GitHub Copilot Telemetry: Identity and Content Controls

GitHub announced fine-grained Copilot client telemetry settings on October 12, 2026. Enterprise administrators can optionally attach user and device identity to OpenTelemetry records without automatically collecting prompts, responses or tool content. The distinction matters because usage attribution and content inspection serve different purposes and carry different privacy risks.

Identity is separate from five content classes

The telemetry.capture.identity control adds the authenticated GitHub login, the local operating-system user name and the host name. GitHub says identity capture is off by default and remains separate from the existing pseudonymous identifier. Administrators can independently control prompts, responses, tool arguments, tool output and policy detail.

GitHub states that each class is off by default. Managed values override local settings, SDK configuration and environment variables. The legacy captureContent switch remains as a shorthand for the five content classes, but GitHub says it never enables identity. Support varies by client, so a policy file should be checked against the specific Copilot CLI, app or VS Code Agent Host version in use.

Content capture can be highly sensitive

The announcement warns that prompt, tool and policy records can contain source code, files, commands, tool results and workspace or user-profile paths. Tool arguments may also identify MCP servers, plugins and hooks. An organization should therefore treat the collection endpoint as a system receiving potentially sensitive development data, not as an ordinary anonymous pageview counter.

Start from a defined audit question. If the goal is adoption counts by user, content fields may be unnecessary. If incident investigation requires tool errors, a narrower class and short retention period may be sufficient. Do not collect a broad stream first and search for a purpose later. Test redaction, access control, deletion and failure behaviour before production rollout.

Consent, notice and Canadian workplace context

Workplace monitoring can engage privacy, employment and collective-agreement obligations that vary by province, sector and workforce. The GitHub settings do not decide whether a proposed collection is lawful or proportionate. Canadian employers should involve privacy, security and labour stakeholders, document purpose and retention, and provide clear notice before connecting identity to developer activity. Obtain qualified advice for consequential monitoring.

Verify the approved OpenTelemetry endpoint and prevent accidental export to a personal or test collector. Use a non-sensitive workspace to confirm exactly which attributes arrive for each enabled switch. Review access logs and delete the test data. These are operational safeguards proposed by AI Speed Canada; the announcement does not report measured privacy outcomes.

Sources and editorial method

We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.

GitHub: client telemetry user attribution and configurable capture ↗ — Primary announcement dated October 12, 2026; accessed October 13.
GitHub Docs: enterprise managed settings ↗ — Official settings schema and example showing separate telemetry capture controls.