GitHub CLI Wants to Watch Your Terminal. Developers Are Pushing Back

Imagine every command you type into your terminal quietly tallied in someone else’s dashboard. That’s roughly how developers are reacting to GitHub’s announcement that its official CLI (gh) will start collecting pseudoanonymous telemetry. The backlash across Hacker News, Reddit, and GitHub issues boils down to one blunt question: when did anyone agree to this?

Why telemetry hits a nerve with developers

Telemetry, in product-speak, means the data a team collects about how their software is used — clicks, command invocations, error rates. Nothing exotic. VS Code does it. Chrome does it. Android Studio does it.

But CLIs are different. A command-line tool sits at the center of a developer’s workflow. It sees which repos you touch, which commands you run, which errors you hit, and how often you retry. That’s not “product usage” in the abstract — that’s the shape of someone’s workday. It’s closer to reading the margins of their notebook than watching them click buttons in a GUI.

The word pseudoanonymous is doing a lot of work here, too. Unlike true anonymization, pseudonymization just swaps your identifier for another token — one that can still be linked back. Under GDPR, pseudonymized data is still personal data. That semantic gap is why developers are squinting hard at GitHub’s phrasing.

Why now, and why the CLI specifically

GitHub’s stated reason is reasonable on paper: as gh has grown, the team needs to know which features matter and which commands are dying on the vine. Every product org wants that signal.

The pushback lands on two specific points. First, the CLI lives inside automation. It’s not a laptop-only tool. It’s baked into CI pipelines, shell scripts, and Makefiles across millions of repos. Every GitHub Actions run, every deploy script, every cron job becomes a telemetry event. That’s a volume-and-scope problem GUI telemetry doesn’t have.

Second, there’s an implicit contract around open source developer tools. When you brew install gh, you’re installing a utility — not opting into a data relationship. Phoning home by default feels, to a lot of devs, like a breach of that unspoken deal.

Why “just opt out” isn’t landing

GitHub says an environment variable will let you turn collection off. The problem with opt-out is baked into the name: the default is collection. Most users never read the release notes, never touch config files, and in many cases don’t even know the setting exists.

What developers are asking for is opt-in — data only leaves your machine if you explicitly say yes. There’s precedent. Homebrew took heat over opt-out analytics years ago and has been slowly pushing toward more transparent, user-driven defaults. Newer runtimes like Deno and Bun market privacy as a feature, not a footnote. “We don’t collect anything” has become an actual selling point in developer tooling. The market has moved, and GitHub is walking into a room that’s already made up its mind.

The Microsoft shadow

GitHub has been a Microsoft subsidiary since 2018, and that context sets the temperature of this debate. Windows telemetry, Bing defaults, and Copilot’s training data have all had their own flare-ups. Developers are asking, reasonably, whether today’s pseudoanonymous usage stats become tomorrow’s AI training signal.

That’s not a paranoid leap. Copilot has already been the subject of class-action litigation over training on public repositories. Given that backdrop, the word “collection” alone triggers pattern recognition. Without crisp answers on retention, third-party sharing, and downstream ML use, GitHub’s “trust us” isn’t going to carry the argument.

What this really comes down to

This isn’t a technical debate. It’s a trust debate. Developer tools are the most voluntarily-adopted software there is — nobody’s IT department made you install gh. That means the switching cost is low and the memory is long. Break the trust once and the migration to alternatives happens faster here than anywhere else in software.

So it’s worth asking: what’s your editor sending home right now? Your package manager? Your CLI? This might be the week to open those config files and read them like you mean it.