---
title: "Hide personal data from session recordings · Agent Wranglers"
url: https://agentwranglers.se/playbook/analytics/privacy-and-consent/session-recording-privacy
id: ANA-9
level: Required
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 814
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Hide personal data from session recordings

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Privacy and consent](https://agentwranglers.se/playbook/analytics/privacy-and-consent.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: ANA-9
- Level: Required
- Chapter: [Privacy and consent](https://agentwranglers.se/playbook/analytics/privacy-and-consent.md)
- Rule: Session recording and heatmap tools mask every typed value and all text from customer records before anything leaves the browser. They record nothing on payment, sign-in or account settings screens.
- Check: A browser test with recording on types the marker `PRIVACY-7f3a` into a form and opens a customer record with a known test name. The captured recording requests contain neither the marker nor the name. Opening the payment and sign-in screens sends 0 recording requests.
- Risk: Data leaked or lost
- How: A session recording tool copies the page and every keystroke to a third party, so an unmasked one leaks whatever your customers see. Turn on the tool's strictest masking, which masks every input and all text, and unmask only fixed labels you choose. Mark containers of customer data with the tool's block attribute, so new fields stay hidden by default. Treat the vendor as a processor, as [sign a contract with every processor](https://agentwranglers.se/playbook/website/privacy/processor-agreements.md) says. Start recording only after a yes, as [store nothing extra without a yes](https://agentwranglers.se/playbook/website/privacy/cookie-consent.md) says. Front-end error reports follow [keep personal data out of logs](https://agentwranglers.se/playbook/operations/logs/logs-without-personal-data.md).

## Sources

- [GDPR Articles 5(1)(c) and 25](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [OWASP Logging Cheat Sheet on data to exclude](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html)

## Related rules

- WEB-215 [Sign a contract with every processor](https://agentwranglers.se/playbook/website/privacy/processor-agreements.md) in Website
- WEB-207 [Store nothing extra without a yes](https://agentwranglers.se/playbook/website/privacy/cookie-consent.md) in Website
- OPS-9 [Keep personal data out of logs](https://agentwranglers.se/playbook/operations/logs/logs-without-personal-data.md) in Operations and observability

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/analytics/privacy-and-consent/session-recording-privacy">Agent Wranglers product analytics and experiments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep personal data out of events](https://agentwranglers.se/playbook/analytics/privacy-and-consent/events-without-personal-data.md)
- Next: [Delete raw events on a schedule](https://agentwranglers.se/playbook/analytics/privacy-and-consent/analytics-retention.md)
- [Privacy and consent](https://agentwranglers.se/playbook/analytics/privacy-and-consent.md)