What Is PII Masking in Session Replay?

Short answer: PII masking replaces personal information with placeholder characters in a session recording. Done properly, the replacement happens in the visitor's browser before anything is sent, so the real values never reach the analytics provider and cannot be recovered from the recording.

Table of Contents

1. What Counts as PII
2. Where Masking Happens Matters
3. Masking vs Blocking
4. What Default Masking Covers and Misses
5. How to Audit Your Pages
6. Masking in DeepSync
7. Key Takeaways

What Counts as PII

Personally identifiable information is anything that identifies a person, directly or in combination.

• Names, email addresses, phone numbers, postal addresses
• Passwords and security answers
• Payment card and bank details
• Government identifiers
• Health, financial, and biometric information
• Account balances and order contents, depending on context

Privacy laws use broader terms, such as "personal data", which can also include IP addresses and online identifiers.

Where Masking Happens Matters

Only the first means the data was never collected. When evaluating a tool, ask which one it uses.

Masking vs Blocking

• Masking keeps the element in the recording and replaces its text with placeholder characters or blocks. You can see that a field existed and was filled.
• Blocking excludes the element altogether. Nothing about it is recorded, and the replay shows an empty placeholder.

Use masking for text you want to hide while keeping the layout readable. Use blocking for anything where even the shape is sensitive, such as an embedded document or a third-party frame.

What Default Masking Covers and Misses

Defaults typically cover form inputs: password fields, payment fields, and text inputs. That handles what people type.

Defaults cannot know what your page displays. These are commonly missed:

• A customer's name in the page header
• An email address shown on an account page
• Order history and delivery addresses
• Account balances and transaction lists
• Support chat transcripts
• Search results containing other people's details
• Personal data inside URLs (PII in URLs)

As the DeepSync docs put it, defaults cover the obvious input types; they cannot know that your third div is a national ID number.

How to Audit Your Pages

1. List pages that show personal data. Account, billing, orders, profile, admin, support.
2. Record yourself using a test account with obviously fake details.
3. Watch the recording. Anything readable that should not be is a gap.
4. Add masking to those elements.
5. Record again and confirm.
6. Repeat after releases that add new account or checkout screens.
7. Check what you send deliberately, such as attributes passed when identifying a user.

Masking in DeepSync

Masking happens in the browser, before anything is transmitted. Passwords, payment fields, and text inputs are masked by default. The characters are replaced at capture time, so the real values never reach DeepSync's servers and cannot be recovered from a recording (PII masking docs).

For content your page displays, add a class:

<!-- contents replaced with blocks in replay -->
<div class="ds-mask">Account balance: ₹48,200</div>

<!-- element is not recorded at all -->
<div class="ds-block">
  <iframe src="/sensitive-embed"></iframe>
</div>

Automatic masking, consent modes, and export and erasure are included on every plan, including Free.

One more place to be careful: the identify call. Whatever you pass is stored and visible in the dashboard, so send identifiers you would be comfortable having a teammate read, and never passwords, tokens, or payment details.

Key Takeaways

• Masking should happen in the browser, before data is sent.
• Defaults protect inputs, not displayed content.
• Use masking to hide text and blocking to exclude elements.
• Audit account and checkout pages with a test account.

Conclusion

Masking is what makes session replay compatible with privacy. The defaults do the first half. The audit is the half only you can do.

Read DeepSync's privacy docs.