---
title: "Data Collected"
description: "See what data is collected by the Sentry Java SDK."
url: https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected/
---

# Data Collected | Sentry for java.util.logging

Sentry takes data privacy very seriously and has default settings in place that prioritize data safety, especially when it comes to personally identifiable information (PII) data. When you add the Sentry SDK to your application, you allow it to collect data and send it to Sentry during the runtime of your application.

The category types and amount of data collected vary, depending on the integrations you've enabled in the Sentry SDK. This page lists data categories that the Sentry Java SDK collects. Use [`dataCollection`](https://docs.sentry.io/platforms/java/guides/jul/configuration/options.md#dataCollection)to control automatic collection for supported categories.

After you configure any Data Collection field or call `options.getDataCollection().forceDataCollection()`, unconfigured fields use their documented defaults.

Data Collection controls only data added automatically by SDK integrations. Data you add through scopes, event processors, `beforeSend`, or other APIs is still sent.

## [HTTP Headers](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#http-headers)

Request and response headers use `DENY_LIST` by default. Supported integrations collect header names and non-sensitive values while replacing sensitive values with `"[Filtered]"`.

Configure [`dataCollection.httpHeaders.request`](https://docs.sentry.io/platforms/java/guides/jul/configuration/options.md#dataCollection) and [`dataCollection.httpHeaders.response`](https://docs.sentry.io/platforms/java/guides/jul/configuration/options.md#dataCollection) to control header collection. `Cookie` and `Set-Cookie` values in the general HTTP header map are always replaced with `"[Filtered]"`; use `dataCollection.cookies` to control separately collected cookie data. Servlet and Spring integrations can collect incoming request headers. OkHttp, Ktor Client, and Apollo can attach request and response headers to captured HTTP client errors.

## [Cookies](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#cookies)

Cookies use `DENY_LIST` by default. Supported integrations collect cookies while replacing sensitive values with `"[Filtered]"`. Use `dataCollection.cookies` to control cookie collection.

## [Information About Logged-in User](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#information-about-logged-in-user)

`dataCollection.userInfo` allows integrations to populate user identity information automatically, including Spring Security usernames and the user's IP address. It defaults to `true`. Set it to `false` to disable automatic user enrichment. User information you set explicitly with `Sentry.setUser()` or on a scope isn't removed.

## [Users' IP Addresses](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#users-ip-addresses)

When `dataCollection.userInfo` is `true`, the SDK adds `"{{auto}}"` as the user's IP address so Sentry can infer it from the connection. Set `dataCollection.userInfo=false` to disable automatic IP enrichment.

## [Request URL](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#request-url)

The request URL (without the query string) of outgoing and incoming HTTP requests is **always sent to Sentry**. Depending on your application, this could contain PII data.

## [Request Query String](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#request-query-string)

Query parameters use `DENY_LIST` by default. Use `dataCollection.urlQueryParams` to filter or disable query string collection for instrumented incoming and outgoing URLs, including HTTP spans and breadcrumbs created by integrations such as Spring and OpenFeign.

## [Request Body](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#request-body)

All request and response body directions are enabled by default, but integrations collect body content only where supported:

* Spring MVC collects incoming request bodies.
* Apollo 3 and 4 collect outgoing request and incoming response bodies for captured HTTP client errors.
* GraphQL Java collects outgoing response bodies when reporting GraphQL errors.

Other HTTP integrations may collect body-size metadata without collecting body content. Body-size metadata remains available when content collection is disabled.

Use `dataCollection.httpBodies` to choose which directions to collect or an empty set to disable body content collection.

For Spring and Spring Boot, incoming request body content is limited to JSON and form bodies that meet the configured [`maxRequestBodySize`](https://docs.sentry.io/platforms/java/guides/jul/configuration/options.md#maxRequestBodySize). The default is `NONE`, so incoming request body content isn't collected until this option is configured.

## [Source Context](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#source-context)

Our build tool plugins for Gradle and Maven can upload your source code to Sentry, which can then used to show the lines of code where an error happened in the Issue Details page.

To opt into sending this source context to Sentry, you have to enable the feature as described in [the Source Context documentation](https://docs.sentry.io/platforms/java/guides/jul/source-context.md).

## [File I/O](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#file-io)

File I/O instrumentation collects file names and absolute paths by default. Set `dataCollection.filePaths=false` to omit them. File extensions and byte counts remain available when paths are disabled.

## [Log Messages](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#log-messages)

By default the Sentry SDK does not send unencoded Logback messages and parameters if an encoder has been set. It will however send the encoded message.

Set `includeUnencodedMessage=true` on the Sentry appender to include the original message and parameters. Data Collection doesn't filter log messages or breadcrumb content. Use `beforeBreadcrumb` for breadcrumbs, `beforeSend` for events, or `options.getLogs().setBeforeSend(...)` for Sentry Logs when you need application-specific filtering.

## [GraphQL Data](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#graphql-data)

GraphQL document and variable collection default to `true`. Use `dataCollection.graphql.document` and `dataCollection.graphql.variables` to disable either category. Operation metadata used for tracing and grouping can still be collected when document or variable content is disabled.

## [OpenTelemetry Attributes](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#opentelemetry-attributes)

Data Collection doesn't filter attributes added by OpenTelemetry instrumentation or your application. Configure the instrumentation that produces them, or scrub them with `beforeSendTransaction`.

## [SQL Queries](https://docs.sentry.io/platforms/java/guides/jul/data-management/data-collected.md#sql-queries)

While SQL queries are sent to Sentry, neither the full SQL query (`UPDATE app_user SET password='supersecret' WHERE id=1;`), nor the values of its parameters will ever be sent. A parameterized version of the query (`UPDATE app_user SET password=? WHERE id=?;`) is sent instead.