Based on https://github.blog/changelog/2026-03-25-updates-to-our-privacy-statement-and-terms-of-service-how-we-use-your-data/ https://github.blog/changelog/2026

Based on https://github.blog/changelog/2026-03-25-updates-to-our-privacy-statement-and-terms-of-service-how-we-use-your-data/ https://github.blog/changelog/2026-03-25-updates-to-our-priv..., it looks like they are going to go for “legitimate interest” which seems clearly overridden by data subject interests in this case, hence not lawful. If you don't want to wait until your PII inevitably gets sent through, you can already now file a complaint to your local supervisory authority: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en https://www.edpb.europa.eu/about-edpb/about-edpb/members_en