docs(sdks): Add spec for `dataCollection` option to supersede `sendDefaultPii` by s1gr1d · Pull Request #16796 · getsentry/sentry-docs

s1gr1d · 2026-03-05T13:34:46Z

This PR extends the Data Collection spec so it is the single place for what SDKs collect and how they scrub it. It adds concrete denylist behavior, request-body and cookie rules, and pulls in the relevant scrubbing behavior from the Data Handling doc.

Data Collection spec (/sdk/foundations/client/data-collection/)
- https://develop-docs-git-sig-data-collection-options.sentry.dev/sdk/foundations/client/data-collection/

IS YOUR CHANGE URGENT?

Help us prioritize incoming PRs by letting us know when the change needs to go live.

Urgent deadline (GA date, etc.):
Other deadline:
None: Not urgent, can wait up to 1 week+

SLA

Teamwork makes the dream work, so please add a reviewer to your PRs.
Please give the docs team up to 1 week to review your PR unless you've added an urgent due date to it.
Thanks in advance for your help!

PRE-MERGE CHECKLIST

Make sure you've checked the following before merging your changes:

Checked Vercel preview for correctness, including links
PR was reviewed and approved by any necessary SMEs (subject matter experts)
PR was reviewed and approved by a member of the Sentry docs team

vercel · 2026-03-05T13:34:55Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
develop-docs	Ready	Preview, Comment	Mar 9, 2026 9:38am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
sentry-docs	Ignored	Preview	Mar 9, 2026 9:38am

stephanie-anderson · 2026-03-09T06:28:51Z

develop-docs/sdk/expected-features/data-handling.mdx

This page does not exist anymore - we moved the PII related content to
https://develop.sentry.dev/sdk/foundations/data-scrubbing/

cleptric · 2026-03-09T12:02:41Z

We should include some more general information, such as how we expect the default snippet too like now, which is very minimal and in-line with the behavior of sendDefualtPii.

sentry.init({
  dsn: '...',
})

// or with user information

sentry.init({
  dsn: '...',
  dataCollection: {
    includeUserInfo: true,     
  }
})

and also mention the reasoning of this change. In particular, we should highlight that we now include more context by default, without a change in our position to be privacy first.

itaybre

This make sense, but got some questions here

itaybre · 2026-03-09T20:50:02Z

develop-docs/sdk/foundations/client/data-collection/index.mdx

+
+The following terms **MUST** be included in the default denylist for headers, and **SHOULD** be applied to cookies and query params where applicable:
+
+`["auth", "token", "secret", "password", "passwd", "pwd", "key", "jwt", "bearer", "sso", "saml", "csrf", "xsrf", "credentials", "session", "sid", "identity"]`


m: We have some additional filtered headers on cocoa that may be relevant here (https://github.com/getsentry/sentry-cocoa/blob/main/Sources/Swift/Core/Tools/HTTPHeaderSanitizer.swift#L8): X-REAL-IP and REMOTE-ADDR

itaybre · 2026-03-09T20:53:31Z

develop-docs/sdk/foundations/client/data-collection/index.mdx

+- SDKs **SHOULD** maintain a default denylist of cookie names using the same matching rule (e.g. `session`, `auth`, `identity`). Values for matching cookie names **MUST** be replaced with `"[Filtered]"`.
+- **When individual cookie key-value pairs cannot be extracted** (e.g. malformed or opaque cookie string), the entire `Cookie` or `Set-Cookie` header value **MUST** be replaced with `"[Filtered]"`. Unfiltered raw cookie header values **MUST NOT** be sent. When in doubt, treat the whole cookie header as sensitive.
+
+#### Request Bodies


m: Should the same apply for response bodies? This is (or will be, depends on the SDK) being recorded now for Session Replay

This configuration is set in SessionReplay configuration, it may be worth aligning there

itaybre · 2026-03-09T20:54:24Z

develop-docs/sdk/foundations/client/data-collection/index.mdx

+
+### User-Set Data and Scrubbing
+
+When the user **explicitly** sets data on the scope (user, request, response, tags, contexts, etc.) or on a span, log, or other telemetry, that data is **not** gated by `dataCollection`. It **MUST** always be attached to outgoing telemetry. The same applies to data the user provides via `beforeSend` or event processors.


