GitHub announced new GitHub Copilot telemetry controls on October 12, 2026, allowing enterprise administrators to attribute activity to a user without necessarily capturing prompts, responses or tool content. The change concerns information exported to a monitoring system. It does not announce full recording for all users or automatic disclosure of conversations to employers.
The separation addresses a practical question: an infrastructure team may need to know which account and machine produced activity without needing what an employee wrote to an agent. The new option separates those requirements. Identified data is not anonymous, however, so identity-only collection still requires clear decisions about its purpose and who can see it.
Identity and content are separate
The telemetry.capture.identity setting adds user.name, the authenticated Copilot account name, currently the GitHub login; process.user.name, the local operating-system account; and host.name, the machine name, to OpenTelemetry data. Identity capture is off by default and separate from the existing pseudonymous identifier. This matters particularly for teams already exporting usage data and assuming every identifier retains its previous meaning.
There are also 5 independent content classes: prompts for instructions and supported context, responses for answers and supported reasoning content, toolArguments for arguments and commands, toolOutput for tool results and error details, and policyDetail for raw policy details such as file paths. Each is off by default. Teams can enable only the required type instead of treating all information as one bundle.
The older captureContent setting remains shorthand for enabling the 5 content classes, but does not enable identity capture. An explicit value for a class within capture overrides that shorthand for that class. When migrating a configuration, check actual values: an old toggle does not necessarily cover the new field, and one override does not disable every other class.
What to check during enterprise rollout
GitHub’s announcement lists fine-grained controls in Copilot CLI, the GitHub Copilot app and VS Code sessions using Agent Host. VS Code behavior also depends on the agent runtime, so do not assume every session exports identical fields. Before broad deployment, check the client version and received data to establish which settings are enforced and which attributes are actually sent.
In the managed configuration described by the announcement, explicit values take precedence over local settings, SDK configuration and environment variables. Teams therefore need to implement capture changes in the appropriate management layer. Changing one local key is not a reliable way to determine what the organization collects; the particular client’s behavior also needs checking.
GitHub warns that content capture can include code, files, commands, results and workspace or user-profile paths, and recommends enabling only necessary classes and sending them to an approved destination. Define the monitoring purpose, viewing permissions and retention period in advance. That can provide useful activity attribution without automatically expanding the sensitive-data collection beyond its purpose.