Drupal CMS telemetry arrived on September 30, 2026, in Drupal CMS Helper 2.2.2. The full release note is one line: "Adds Amplitude for anonymous usage data tracking, with opt-in consent." As of October 7, that line is nearly all the public detail there is.
Drupal CMS Helper is the small module that ships inside every Drupal CMS site. So this change reaches nonprofits, associations and universities that built on Drupal CMS, whether or not anyone on staff reads release notes. This piece covers what the release confirms, what it leaves open, how to decide whether to opt in, and two other items from the same two weeks: the OpenKnowledgebase beta and the state of Drupal security advisories.
The short version: the tracking is described as opt-in, so nothing should be sent unless someone on your site agrees. What is sent, where it is stored and how to change your answer are not yet documented. Until they are, decline, or say yes only on a test site. And if you are still on Drupal 10, none of this reaches you, but December 9 does.
What Drupal CMS Helper 2.2.2 changed
The Drupal CMS Helper project page says the module "provides functionality for Drupal CMS that is not yet in Drupal core or dependencies." It is included with Drupal CMS automatically. The page says it should not be uninstalled.
The 2.2.2 release page gives these facts:
- Released September 30, 2026.
- Requires Drupal core 11.3 or later.
- Change: Amplitude added for “anonymous usage data tracking, with opt-in consent.”
Amplitude is a commercial product analytics service. Software teams use it to see which features people use and where they get stuck.
The project page reported 7,448 sites using the module when we checked. That figure comes from drupal.org’s own usage tracking, which counts sites that report in. It moves from day to day.
Drupal CMS 2.2.0, the multilingual release, came out September 25. Helper 2.2.2 followed five days later. A site that runs a routine Composer update may pick it up without anyone choosing it as a feature. That is normal for a patch release. It is also why you should know it is there.
What we know and do not know about Drupal CMS telemetry
The release note settles two questions. It does not settle the ones a privacy-minded site owner asks next.
| Question | What the public record says | Source |
|---|---|---|
| Is it on by default? | Described as “opt-in consent” | 2.2.2 release note |
| Which service receives the data? | Amplitude | 2.2.2 release note |
| What data is sent? | Described only as “anonymous usage data” | 2.2.2 release note |
| What does the consent screen say? | Not documented | Nothing found on drupal.org |
| How do I change my answer later? | Not documented | Nothing found on drupal.org |
| How long is data kept? | Not documented | Nothing found on drupal.org |
The DropTimes reached the same place in its October 6 release roundup. It noted that the release note "does not specify which usage events or data fields are sent to Amplitude, how long the information is retained, or describe the consent interface." It added: "Those details should not be inferred from the short release note alone."
We agree, so this post does not guess about Drupal CMS telemetry. We tried to read the code change and the issue behind it. Drupal’s issue queues now live on GitLab, and those pages were not readable to us. If your developer can open the repository, the commit for 2.2.2 is the best source for exactly what is collected.
Why Drupal wants usage data
The reason for Drupal CMS telemetry is on record, even if the details are not. In December 2025 the Drupal Association posted about privacy-first telemetry. It said real usage data could "provide us statistically significant insights into what features of Drupal are most commonly used, what creates the most friction, and what most needs our attention."
That post set three markers worth holding the project to:
- Start small. It planned to begin with the Drupal CMS trial and “a small initial set of information about application usage.”
- Allow refusal. It said: “Site owners, especially those in regulated industries, must be able to opt-out of data collection.”
- A named vendor. It named PiwikPro, a European company focused on privacy and compliance.
The 2.2.2 release names Amplitude instead. We found no public explanation for the change of vendor. That is a fair question to ask on drupal.org, and the answer matters to any site with data-handling rules.
A wider debate sits in Drupal core. Issue #3576103 proposes one site-wide setting for telemetry consent, unchecked by default on new sites. As of its last update in March 2026, it was still active and not committed. Commenters there were split on one consent box versus a separate box for each feature.
So Drupal CMS telemetry has shipped its own opt-in ahead of any core-wide standard. The helper module exists to carry features not yet in core, so that fits its role. It does mean the rules could change again once core settles on a model.
How to decide on Drupal CMS telemetry for your organization
Usage data can help Drupal CMS get better for small teams like yours. There is a real case for saying yes to Drupal CMS telemetry once the terms are clear. The question is when.
Step 1: Find out if you have it. Your developer can run composer show drupal/drupal_cms_helper to see the installed version. Site admins can check Reports, then Available updates. Version 2.2.2 or later includes the tracking.
Step 2: Read the prompt before anyone clicks. The release says consent is opt-in, but it does not say where the prompt appears. If it shows up in the admin area, whoever sees it first may answer for the whole organization. Ask your vendor to leave it unanswered until you decide.
Step 3: Check it against your own rules. That may be a privacy policy, data agreements with members or funders, or an IT security review. The usual question is simple: does any data leave our site, and to whom?
Step 4: Test it on staging. If the team wants to opt in, do it on a test copy first. A developer can watch the browser’s network panel, or the server’s outbound requests, and see what goes to Amplitude.
Step 5: Write the answer down. Note who decided, when, and why. Reviews and audits ask for that months later.