Thanks for the clarification 👍

itaybre · 2026-03-09T21:05:36Z

develop-docs/sdk/foundations/client/data-collection/index.mdx

+- User identifiers (user ID, username, email)
+- IP address
+- Cookies and headers that identify the user or session
+- HTTP request data (TBD)


h: What about request paths?
Some requests may be identifiable, like /user/USER_ID
Should we have a denylist/allowlist for url paths?

Good question 🤔
What we currently do in JS: When we either know it's a param route, we use the appropriate parametrized route name (e.g. user/:id) as the transaction name but the full URL (e.g. user/123) is still added in the attributes. @cleptric Any opinions on that?

s1gr1d changed the title ~~docs(sdks): Add docs on dataCollection~~ docs(sdks): Add spec for dataCollection option to supersede sendDefaultPii Mar 5, 2026

s1gr1d requested a review from cleptric March 5, 2026 13:36

vercel bot deployed to Preview – develop-docs March 5, 2026 13:43 View deployment

s1gr1d force-pushed the sig/data-collection-options branch from 441172f to e99813b Compare March 5, 2026 13:58

vercel bot deployed to Preview – develop-docs March 5, 2026 14:05 View deployment

vercel bot deployed to Preview – develop-docs March 6, 2026 14:38 View deployment

stephanie-anderson reviewed Mar 9, 2026

View reviewed changes

dingsdax added the sdk-develop-docs PRs touching develop-docs/sdk label Mar 9, 2026

s1gr1d added 7 commits March 9, 2026 10:31

docs(sdks): Add docs on dataCollection

33a6fa6

fix typo

07f843e

review suggestions

c36a5d8

create technical spec (skill)

78d0895

explain pii info

88bcbae

change ordering

69badc9

add ai agent messages to migration

ae5020b

s1gr1d force-pushed the sig/data-collection-options branch from de9517c to ae5020b Compare March 9, 2026 09:31

vercel bot deployed to Preview – develop-docs March 9, 2026 09:38 View deployment

itaybre reviewed Mar 9, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs(sdks): Add spec for `dataCollection` option to supersede `sendDefaultPii`#16796

docs(sdks): Add spec for `dataCollection` option to supersede `sendDefaultPii`#16796
s1gr1d wants to merge 7 commits intomasterfrom
sig/data-collection-options

s1gr1d commented Mar 5, 2026 •

edited

Loading

Uh oh!

vercel bot commented Mar 5, 2026 •

edited

Loading

Uh oh!

stephanie-anderson Mar 9, 2026

Uh oh!

cleptric commented Mar 9, 2026

Uh oh!

itaybre left a comment •

edited

Loading

Uh oh!

itaybre Mar 9, 2026

Uh oh!

itaybre Mar 9, 2026

Uh oh!

itaybre Mar 9, 2026

Uh oh!

itaybre Mar 9, 2026

Uh oh!

itaybre Mar 9, 2026

Uh oh!

s1gr1d Mar 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants


		The following terms MUST be included in the default denylist for headers, and SHOULD be applied to cookies and query params where applicable:

		`["auth", "token", "secret", "password", "passwd", "pwd", "key", "jwt", "bearer", "sso", "saml", "csrf", "xsrf", "credentials", "session", "sid", "identity"]`


		### User-Set Data and Scrubbing

		When the user explicitly sets data on the scope (user, request, response, tags, contexts, etc.) or on a span, log, or other telemetry, that data is not gated by `dataCollection`. It MUST always be attached to outgoing telemetry. The same applies to data the user provides via `beforeSend` or event processors.

Uh oh!

Conversation

s1gr1d commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

IS YOUR CHANGE URGENT?

SLA

PRE-MERGE CHECKLIST

Uh oh!

vercel bot commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stephanie-anderson Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

cleptric commented Mar 9, 2026

Uh oh!

itaybre left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

itaybre Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

itaybre Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

itaybre Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

itaybre Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

itaybre Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

s1gr1d Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

s1gr1d commented Mar 5, 2026 •

edited

Loading

vercel bot commented Mar 5, 2026 •

edited

Loading

itaybre left a comment •

edited

Loading