Sentry is retiring sendDefaultPii in favour of a new dataCollection option, available since JavaScript SDK v10.57.0 and becoming the default from v11 onward, with each language SDK rolling it out on its own schedule. The old setting was a single switch: on, and every crash report could carry request bodies, cookies, and user identity; off, and you got a stripped-down event with little debugging context. dataCollection splits that switch into named categories — user identity, HTTP header names, database queries, GenAI inputs and outputs — and v11’s unset default turns several of them on, because Sentry decided crash reports should be useful without a manual setup pass. For a team that never explicitly configured sendDefaultPii, upgrading the SDK quietly changes what leaves the app on every error, not just what a config file says.
That matters because crash and error tracking sits closest to production data of any tool in a typical stack — it’s designed to capture the exact state of a request when something breaks, which is precisely when it’s most likely to contain something sensitive. A team that never opted in under the old binary switch could find itself opted into partial PII collection under the new granular one, without anyone changing a line of code beyond a version bump. Compliance teams that signed off on a sendDefaultPii: false configuration have no guarantee that judgment carries over to dataCollection’s defaults, and “we didn’t change our Sentry config” stops being a valid answer to “why is user data showing up in error reports” once the SDK’s own defaults have moved.
Data Points to Track
- SDK version per platform, so you know exactly which services have crossed the v10-to-v11 boundary and inherited the new defaults, and which are still on the old switch
dataCollectioncategory values currently in effect (user identity, header names, database queries, GenAI I/O) versus what your team believes is configured- Header value filtering hits, confirming
auth,token,password, andsecret-pattern values are still being replaced with[Filtered]after the upgrade - Span streaming volume, since v11 sends spans in batches as they finish rather than bundling them into one transaction, which changes ingest and quota patterns even without a PII concern
- GenAI input/output presence in captured events, for any service that calls an LLM and now has prompts or completions attached to error reports by default
Setup Steps
- Inventory every service’s Sentry SDK version before it auto-updates, and flag which are still on
sendDefaultPiiversus already exposed todataCollectiondefaults. - Explicitly set
dataCollectioncategories rather than relying on the unset default, so an SDK upgrade can’t silently change what’s captured. - Re-run your PII compliance review against the new category list, not the old boolean, since “PII off” no longer maps cleanly onto the new options.
- Add a CI or dependency check that flags a Sentry SDK major-version bump, so the v11 rollout doesn’t arrive as a surprise inside an unrelated dependency update.
- Sample recent production events post-upgrade and manually check for user identity, headers, or GenAI content that wasn’t present before, confirming your explicit configuration is actually being honoured.
Actionable Insights
The moment you can see dataCollection category values alongside SDK version per service, an unexpected appearance of user data in error reports stops being a mystery and becomes a diagnosis: check whether that service crossed the v11 boundary without an explicit override. Longer term, the category-level breakdown is a better lens than the old binary ever was — it lets a team keep GenAI inputs and database queries flowing to debug an AI feature while still holding a hard line on user identity, instead of trading all context away to avoid one category of risk.
Related Resources
Need help tracking this in your app?
Our team sets up analytics pipelines for mobile and web teams every day. Talk to us and get your first events flowing in under an hour.
Talk to an expert