Our view: say no, or leave the prompt unanswered, until drupal.org documents the data fields and the way to change your answer. Then look again. Drupal CMS telemetry that is anonymous and documented is easy to support.
One more point for Drupal 10 sites. Helper 2.2.2 requires Drupal 11.3 or later, and Drupal CMS is built on Drupal 11. If you run Drupal 10, this change does not reach you. Your deadline is the bigger issue.
OpenKnowledgebase: a self-hosted Drupal AI knowledge base in beta
The second item is a new product built on Drupal. OpenKnowledgebase is an open source wiki and AI knowledge base from drunomics, a Drupal agency. Its beta 1 announcement describes it as a knowledge base "for people and agents."
One correction to what has circulated. Beta 1 was released September 23, 2026, not October 5. The GitHub releases page shows beta 2 on October 1. The drupal.org project lists its 1.0.0-beta2 release as September 30.
What beta 1 includes, according to drunomics:
| Area | What it does | Built on |
|---|---|---|
| Editing | Real-time shared editing, with review before publishing | Drupal 11 and Nuxt |
| AI chat | Answers with citations to specific blocks of content | Drupal AI (OpenAI, Anthropic, Mistral) |
| Search | Keyword and semantic search together | OpenSearch |
| Agents | AI agents can edit, under a two-step review | Built-in MCP server |
It runs on your own servers with Docker. The product site lists about 4GB of free RAM as the requirement. The frontend is MIT licensed and the Drupal modules are GPL-2.0-or-later. Drunomics says there is "No open-core," and offers paid hosting as an option.
Is OpenKnowledgebase worth evaluating?
It may be, for one kind of team. Drunomics aims it at groups using Confluence-style wikis that want AI help without giving up control of their data. An association with a large staff handbook or member-services knowledge base fits that description. So does a university IT help desk.
Three cautions apply:
- It is beta. The drupal.org project page says API stability is not guaranteed until 1.0.0.
- No security coverage yet. The project is not covered by Drupal’s security advisory policy. Its page warns: “Use at your own risk!”
- Self-hosted means you run it. Docker, OpenSearch and updates all fall to your team or vendor.
A test install with non-sensitive documents is a reasonable step this quarter. Production use can wait for 1.0 and security coverage. We covered how Drupal’s AI work is changing its security load in our post on the Drupal AI Security Initiative.
Drupal security advisories since September 23
As of the morning of October 7, the Drupal security advisory list shows nothing newer than September 23. The last core advisory is SA-CORE-2026-013, from September 16.
The September 23 batch was large. Most of it was Webform, which we explained for non-technical readers in the Webform advisories in plain language. It also included advisories for AI CKEditor and Smart Content, both rated Moderately critical.
One item in that batch matters to sites that add modules from the admin screen. SA-CONTRIB-2026-178 covers Project Browser, which lets admins apply recipes and enable modules from the web interface. It is rated Critical, 15 out of 25, for cross-site request forgery. The fixed versions are 2.1.5 and 2.0.3. If your site uses Project Browser, confirm you are on one of them.
Drupal 10 end of life is still December 9, 2026
The release schedule has not changed. Drupal’s core release schedule says: "Drupal 10 will reach end of life on December 9, 2026."
Our guide to Drupal 10 end of life covers what that date means and what to plan. Drupal CMS telemetry and OpenKnowledgebase both assume Drupal 11. The Drupal 12 timeline is in our look at the Drupal 12 release slip, and the features waiting on Drupal 11 are in our DrupalCon Rotterdam recap.
Frequently Asked Questions
What is Drupal CMS telemetry?
It is usage tracking added in Drupal CMS Helper 2.2.2 on September 30, 2026. The release note says it uses Amplitude for anonymous usage data, with opt-in consent.
Is Drupal CMS telemetry turned on by default?
The release note describes it as opt-in. That means data should not be sent unless someone on the site agrees. The consent screen itself is not documented on drupal.org as of October 7.
What data does it send to Amplitude?
Drupal.org does not say beyond “anonymous usage data.” The specific events and fields are not documented. Your developer can check the 2.2.2 code or watch traffic on a test site.
How do I know if my site has Drupal CMS Helper 2.2.2?
Ask your developer to run composer show drupal/drupal_cms_helper. Admins can also check Reports, then Available updates. Version 2.2.2 or later includes the tracking.
Can I uninstall Drupal CMS Helper to avoid telemetry?
The project page says the module should not be uninstalled from Drupal CMS. Declining the opt-in is the intended way to say no.
Does this affect Drupal 10 sites?
No. Drupal CMS Helper 2.2.2 requires Drupal 11.3 or later. Drupal 10 sites have a bigger issue: end of life on December 9, 2026.
Why did Drupal pick Amplitude instead of PiwikPro?
We found no public explanation. The Drupal Association named PiwikPro in December 2025. The 2.2.2 release names Amplitude. It is a fair question to raise on drupal.org.
When did OpenKnowledgebase reach beta?
Beta 1 was released September 23, 2026, and beta 2 on September 30 on drupal.org (October 1 on GitHub). It is self-hosted with Docker and not yet covered by Drupal security advisories.
Have there been new Drupal security advisories since September 23?
None as of the morning of October 7, 2026. The September 23 batch included a Critical advisory for Project Browser, fixed in versions 2.1.5 and 2.0.3.
