OpenClaw Adds Opt-In Telemetry With a Default-On Update Ping — What Operators Should Change Today

A merged pull request changes where OpenClaw sends its startup update check and adds an optional feature-statistics tier. Operators who care about outbound connections should read this one closely, because part of it is enabled by default.

The two tiers

Tier 1 — update ping, on by default (opt-out). The startup update check no longer queries registry.npmjs.org. It now targets https://telemetry.openclaw.ai/api/latest-version and carries only a User-Agent string of the form openclaw/<version> (<os>; node/<version>; <arch>; <surface>). Because gateways run for weeks, the check also fires from the maintenance tick on a jittered schedule, roughly daily, so results are cached in local machine state and failures never interrupt startup.

Tier 2 — feature stats, off by default (opt-in). With telemetry.enabled: true, the same daily request becomes a POST carrying feature names and small counts only — channel names, provider families, plugin count, session count. Per the PR: no content, no prompts, no credentials, no paths, no hostnames, and deliberately no install identifier, so daily pings cannot be linked across days by design.

Interactive onboarding asks once about telemetry with “No thanks” preselected; scripted and container installs are never asked and leave the setting unset, meaning they get Tier 1 only.

Why this matters beyond privacy preference

Two operational details deserve attention:

• The automatic npm fallback is deleted, not kept. Update checking now has exactly one canonical path through the telemetry endpoint. If your network policy blocks telemetry.openclaw.ai, you have silently lost automated update checking, not just telemetry. Allowlist it or disable update checks explicitly.
• One switch goes fully dark. update.checkOnStart: false or the OPENCLAW_NO_AUTO_UPDATE environment variable disables the entire request — both the version check and any telemetry — because they share one request.

Tier 2 additionally honors DO_NOT_TRACK=1, which forces feature stats off regardless of config.

Operator guidance

1. Decide your posture before the next Gateway restart lands on your install: allowlist telemetry.openclaw.ai, or set update.checkOnStart: false / OPENCLAW_NO_AUTO_UPDATE if your policy requires zero new endpoints.
2. If you opt in to feature stats, know that openclaw telemetry show prints the exact payload the sender would transmit, produced by the same builder — audit it rather than trusting the description.
3. The server implementation is public (a small MIT-licensed Cloudflare Worker). Review what it stores yourself; the claim “anonymous” is verifiable here in a way most analytics claims are not.
4. Container and CI images never see the consent prompt. If you want feature stats from those surfaces, it requires explicit config; silence means Tier 1 only.

Interpretation: this is a good-faith, auditable design that still shifts a default. Default-on pings are a policy decision each operator should make deliberately — and the tools to make either choice exist in the same merge.