fix(telemetry): make telemetry opt-in and off by default

PRIVACY.md

@@ -32,14 +32,15 @@ go—and, importantly, where they don't.
 - **API Keys & Credentials**: If you enter an API key (e.g., to connect an AI
   model), it is stored locally on your device and never sent to us or any third
   party, except the provider you have chosen.
-- **Telemetry (Usage Data)**: We collect feature usage and error data to help
+- **Telemetry (Usage Data)**: Telemetry is **off by default**. If you explicitly
+  opt in through the settings, we collect feature usage and error data to help
   us improve Bolt Code. This telemetry is powered by PostHog and includes your
   VS Code machine ID, feature usage patterns, and exception reports. The VS Code
   machine ID is a persistent identifier and may be considered personal data in
   some jurisdictions; we use it only for product analytics and error grouping.
   We retain telemetry only as long as needed for product analytics and debugging.
-  Telemetry does **not** collect your code or AI prompts, and you can opt out at
-  any time through the settings.
+  Telemetry does **not** collect your code or AI prompts, and you can opt back
+  out at any time through the settings.
 - **Marketplace Requests**: When you browse or search the Marketplace for Model
   Configuration Profiles (MCPs) or Custom Modes, Bolt Code makes a secure API
   call to Bolt Code's backend servers to retrieve listing information. These
@@ -56,8 +57,8 @@ go—and, importantly, where they don't.
 ## **Your Choices & Control**
 
 - You can run models locally to prevent data being sent to third-parties.
-- Telemetry collection is enabled by default to help us improve Bolt Code, but
-  you can opt out at any time through the settings.
+- Telemetry collection is disabled by default. You can opt in, and back out,
+  at any time through the settings.
 - You can delete Bolt Code to stop all data collection.
 
 ## **Security & Updates**

src/core/webview/__tests__/telemetrySettingsTracking.spec.ts

@@ -31,8 +31,8 @@ describe("Telemetry Settings Tracking", () => {
 			const newSetting = "disabled" as TelemetrySetting
 
 			// Simulate the logic from webviewMessageHandler
-			const isOptedIn = newSetting !== "disabled"
-			const wasPreviouslyOptedIn = previousSetting !== "disabled"
+			const isOptedIn = newSetting === "enabled"
+			const wasPreviouslyOptedIn = previousSetting === "enabled"
 
 			// If turning telemetry OFF, fire event BEFORE disabling
 			if (wasPreviouslyOptedIn && !isOptedIn && TelemetryService.hasInstance()) {
@@ -50,20 +50,23 @@ describe("Telemetry Settings Tracking", () => {
 			expect(mockTelemetryService.updateTelemetryState).toHaveBeenCalledWith(false)
 		})
 
-		it("should fire event when going from unset to disabled", () => {
+		it("should not fire event when going from unset to disabled", () => {
 			const previousSetting = "unset" as TelemetrySetting
 			const newSetting = "disabled" as TelemetrySetting
 
-			const isOptedIn = newSetting !== "disabled"
-			const wasPreviouslyOptedIn = previousSetting !== "disabled"
+			const isOptedIn = newSetting === "enabled"
+			const wasPreviouslyOptedIn = previousSetting === "enabled"
 
 			if (wasPreviouslyOptedIn && !isOptedIn && TelemetryService.hasInstance()) {
 				TelemetryService.instance.captureTelemetrySettingsChanged(previousSetting, newSetting)
 			}
 
 			TelemetryService.instance.updateTelemetryState(isOptedIn)
 
-			expect(mockTelemetryService.captureTelemetrySettingsChanged).toHaveBeenCalledWith("unset", "disabled")
+			// Telemetry is opt-in, so "unset" was never opted in; nothing was on,
+			// so there is no transition event to capture (and nothing to send it).
+			expect(mockTelemetryService.captureTelemetrySettingsChanged).not.toHaveBeenCalled()
+			expect(mockTelemetryService.updateTelemetryState).toHaveBeenCalledWith(false)
 		})
 	})
 
@@ -72,8 +75,8 @@ describe("Telemetry Settings Tracking", () => {
 			const previousSetting = "disabled" as TelemetrySetting
 			const newSetting = "enabled" as TelemetrySetting
 
-			const isOptedIn = newSetting !== "disabled"
-			const wasPreviouslyOptedIn = previousSetting !== "disabled"
+			const isOptedIn = newSetting === "enabled"
+			const wasPreviouslyOptedIn = previousSetting === "enabled"
 
 			// Update the telemetry state first
 			TelemetryService.instance.updateTelemetryState(isOptedIn)
@@ -95,8 +98,8 @@ describe("Telemetry Settings Tracking", () => {
 			const previousSetting = "enabled" as TelemetrySetting
 			const newSetting = "enabled" as TelemetrySetting
 
-			const isOptedIn = newSetting !== "disabled"
-			const wasPreviouslyOptedIn = previousSetting !== "disabled"
+			const isOptedIn = newSetting === "enabled"
+			const wasPreviouslyOptedIn = previousSetting === "enabled"
 
 			// Neither condition should be met
 			if (wasPreviouslyOptedIn && !isOptedIn && TelemetryService.hasInstance()) {
@@ -114,14 +117,13 @@ describe("Telemetry Settings Tracking", () => {
 			expect(mockTelemetryService.updateTelemetryState).toHaveBeenCalledWith(true)
 		})
 
-		it("should fire event when going from unset to enabled (telemetry banner close)", () => {
+		it("should fire event AFTER enabling when going from unset to enabled (explicit opt-in)", () => {
 			const previousSetting = "unset" as TelemetrySetting
 			const newSetting = "enabled" as TelemetrySetting
 
