# Privacy, masking, and GDPR controls

**Category:** [Session Replay](https://help.totalctrl.app/hc/totalctrl/totalctrl-help-center/en-US/categories/session-replay)
**Updated:** 2026-08-19

## What is masked by default

The SDK automatically masks `input[type=password]`, credit-card inputs, and any element carrying the `data-sr-mask` attribute. Wrap sensitive markup like `<div data-sr-mask>…</div>` to keep it out of recordings.
## Add your own masking rules

In **Settings & SDK**, under **Privacy & Compliance**, enter extra CSS selectors to mask — one per line, for example `.credit-card-number` or `[data-private]`. These are added to the built-in masks. Click **Save Privacy Settings** to apply.
## Anonymize IP addresses

Enable **Anonymize visitor IP addresses** to zero the last octet of IPv4 addresses (or the last 80 bits of IPv6) at the moment data is ingested. This is recommended for GDPR compliance.
## Let visitors opt out

Call `window.__SR.optOut()` from your consent platform's reject handler to stop recording a visitor and set a one-year opt-out cookie. Use `window.__SR.optIn()` to re-enable recording if they later consent. Opted-out visitors are skipped at ingest.
## Erase or export visitor data

Under **GDPR Data Controls**, paste a **Visitor ID** (from the `_sr_vid` localStorage key) and choose:

- **Erase Data** — permanently deletes that visitor's sessions and stored chunks, scrubs identifying fields, and records an opt-out. This cannot be undone.
- **Export Data** — downloads all of that visitor's session metadata as JSON for data-portability requests.

## Retention

Your plan's **retention period**, shown under **Plan Limits**, controls how long sessions are kept before they are purged automatically.

---

## Related Articles

- [Install the recording SDK](https://help.totalctrl.app/en-US/articles/install-the-sdk)
- [Getting started: install the recorder](https://help.totalctrl.app/en-US/articles/session-replay-getting-started)
- [Heatmaps & funnels](https://help.totalctrl.app/en-US/articles/session-replay-heatmaps-funnels)
- [Frustration signals: rage clicks, dead clicks, errors & struggle score](https://help.totalctrl.app/en-US/articles/session-replay-signals)
- [Restrict recording to your sites with Allowed origins](https://help.totalctrl.app/en-US/articles/session-replay-allowed-origins)

---
[← Back to TotalCtrl Help Center](https://help.totalctrl.app/en-US/)