---
title: "Data Collected"
description: "See what data is collected by the Sentry Python SDK."
url: https://docs.sentry.io/platforms/python/data-management/data-collected/
---

# Data Collected | Sentry for Python

Sentry takes data privacy very seriously and has default settings in place that prioritize data safety, especially when it comes to personally identifiable information (PII) data. When you add the Sentry SDK to your application, you allow it to collect data and send it to Sentry during the runtime of your application.

The category types and amount of data collected vary, depending on the integrations you've enabled in the Sentry SDK. This page lists data categories that the Sentry Python SDK collects.

Options to control data collection

You can control many of the categories listed here with the [experimental `data_collection` option](https://docs.sentry.io/platforms/python/configuration/options.md#data_collection), which lets you opt in or out of each data category individually. Because it's experimental, it goes inside the `_experiments` dictionary in your `sentry_sdk.init()` call.

The [`send_default_pii` option](https://docs.sentry.io/platforms/python/configuration/options.md#send_default_pii) is still fully supported. We plan to eventually deprecate it in favor of `data_collection`, but that won't happen until a future major version.

How much data the SDK collects by default depends on which option you use. Without `data_collection` (and with `send_default_pii` unset or `False`), the SDK collects conservatively, and the defaults described on this page apply.

As soon as you pass a `data_collection` dictionary, the categories you don't set explicitly fall back to their `data_collection` defaults, which are more permissive. For example, cookies, query parameters (with sensitive values scrubbed), and AI message content are then collected unless you opt out. Setting `send_default_pii=True` is roughly equivalent to enabling all `data_collection` categories.

If you set both, `send_default_pii` is ignored entirely and the SDK emits a `DeprecationWarning`.

Regardless of these options, you can always scrub any data before it's sent to Sentry. See [Scrubbing Sensitive Data](https://docs.sentry.io/platforms/python/data-management/sensitive-data.md) for details.

## [HTTP Headers](https://docs.sentry.io/platforms/python/data-management/data-collected.md#http-headers)

By default, the Sentry SDK sends HTTP request headers to Sentry but filters out any headers that contain sensitive data. (See the [list of headers](https://github.com/getsentry/sentry-python/blob/master/sentry_sdk/integrations/_wsgi_common.py#L28-L35) that are filtered). The Python SDK doesn't capture response headers.

To send all HTTP headers, set `send_default_pii=True` in the `sentry_sdk.init()` call.

When using `data_collection`, request headers are collected with sensitive values scrubbed. Use `http_headers` to control this:

```python
import sentry_sdk

sentry_sdk.init(
    dsn="https://<key>@o<orgId>.ingest.sentry.io/<projectId>",
    _experiments={
        "data_collection": {
            # Collect nothing:
            "http_headers": {"request": {"mode": "off"}},
            # Or only send real values for the listed headers:
            # "http_headers": {"request": {"mode": "allowlist", "terms": ["content-type"]}},
            # Or collect everything, filtering additional terms:
            # "http_headers": {"request": {"mode": "denylist", "terms": ["-ip"]}},
        },
    },
)
```

Values whose keys match Sentry's built-in sensitive denylist (such as `auth`, `token`, or `password`) are always scrubbed, while the keys are kept. See [the `data_collection` reference](https://docs.sentry.io/platforms/python/configuration/options.md#data_collection) for details on `mode` and `terms`.

Additionally a [data scrubber](https://docs.sentry.io/platforms/python/data-management/sensitive-data.md) removes sensitive data from headers (and a lot of other fields) right before sending data to Sentry.

## [Cookies](https://docs.sentry.io/platforms/python/data-management/data-collected.md#cookies)

By default, the Sentry SDK doesn't send cookies. Sentry tries to remove any cookies that contain sensitive information, such as the Session ID and CSRF Token cookies in Django.

If you want to send cookies, set `send_default_pii=True` in the `sentry_sdk.init()` call.

When using `data_collection`, cookies are collected by default with sensitive values scrubbed. Opt out with `{"mode": "off"}`, or restrict which values are sent using `"allowlist"` or `"denylist"` mode:

```python
import sentry_sdk

sentry_sdk.init(
    dsn="https://<key>@o<orgId>.ingest.sentry.io/<projectId>",
    _experiments={
        "data_collection": {
            "cookies": {"mode": "off"},
        },
    },
)
```

Additionally a [data scrubber](https://docs.sentry.io/platforms/python/data-management/sensitive-data.md) removes sensitive data from cookies (and a lot of other fields) right before sending data to Sentry.

