What is PII?

PII (personally identifiable information) is any data that identifies a specific person on its own or in combination with other data, such as a name, email address, phone number, account identifier or payment detail.

Why it matters

A session recording is a detailed record of one person's behaviour, and it can easily contain PII: an email typed into a login form, a name in a profile header, an address on a checkout page. Under GDPR and similar laws, that makes the recording personal data with all the obligations that follow.

The practical answer has two parts. Prevent PII from being recorded where you can, through input masking and blocking, and limit how long what remains is kept, through data retention. Consent governs whether to record at all.

How AnyReplay handles it

On the web and on React Native alike, every field value is masked by default, and passwords, one-time codes and payment fields are masked whatever you set. Email and phone fields are ordinary fields: recorded only if you set maskAllInputs: false. Masking happens before anything leaves the device. Elements carrying the ar-mask class lose their text; elements carrying ar-block are not recorded. Retention defaults to 14 days per organisation and is enforced by the API on an interval; deleting a session deletes the recording. If you identify users with identify({ userId, email }), that is PII you chose to attach, so treat it accordingly. For the legal background, read session replay privacy and GDPR.