PII
PII, personally identifiable information, is any data that identifies a person directly or in combination, such as names, email addresses, phone numbers, government IDs, or precise location. Session recordings are PII-dense by nature, because pages routinely display exactly this information back to logged-in users.
How it works
In replay, PII enters through three doors: what users type (inputs), what pages display (account screens, order details, dashboards), and what the session metadata itself reveals (IP addresses, user identifiers attached for segmentation). Input masking closes the first door; text masking and element blocking close the second; the third is a data-governance decision about what you attach to sessions at all. The GDPR term of art is "personal data" and it is broader than the US-flavored PII, covering identifiers like IPs and cookie IDs; a recording pipeline designed for the stricter definition satisfies both.
Where you encounter it
Masking configuration, privacy reviews, DPAs with replay vendors, and data maps, where session recordings must be inventoried as a personal-data store like any database.