fix: disable PostHog GeoIP enrichment

README.md

@@ -212,6 +212,7 @@ export OPENADAPT_TELEMETRY_ENABLED=false
 - Tag keys are validated, sensitive/invalid keys are dropped, and values are scrubbed before upload
 - User IDs are HMAC-anonymized before upload (`anon:v2:<hash>`)
 - `send_default_pii` is enforced to `false` by the client
+- PostHog events set `$geoip_disable: true` to suppress IP geolocation enrichment
 
 ## Internal Usage Tagging
 

src/openadapt_telemetry/posthog.py

@@ -167,7 +167,10 @@ def _queue_capture_payload(
         "api_key": _posthog_project_api_key(),
         "event": event,
         "distinct_id": distinct_id,
-        "properties": properties,
+        # This client runs on end-user machines. Explicitly suppress PostHog's
+        # ingest-side IP geolocation for every event; callers cannot override
+        # the privacy boundary with a supplied property.
+        "properties": {**properties, "$geoip_disable": True},
     }
     try:
         _ensure_worker().put_nowait(payload)

tests/test_posthog.py

@@ -44,6 +44,7 @@ def test_capture_event_enabled_in_ci_with_override() -> None:
             assert queue.payload is not None
             assert queue.payload["event"] == "agent_run"
             assert queue.payload["distinct_id"] == "test-id"
+            assert queue.payload["properties"]["$geoip_disable"] is True
 
 
 def test_capture_event_scrubs_sensitive_properties() -> None: