From one switch to a control panel: meet `dataCollection`

Summary

Sentry is replacing the JavaScript SDK boolean option sendDefaultPii with dataCollection, a category-level control for automatically collected data. In version 11, dataCollection becomes the default, sendDefaultPii is removed, and several categories—including user information, cookies, HTTP bodies, GenAI inputs and outputs, database query data, and stack-frame variables—are collected by default. The post distinguishes PII, which is collected by default, from sensitive credentials, whose values in collected headers are filtered automatically; manually attached data remains unaffected. Developers can preserve v10’s restrictive baseline or select true, false, allow lists, and deny lists for supported fields, while beforeSend and beforeSendSpan handle additional filtering. Because v11 also enables span streaming by default, span drops move to ignoreSpans, and existing withStreamedSpan wrappers should be removed.

Takeaways

1. 1

   With JavaScript SDK v11, an unset dataCollection collects more than the previous restrictive v10 default, including request and response bodies, user information, cookies, GenAI inputs and outputs, and database query data.

2. 2

   Manually attached data is still sent even when its category is disabled; for example, setting userInfo to false does not prevent explicitly supplied data from Sentry.setUser(...) from being sent.

3. 3

   Span streaming is enabled by default in v11. Span modifications use beforeSendSpan, span drops use ignoreSpans, and beforeSendTransaction or ignoreTransactions are unavailable once streaming is active.