GitHub has made separate controls for identity and content collection available in GitHub Copilot
According to GitHub, enterprise administrators can link GitHub Copilot activity to specific users without collecting prompts and responses. Five content categories can be controlled separately. Identity collection and collection of all content categories are disabled by default.
GitHub has announced new data collection controls for enterprise administrators of GitHub Copilot. According to the company, activity can be linked to a specific user without recording prompts, responses or tool content. Detailed settings are available in Copilot CLI, GitHub Copilot app and VS Code editor sessions using Agent Host.
The telemetry.capture.identity setting adds the GitHub account login name, the local operating system account name and the computer name to OpenTelemetry data. Identity collection is disabled by default and remains separate from the existing pseudonymous user identifier. Administrators can also independently control five content categories: prompts and input context, responses and supported reasoning content, tool arguments and definitions, tool results and error details, and raw policy details including filesystem paths.
Each content category is disabled by default. Explicitly set, centrally managed values take precedence over local settings, SDK configuration and environment variables. The existing captureContent setting remains a shared shorthand for the five content categories, but never enables identity collection. According to GitHub, captured data may contain source code, file contents, commands or paths to the workspace and user profile.
Why it matters
Centrally managed settings determine the scope of collection even where local configurations differ between computers. For an audit, user identification can be enabled and only the necessary content categories selected, allowing the amount of sensitive data sent to the collection system to be limited.
Two audiences, two different impacts
What this means
For individuals
If an administrator enables identity collection, your work activity may be linked to your login name, local account and computer even without recording prompts and responses.
More practical updates →For a business
A company can configure employee activity tracking separately from work content collection. This allows it to tailor the scope of an audit to its oversight needs and the risk of transmitting source code or file contents.
Risks and complianceCheck the original
Event sources
clearly official source · 1 publisher, 0 independent. We count feeds from the same owner only once.