Microsoft Copilot Human Contractors Review User Photos and AI Prompts, Raising Privacy Concerns

Human Contractors Access Microsoft Copilot User Data

Microsoft has hired hundreds of human contractors to review user prompts and images submitted to its Copilot AI image editor, according to documents obtained by 404 Media1

1

4

4

. These human reviewers can see the original photos users upload, the AI prompts they submit, and the AI-generated content produced by Microsoft Copilot. What raises immediate privacy concerns is that uploaded photos of real people reach contractors with faces completely uncensored3

3

.

In each assignment, a contractor receives the user's prompt and original image along with two edits produced by the AI image editor. Their task is to decide which version better follows the instructions across four areas: whether Copilot completed the requested edit, left unrelated parts unchanged, avoided visible defects, and produced a strong image overall2

2

. Microsoft's instructions tell contractors to "trust your intuition" and rely on gut reactions when evaluating which AI-generated edit feels better1

1

.

Disturbing Content Floods Review Queues

Many of the AI prompts human contractors encounter are sexual, disturbing, or potentially illegal. Reviewers reported seeing requests to enlarge women's breasts, shorten their skirts, reveal more of their legs, or place people in sexual positions2

2

. Other assignments included upskirt photos, pro-anorexia content, and fetish images involving children's cartoon characters1

1

4

4

.

"Faces are always uncensored, and many of the prompts are sexual in nature and dubiously consensual," one contractor who works on reviewing user prompts told 404 Media under condition of anonymity3

3

. The ethical implications extend beyond privacy concerns into potential nonconsensual content creation. Contractors described opening assignments without warning about what they contained. "I just came across an image set that consisted of eight upskirt photos," one reviewer wrote while requesting an unsafe-content flag2

2

. Another contractor said they "recoiled" after encountering pro-anorexia content4

4

.

Contractors Assess Quality, Not Safety

What makes this practice particularly concerning is that human reviewers are not hired to moderate harmful content or determine whether Microsoft Copilot should have accepted certain requests. Their job is purely to judge the quality of the AI's response2

2

. In some cases, that means deciding which output more closely matches a user's request for a sexualized edit—for example, whether breasts were enlarged as requested1

1

.

"Who is writing these prompts and who is deciding that basically generating porn is what Copilot is now focused on?" one contractor wrote on an internal message board. "It's hard to take things seriously when my focus has to be what model generated the appropriate bust size or which middle-aged woman was put in the appropriate sexually suggestive position"2

2

4

4

. Contractors aren't required to flag objectionable content—they simply log whether the AI tool accurately fulfilled the request1

1

.

Microsoft's Data Handling Practices Under Scrutiny

Microsoft defended the practice by pointing to its terms of use. "Microsoft uses customer data as described in our terms of use, including to improve our products and enforce our code of conduct," a Microsoft spokesperson told 404 Media1

1

3

3

. The company's Copilot privacy documentation acknowledges that some conversations can be subject to automated and human review for product improvement and digital safety5

5

.

Microsoft does offer harmful content protection to filter out sexual and offensive content, but organization administrators can disable this feature1

1

. Users cannot opt out of human review when Microsoft investigates suspected violations of its Code of Conduct5

5

. The company advises users not to share information they would not want reviewed, yet many users assume their conversations and uploaded photos remain private unless they violate policies4

4

.

Industry-Wide Pattern Emerges

Microsoft Copilot is not alone in this practice. Earlier reporting by 404 Media found that OpenAI has hired thousands of poorly paid overseas contractors to review ChatGPT prompts1

1

3

3

. Tech companies have long used contractors to moderate online content and label data for AI model training, but the Copilot assignments serve a different purpose—comparing outputs to improve accuracy and ability to follow prompts rather than screening for safety2

2

.

At least one company hiring contractors for Microsoft is Prolific, which offers human feedback for preference tuning, safety evaluations, and AI benchmarks2

2

3

3

. Prolific did not respond to requests for comment from 404 Media. The documents indicate that at least hundreds of human reviewers sometimes see Microsoft Copilot submissions, meaning uploaded photos and prompts may be viewed by multiple contractors as part of the evaluation process2

2

.

What Users Should Watch For

This revelation exposes the hidden human element that AI companies employ to run and improve their technology—an aspect not made clear to the public4

4

. The average user assumes their conversations and uploaded photos aren't being viewed by other people except for moderation purposes. The reality is that human contractors, often not well compensated, are expected to view disturbing and potentially traumatizing content including nonconsensual imagery4

4

.

Microsoft recently launched a new Copilot app with coding tools and an always-on agent called Autopilot3

3

. As AI image editing capabilities expand, questions about data handling practices and privacy protections will intensify. Microsoft says it excludes identifying information in images from AI model training after de-identification, metadata removal, and face blurring, though privacy rules differ depending on the Copilot product and how it's used5

5

. Users should check relevant privacy settings and terms before uploading sensitive material, and avoid sharing confidential documents or highly sensitive photographs containing private information unless they fully understand the service's data handling practices5

5

.