Microsoft pays people to look at photographs that users send to Copilot. The arrangement comes from internal documents obtained by 404 Media, which reported on 28 September 2026 that contractors reviewing the assistant's image editing see the pictures unaltered, faces included, and that many of the requests they handle are sexual. Their task is not to police what people ask for. It is to decide which of two AI edits looks better.
What a reviewer actually does
When someone asks Copilot to change a photo, the service generates two edits to choose between. A contractor sees the prompt the user typed, the picture they uploaded and the two edits Copilot produced, then picks the better one, as 404 Media's reporting describes and The Next Web reproduced. The judgment covers four things: whether the edit followed the instruction, whether the rest of the image stayed unchanged, whether it introduced visible distortions, and how good it looks overall. The instructions tell reviewers that their instinct as a human viewer is part of the assessment.
The service is a general purpose image editor: a user uploads a picture and asks for a change, and the result is based on the photograph they supplied, so the material reaching a reviewer is regularly a photograph of a real person. The reviewers see the prompt text as well as the image, which means the request in the user's own words is part of what they read whether or not a file is attached.
The work reaches them through vendor firms rather than from Microsoft directly. The documents behind the reporting include instruction guides, the prompts and pictures involved and the contractors' own internal message boards. Prolific, which 404 Media identified as at least one company hiring reviewers for Copilot, did not answer questions about the arrangement.
The reviews are not moderation
Contractors are paid to rate the quality of Copilot's output, 404 Media reported, not to flag offensive or harmful requests. That distinction shapes what the workers describe. A sexual edit request is an ordinary task, and nothing in their instructions tells them to treat it as a problem rather than a job.
One contractor told 404 Media: "Faces are always uncensored, and many of the prompts are sexual in nature and dubiously consensual." Contractors described requests to shorten women's skirts, enlarge their breasts or put people into sexual positions. One reported a set of eight upskirt photos and asked for an unsafe-content flag on the task, a mechanism that exists but is not part of what they are asked to do. Others said they had seen pro-anorexia content, and one reported a prompt that seemed designed to create a suggestive image of a group of young girls.
On an internal message board, a contractor wrote: "Who is writing these prompts and who is deciding that basically generating porn is what Copilot is now focused on?"
None of this arrives through a moderation queue. It is the material that passes through a quality check on an image editing feature, so the reviewers' descriptions read the way they do: the work asks whether an edit matched the request, and the request is sometimes disturbing. The examples are the ones the contractors described, and the discomfort in their accounts is part of the report rather than an afterthought.
What Microsoft's published terms say
Microsoft told 404 Media that it uses customer data as described in its terms of use, including to improve its products and enforce its code of conduct. The published terms are more specific than the chat window suggests. Copilot may include both automated and manual processing of data, by Microsoft's own wording, and the terms warn users not to share anything with Copilot that they do not want Microsoft to review.
The Copilot privacy FAQ makes the same point in plainer language: some Copilot conversations are subject to both automated and human review for product improvement and digital safety purposes, and an opt-out of human review is not available. Files shared with Copilot, including uploaded images, are stored securely for no longer than 18 months before they are deleted. That FAQ covers the Copilot app for web, desktop and mobile, and Microsoft shipped an updated version of that app on 18 August 2026.
Read together, those statements describe three separate things. Human review exists. It applies to some conversations, not all. And it cannot be switched off.
The stated purposes are also two, and they point in different directions: improving a product and enforcing a code of conduct. The reviewers' task is the first, rating whether an edit was good, and their accounts of what they see come out of a quality process rather than out of the second.
For someone who uploads a photograph to have a background tidied, the practical question is which requests reach a person, and the terms do not let the user decide in advance. The policy's guidance is a warning rather than a setting.
What the documents add to the published policy
Microsoft's spokesperson pointed to those terms, and the privacy FAQ is public, so the practice the documents describe sits inside what Microsoft discloses. What the internal documents add is what the policy looks like when it runs: photographs arriving with faces visible, a queue heavy with sexual requests, and reviewers grading a system's output without a mandate to act on what they see.
That last point is the one the contractors return to. Rating an edit is a quality judgment about a tool; moderating a request is a judgment about a person. Only the first is in their instructions.
The measure of the change is what a user can be expected to know before uploading. Microsoft's documentation says plainly that a person may read some conversations, and the same pages say the setting to prevent it does not exist. The photograph and the edit trade for each other, and the review is part of what the exchange involves.
A review of the kind the contractors describe happens as a request is handled, and the file then stays in Microsoft's systems, securely, for no longer than 18 months. Microsoft's own terms give the only guidance available to the person who uploaded it: do not share anything with Copilot that you do not want reviewed.