🔐 Clear, Flexible Privacy for Session Replay

🔐 Clear, Flexible Privacy for Session Replay

Overview

We introduced a clearer, more flexible set of privacy controls for Session Replay. You can choose a baseline privacy configuration and refine it with element-level rules. This makes it easier to align replay collection with your organization’s privacy requirements while preserving useful context for analysis.

What You Can Do Now

• Select one of three baseline privacy options that define how text and inputs are handled by default.

• Apply CSS selector rules to mask, unmask, or fully block specific elements.

• Manage all replay privacy settings from a single place in the console.

How It Works

You begin by choosing a baseline privacy option in the Statsig Console UI. This sets the default masking behavior for all session replays.

Baseline privacy options:

• Passwords (Default): Only password inputs are replaced with asterisks (*). All other text and inputs are shown as is.

• Inputs: All text inside input fields is replaced with asterisks (*). All other text is shown as is.

• Maximum: All text and all inputs are replaced with asterisks (*).

After selecting a baseline, you can add CSS selector rules to override it for specific elements. Selector rules follow a strict precedence order: Block, then Mask, then Unmask. Password inputs are always masked and cannot be unmasked.

Blocking removes an element entirely from the replay and replaces it with a black placeholder of the same size. Masking replaces text with asterisks. Unmasking reveals text that would otherwise be masked by the baseline setting.

All settings are configured in the Statsig Console under Project Settings → Analytics & Session Replay and require project admin permissions.

Impact on Your Analysis

These controls let you confidently use Session Replay in privacy-sensitive environments. You can protect PII by default while selectively revealing safe UI elements for debugging, without sacrificing visibility into user behavior.