## [Information About Logged-in User](https://docs.sentry.io/platforms/python/data-management/data-collected.md#information-about-logged-in-user)

By default, the Sentry SDK doesn't send any information about the logged-in user, such as email address, user ID, or username. Even if enabled, the type of logged-in user information you'll be able to send depends on the integrations you enable in Sentry's SDK. Most integrations won't send any user information. Some will only set the user ID, but there are a few that will set the user ID, username, and email address.

To start sending logged-in user information, set `send_default_pii=True` in the `sentry_sdk.init()` call.

When using `data_collection`, the SDK populates user identity fields (`user.id`, `user.email`, `user.username`) from instrumentation by default. To disable this, set `user_info` to `False`:

```python
import sentry_sdk

sentry_sdk.init(
    dsn="https://<key>@o<orgId>.ingest.sentry.io/<projectId>",
    _experiments={
        "data_collection": {
            "user_info": False,
        },
    },
)
```

## [Users' IP Address](https://docs.sentry.io/platforms/python/data-management/data-collected.md#users-ip-address)

By default, the Sentry SDK doesn't send the user's IP address. Even if enabled, whether you're able to send the user's IP address or not, will depend on the integrations you enable in Sentry's SDK. Most integrations won't set the user's IP address at all.

To enable sending the user's IP address, set `send_default_pii=True` in the `sentry_sdk.init()` call.

When using `data_collection`, the user's IP address is sent by default. Disable it by setting `user_info` to `False`.

Even when this is disabled, IP addresses can still reach Sentry through collected HTTP headers, cookies, or query parameters (for example, the `X-Forwarded-For` header). If you use `data_collection`, add these terms to the deny lists for those categories so their values are filtered:

```python
import sentry_sdk

sentry_sdk.init(
    dsn="https://<key>@o<orgId>.ingest.sentry.io/<projectId>",
    _experiments={
        "data_collection": {
            "http_headers": {
                "request": {
                    "mode": "denylist",
                    "terms": ["forwarded", "-ip", "remote-", "via", "-user"],
                },
            },
            "cookies": {
                "mode": "denylist",
                "terms": ["forwarded", "-ip", "remote-", "via", "-user"],
            },
            "url_query_params": {
                "mode": "denylist",
                "terms": ["forwarded", "-ip", "remote-", "via", "-user"],
            },
        },
    },
)
```

## [Request URL](https://docs.sentry.io/platforms/python/data-management/data-collected.md#request-url)

The full request URL of outgoing and incoming HTTP requests is **always sent to Sentry**. Depending on your application, this could contain PII data.

## [Request Query String](https://docs.sentry.io/platforms/python/data-management/data-collected.md#request-query-string)

By default, the full request query string of outgoing and incoming HTTP requests is sent to Sentry. Depending on your application, this could contain PII data. For example, a query string like `?user_id=1234`, where `1234` is a user id (which may be considered PII).

When using `data_collection`, use `url_query_params` to control this. Set it to `{"mode": "off"}` to disable collection entirely, or use `"allowlist"` / `"denylist"` mode to filter which values are sent. Values whose keys match the built-in sensitive denylist (terms like `auth`, `token`, `password`, and `secret`) are scrubbed automatically.

```python
import sentry_sdk

sentry_sdk.init(
    dsn="https://<key>@o<orgId>.ingest.sentry.io/<projectId>",
    _experiments={
        "data_collection": {
            "url_query_params": {"mode": "off"},
        },
    },
)
```

Sentry also has some additional [server-side data scrubbing](https://docs.sentry.io/security-legal-pii/scrubbing/server-side-scrubbing.md) in place to remove sensitive data from the query string.

## [Request Body](https://docs.sentry.io/platforms/python/data-management/data-collected.md#request-body)

The request body of incoming HTTP requests can be sent to Sentry. Whether it's sent or not, depends on the type and size of request body as described below:

* **The type of the request body:**

  * JSON and form bodies are sent
  * Raw request bodies are always removed
  * Uploaded files in the request bodies are never sent to Sentry

* **The size of the request body:** There's a ["max\_request\_body\_size"](https://docs.sentry.io/platforms/python/configuration/options.md#max-request-body-size) option that's set to `medium` by default. This means that larger request bodies aren't sent to Sentry.

If you want to prevent bodies from being sent to Sentry altogether, set `max_request_body_size` to `"never"`.

When using `data_collection`, incoming and outgoing request bodies are collected by default. To disable body collection, set `http_bodies` to an empty list, or provide only the body types you want:

```python
import sentry_sdk

sentry_sdk.init(
    dsn="https://<key>@o<orgId>.ingest.sentry.io/<projectId>",
    _experiments={
        # Collect only incoming request bodies:
        "data_collection": {
            "http_bodies": ["incoming_request"],
        },
    },
)
```

The valid body types are `"incoming_request"` and `"outgoing_request"`. The Python SDK doesn't capture response bodies, so there are no response body types.

