Document and add sendDefaultPii: true to onboarding docs

[HazAT]

Description

Our approach is privacy first and we want to be transparent about that
sendDefaultPii is not the best API since it hides a lot of functionality behind one flag we are probably revisiting this in the future.

But until we have a better API, we want that sendDefaultPii: true will be added to the onboarding docs (in-product and docs) with a comment like:

Sentry.init({
  dsn: "DSN",
  // Adds request headers and IP for users,
  // visit: https://docs.sentry.io/platforms/javascript/data-management/data-collected/ for more info
  sendDefaultPii: true,

We know that what's not in onboarding docs is very hard to discover and the functionality provided by sendDefaultPii: true is something crucial for debugging your issues.

Each SDK should link to the specific docs added in #82.

Why should we be doing this?

To make it very clear to our users that this option exists and they can change the behavior in case they have privacy concerns.

Why now?

Because we had [INC-984] and we should be more deliberate what we do

Notion Document(s)

Related DACI: https://www.notion.so/sentry/DACI-user-ip_address-auto-behind-sendDefaultPii-true-1818b10e4b5d802f8938e894fd0348d5

Stakeholder(s)

@HazAT

Team(s)

Mobile, Web Backend, Web Frontend, GDX

SDKs

SDKs

Preview Give feedback

1. Native SDK (doesn't have this option)
2. JavaScript SDK
3. Electron SDK
4. Python SDK Document and add send_default_pii=True to onboarding docs sentry-python#3997
5. PHP SDK
6. Laravel SDK
7. Symfony SDK
8. Go SDK
9. Ruby SDK feat(ruby): Add send_default_pii to onboarding snippets sentry-docs#12709 chore(ruby): Add send_default_pii to onboarding snippets sentry#85148
10. Elixir SDK
11. Rust SDK
12. Java / Android SDK (Use sendDefaultPii=true in docs and in product getting started guide sentry-java#4119)
13. .NET SDK
14. Unity SDK
15. Unreal SDK
16. PowerShell SDK
17. Apple/Cocoa SDK Apple: Document and add sendDefaultPii: true to onboarding docs sentry-docs#12752
18. Capacitor SDK
19. Cordova SDK
20. Document and add sendDefaultPii: true to onboarding docs sentry-dart#2691
    Platform: Dart +1
    
21. Implement and document / add sendDefaultPii: true to onboarding docs sentry-kotlin-multiplatform#331
    Platform: KMP +1
22. React Native SDK Documents and Use sendDefaultPii=true in docs and in product getting started guide sentry-react-native#4539
23. Sentry CLI

[markushi]

@HazAT I already see people blindly copying this, how about having the prop commented out by default?

Something like this

Sentry.init({
  dsn: "DSN",

  // Uncomment if you want to see request headers and IP for users
  // Visit https://docs.sentry.io/platforms/javascript/sendDefaultPii for more info
  // sendDefaultPii: true,

[philipphofmann]

I agree with @markushi. Even though you can argue that the code tells you in your face that it sends PII, plenty of developers will blindly copy this and then get angry once they see PII in Sentry.

[kahest]

@HazAT

Each SDK should furthermore add a page similar to https://docs.sentry.io/platforms/python/data-management/data-collected/, listing all data collected by the SDK and pointing out what additional data is sent if sendDefaultPii: true.

We have this project #82 which captures what you describe here, IMO it makes sense to do both in tandem

[cleptric]

Updated getsentry/sentry-cocoa#82 and this issue accordingly.

[andreiborza]

@HazAT I already see people blindly copying this, how about having the prop commented out by default?

Something like this

Sentry.init({
dsn: "DSN",

// Uncomment if you want to see request headers and IP for users
// Visit https://docs.sentry.io/platforms/javascript/sendDefaultPii for more info
// sendDefaultPii: true,

How about putting this behind, default toggled off?

[philipphofmann]

That's a great idea. @andreiborza, with your approach, I would argue default toggled on is OK. I think fewer people will miss the checkbox than the default value in the code.

[HazAT]

Let's please just add this line of code and comment and move on -> KISS
It should work when you paste it (so the code shouldn't even be commented out).

Another button means more docs, more confusion, more questions

The intention of this is to make it more obvious to our users what our SDKs can do and not make it more difficult.

[philipphofmann]

@HazAT, OK I will shut up now 😄 , and I accept the decision to add the line of code 👍 because of KISS.

[buenaflor]

@HazAT should the line also be part of the wizard when we patch the Sentry.init into the user code?