Make ORT_TELEMETRY_DISABLED a full telemetry opt-out - #29843
Merged
Conversation
When ORT_TELEMETRY_DISABLED is set, skip creating the 1DS uploader entirely so no device-id file is persisted and no ProcessInfo event is uploaded, matching CI / unit-test suppression. The environment opt-out stays latched so the runtime EnableTelemetryEvents() API cannot re-enable telemetry for the process lifetime. Addresses review feedback on PR #27379 (opt-out asymmetry).
Merged
bmehta001
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Makes
ORT_TELEMETRY_DISABLEDa full telemetry opt-out on the non-Windows (1DS) provider. Previously, setting the environment variable only flippedenabled_ = falsewhileInitialize()still created the 1DS uploader, wrote the persistent device-id file to disk, and letLogProcessInfo()upload a one-shotProcessInfoevent (it only checkedlogger_ != nullptr, notIsEnabled()). So a user who explicitly opted out still got an on-disk identifier and a network upload.With this change, the env-var opt-out is treated like CI / unit-test suppression: the provider returns early before creating the uploader, so nothing is initialized, persisted, or sent.
Key Changes
onnxruntime/core/platform/telemetry_environment.hShouldSuppressTelemetry()now also returns true forIsTelemetryDisabledByEnvVar(), making it the single "collect nothing" gate.onnxruntime/core/platform/posix/telemetry.ccInitialize()collapses the CI/unit-test and env-var checks into one early return onShouldSuppressTelemetry(). When set, noLogManager/uploader is created,DeviceId::GetValue()is never called (no device-id file), andLogProcessInfo()returns early (no upload).env_disabled_is still latched so the runtimeEnableTelemetryEvents()API cannot re-enable it.LogProcessInfo()comment updated.docs/Privacy.mdonnxruntime/test/platform/telemetry_environment_test.ccShouldSuppressTelemetry()is true whenORT_TELEMETRY_DISABLEDis set.Motivation and Context
Addresses review feedback on #27379 (the "opt-out asymmetry" thread): an explicit
ORT_TELEMETRY_DISABLED=1should leave no on-disk identifier and send nothing, rather than only suppressing usage events while still emitting an initialization heartbeat. The runtime API-based disable (DisableTelemetryEvents()) is unchanged and may still emit a minimal init event, matching the Windows ETW model.Testing
TelemetryEnvironmentTest.EnvVarOptOutnow asserts full suppression viaShouldSuppressTelemetry().ORT_TELEMETRY_DISABLED=1: noonnxruntime.db/deviceidfile is created under the cache dir, and noProcessInfoevent is uploaded.