Data masking
Data masking in session replay is the replacement of sensitive content with placeholders at record time, in the user's browser, so the real values never enter the recording. A masked password field is serialized as asterisks; the true input does not exist anywhere in the stored session.
How it works
Masking operates during serialization and input capture. The recording options documentation covers rrweb's controls, including maskAllInputs: true (every input value replaced), maskInputOptions for masking by input type, maskTextClass and maskTextSelector for text content, and a maskInputFn for custom logic. A stricter sibling is blocking: elements matching blockClass (default rr-block) are replaced by a same-sized placeholder, so neither content nor structure enters the recording. Because masking happens in the browser before transmission, the original value does not reach the ingest service or stored session. The browser still reads and transforms page content while applying the masking rule, so masking reduces the data retained by the replay system without erasing every privacy obligation.
Where you encounter it
Every production recording setup; the defaults you choose here decide your GDPR exposure. Recorder configuration is the first control point, followed by checks that masked values never reach ingest or storage in their original form.