigation.

The available sources also do not establish a control that lets someone pictured in a photo prevent its review when another person uploads it. In short, the evidence supports a specific finding about the reported review tasks, but leaves important questions about opt-outs—especially for people who appear in someone else’s upload—unanswered.