-			const isOptedIn = newSetting !== "disabled"
-			const wasPreviouslyOptedIn = previousSetting !== "disabled"
+			const isOptedIn = newSetting === "enabled"
+			const wasPreviouslyOptedIn = previousSetting === "enabled"
 
-			// For unset -> enabled, both are opted in, so no event should fire
 			if (wasPreviouslyOptedIn && !isOptedIn && TelemetryService.hasInstance()) {
 				TelemetryService.instance.captureTelemetrySettingsChanged(previousSetting, newSetting)
 			}
@@ -132,8 +134,13 @@ describe("Telemetry Settings Tracking", () => {
 				TelemetryService.instance.captureTelemetrySettingsChanged(previousSetting, newSetting)
 			}
 
-			// unset is treated as opted-in, so no event should fire
-			expect(mockTelemetryService.captureTelemetrySettingsChanged).not.toHaveBeenCalled()
+			// "unset" is off under opt-in semantics, so enabling is a real
+			// transition and the event fires after telemetry is turned on.
+			expect(mockTelemetryService.updateTelemetryState).toHaveBeenCalledWith(true)
+			expect(mockTelemetryService.captureTelemetrySettingsChanged).toHaveBeenCalledWith("unset", "enabled")
+			expect(mockTelemetryService.updateTelemetryState).toHaveBeenCalledBefore(
+				mockTelemetryService.captureTelemetrySettingsChanged,
+			)
 		})
 	})
 

src/core/webview/webviewMessageHandler.ts

@@ -633,10 +633,11 @@ export const webviewMessageHandler = async (
 					),
 				)
 
-			// Enable telemetry by default (when unset) or when explicitly enabled
+			// Telemetry is opt-in: only enabled when the user explicitly turned it on.
+			// "unset" (the default) and "disabled" both keep telemetry off.
 			await provider.getStateToPostToWebview().then((state) => {
 				const { telemetrySetting } = state
-				const isOptedIn = telemetrySetting !== "disabled"
+				const isOptedIn = telemetrySetting === "enabled"
 				TelemetryService.instance.updateTelemetryState(isOptedIn)
 			})
 
@@ -2569,8 +2570,9 @@ export const webviewMessageHandler = async (
 		case "telemetrySetting": {
 			const telemetrySetting = message.text as TelemetrySetting
 			const previousSetting = getGlobalState("telemetrySetting") || "unset"
-			const isOptedIn = telemetrySetting !== "disabled"
-			const wasPreviouslyOptedIn = previousSetting !== "disabled"
+			// Opt-in semantics: only an explicit "enabled" turns telemetry on.
+			const isOptedIn = telemetrySetting === "enabled"
+			const wasPreviouslyOptedIn = previousSetting === "enabled"
 
 			// If turning telemetry OFF, fire event BEFORE disabling
 			if (wasPreviouslyOptedIn && !isOptedIn && TelemetryService.hasInstance()) {

webview-ui/src/__tests__/TelemetryClient.spec.ts

@@ -84,6 +84,14 @@ describe("TelemetryClient", () => {
 			// Assert
 			expect(posthog.init).not.toHaveBeenCalled()
 		})
+
+		it("doesn't initialize PostHog when telemetry is unset even with an API key and distinct ID", () => {
+			// Regression test for opt-in semantics: the default "unset" state must
+			// stay off even when a build ships a real key.
+			telemetryClient.updateTelemetryState("unset", "test-key", "test-user")
+
+			expect(posthog.init).not.toHaveBeenCalled()
+		})
 	})
 
 	/**

webview-ui/src/components/common/TelemetryBanner.tsx

@@ -13,7 +13,9 @@ const TelemetryBanner = () => {
 
 	const handleClose = () => {
 		setIsDismissed(true)
-		vscode.postMessage({ type: "telemetrySetting", text: "enabled" satisfies TelemetrySetting })
+		// Telemetry is opt-in; dismissing the banner records an explicit decline
+		// rather than silently opting the user in.
+		vscode.postMessage({ type: "telemetrySetting", text: "disabled" satisfies TelemetrySetting })
 	}
 
 	const handleOpenSettings = () => {

webview-ui/src/i18n/locales/en/welcome.json

@@ -12,7 +12,7 @@
 	},
 	"telemetry": {
 		"helpImprove": "Help Improve Bolt Code",
-		"helpImproveMessage": "Bolt Code collects error and usage data to help us fix bugs and improve the extension. This telemetry does not collect code, prompts or personal information. You can turn this off in <settingsLink>settings</settingsLink>."
+		"helpImproveMessage": "Telemetry is off by default. If you like, you can help us fix bugs and improve the extension by enabling anonymous error and usage reporting in <settingsLink>settings</settingsLink>. No code, prompts, or personal information is ever collected."
 	},
 	"importSettings": "Import Settings"
 }

webview-ui/src/utils/TelemetryClient.ts

@@ -9,7 +9,8 @@ class TelemetryClient {
 	public updateTelemetryState(telemetrySetting: TelemetrySetting, apiKey?: string, distinctId?: string) {
 		posthog.reset()
 
-		if (telemetrySetting !== "disabled" && apiKey && distinctId) {
+		// Opt-in semantics: only an explicit "enabled" turns telemetry on.
+		if (telemetrySetting === "enabled" && apiKey && distinctId) {
 			TelemetryClient.telemetryEnabled = true
 
 			posthog.init(apiKey, {