`max_request_body_size` still applies on top of `http_bodies`.

## [Source Context](https://docs.sentry.io/platforms/python/data-management/data-collected.md#source-context)

When an unhandled exception is sent to Sentry, a snapshot of the source code surrounding the line where the error originates is sent with it.

To opt out of sending this source context to Sentry, set `include_source_context` to `False`.

When using `data_collection`, use `frame_context_lines` to control how many lines above and below each stack frame are captured. It defaults to `5`. Set it to `0` (or `False`) to opt out:

```python
import sentry_sdk

sentry_sdk.init(
    dsn="https://<key>@o<orgId>.ingest.sentry.io/<projectId>",
    _experiments={
        "data_collection": {
            "frame_context_lines": 0,
        },
    },
)
```

## [Local Variables In Stack Trace](https://docs.sentry.io/platforms/python/data-management/data-collected.md#local-variables-in-stack-trace)

When unhandled errors and exceptions are sent to Sentry, the names and values of local variables that were set when the errors occurred are sent at the same time.

You can stop sending local variables to Sentry by setting `include_local_variables=False` in the `sentry_sdk.init()` call.

When using `data_collection`, `stack_frame_variables` controls this and defaults to `True`.

To opt out explicitly, set `stack_frame_variables` to `False`:

```python
import sentry_sdk

sentry_sdk.init(
    dsn="https://<key>@o<orgId>.ingest.sentry.io/<projectId>",
    _experiments={
        "data_collection": {
            "stack_frame_variables": False,
        },
    },
)
```

## [SQL Queries](https://docs.sentry.io/platforms/python/data-management/data-collected.md#sql-queries)

While SQL queries are sent to Sentry, neither the full SQL query (`UPDATE app_user SET password='supersecret' WHERE id=1;`), nor the values of its parameters will ever be sent. A parameterized version of the query (`UPDATE app_user SET password='%s' WHERE id=%s;`) is sent instead.

When using `data_collection`, set `database_query_data` to `False` to stop collecting database query data:

```python
import sentry_sdk

sentry_sdk.init(
    dsn="https://<key>@o<orgId>.ingest.sentry.io/<projectId>",
    _experiments={
        "data_collection": {
            "database_query_data": False,
        },
    },
)
```

## [GraphQL Documents And Variables](https://docs.sentry.io/platforms/python/data-management/data-collected.md#graphql-documents-and-variables)

When using `data_collection`, the GraphQL query document and its variables are collected by default. Both can be disabled independently:

```python
import sentry_sdk

sentry_sdk.init(
    dsn="https://<key>@o<orgId>.ingest.sentry.io/<projectId>",
    _experiments={
        "data_collection": {
            "graphql": {"document": False, "variables": False},
        },
    },
)
```

Without `data_collection` (and with `send_default_pii` unset or `False`), GraphQL documents and variables aren't collected.

## [Queue And Task Message Data](https://docs.sentry.io/platforms/python/data-management/data-collected.md#queue-and-task-message-data)

When using `data_collection`, message body data for queue and task-queue integrations is collected by default. Set `queues` to `False` to opt out:

```python
import sentry_sdk

sentry_sdk.init(
    dsn="https://<key>@o<orgId>.ingest.sentry.io/<projectId>",
    _experiments={
        "data_collection": {
            "queues": False,
        },
    },
)
```

Without `data_collection` (and with `send_default_pii` unset or `False`), this data isn't collected.

## [LLM Inputs And Responses](https://docs.sentry.io/platforms/python/data-management/data-collected.md#llm-inputs-and-responses)

When using Sentry in your AI apps, the SDK by default won't add data like LLM inputs and responses to spans. To start recording these, add `send_default_pii=True` to your `sentry_sdk.init()` call.

Most AI integrations have an additional parameter to control whether prompts should be included called `include_prompts`. See the [documentation for the specific AI framework](https://docs.sentry.io/platforms/python/integrations.md#ai) for more information.

When using `data_collection`, the `gen_ai` category records both inputs and outputs unless you opt out. Metadata like the model ID and token counts is always collected.

```python
import sentry_sdk

sentry_sdk.init(
    dsn="https://<key>@o<orgId>.ingest.sentry.io/<projectId>",
    _experiments={
        "data_collection": {
            "gen_ai": {"inputs": False, "outputs": False},
        },
    },
)
```

`gen_ai` supersedes the per-integration `include_prompts` parameter. When `data_collection` is set, `gen_ai` determines whether prompt content is recorded, regardless of what an individual integration's `include_prompts` is set to.