Copilot photo uploads can reach human reviewers, and faces reportedly aren’t blurred

Photos uploaded to Microsoft Copilot for editing can end up in front of human contractors, along with the instructions users type into the chatbot. A September 28 investigation by 404 Media found that workers review real uploads to assess AI image edits. One worker said faces remain uncensored.

That raises a straightforward Copilot privacy concern. People submitting pictures for an AI edit may not expect another person to see them. Some contractors also questioned whether the people pictured had consented to the sexualized changes users requested.

What can human reviewers see

Internal instructions obtained by 404 Media describe a side-by-side evaluation. Contractors receive the original picture and its accompanying prompt, followed by two Copilot-generated versions.

Workers described requests to shorten women’s skirts or place people in sexually suggestive positions. Reviewers therefore see the original photo alongside an explicit record of how someone wants it altered.

The privacy concern extends beyond the account holder. Someone whose photo another user uploads can appear in the review process without ever having opened Copilot themselves. An uncensored face leaves that person recognizable in material they might not know exists.

Why are workers reviewing these images

Reviewers check whether an edit follows the prompt and preserves details that should stay unchanged. They also assess visual defects and overall quality before choosing the better version.

For sexualized requests, that means judging how successfully Copilot made the requested changes. These assignments focus on output quality, rather than identifying content that should be blocked.

Some contractors complained about encountering disturbing images without warning. One asked for an unsafe-content flag after receiving a set of upskirt photos, illustrating how little warning workers could have about the next task.

What has Microsoft said about privacy

Microsoft told 404 Media that it uses customer data under its terms of use to improve products and enforce its code of conduct. Prolific, one company supplying contractors, didn’t respond to a request for comment.

The investigation doesn’t establish how frequently uploads reach reviewers or which account types are affected. Before submitting a sensitive photo, consider whether it’s something you’d be comfortable having a human reviewer see.