PostHog session replay: sampling, masking, and what it is actually good for
Session replay answers a different question than your funnel chart: not "how many people dropped off here" but "what did the ten people who dropped off here actually do." Configured well, it is a debugging and UX tool. Configured as "record everything," it is a bill and a privacy problem.
What replay is for, specifically
Session replay is best used as a targeted debugging and qualitative-research tool, not a passive dashboard. The highest-value moment to open a replay is after an aggregate metric already told you something is wrong - a conversion rate dropped, a rage-click cluster appeared, a support ticket references a bug nobody can reproduce.
Sampling strategy: the decision that controls cost and signal
Strategy
When it fits
Record everything
Rarely correct outside a very low-traffic beta; expensive and mostly unwatched
Percentage sample
General-purpose default - enough sessions to spot patterns without recording the entire funnel
Cohort-targeted
Record sessions from a specific segment (new users, a beta cohort, an at-risk account) deliberately
Trigger-based
Start recording only after a signal fires - an error, a rage click, a specific event
Masking and privacy configuration
Replay should be configured to mask sensitive fields by default - payment forms, personal identifiers, anything a support or product team does not need to see pixel-for-pixel to understand a session. This is implementation work done once, correctly, rather than an afterthought discovered during a privacy review.
Where replay fits into an implementation engagement
We scope replay sampling and masking as part of the same instrumentation pass that covers feature flags and event architecture - replay volume also feeds directly into usage-based cost, so the sampling decision is a cost decision too.
Frequently Asked Questions
Does session replay record everything by default?
PostHog lets you enable replay broadly, but recording every session at full fidelity is rarely the right default - sampling by cohort, funnel step, or a percentage of sessions is the more common production setup.
How does masking work?
PostHog supports masking input fields and specific DOM elements so sensitive data (payment fields, personal information) is not captured in the recording, alongside broader text-masking options.
Is replay a GDPR or consent concern?
Session replay captures user behavior and potentially personal data, so it needs to sit behind the same consent and cookie-notice logic as any other tracking - see our note on this in the comparison guides and PostHog's own documentation for the current mechanism.
When is replay more useful than analytics dashboards?
When a metric moved and you don't know why - a spike in rage clicks, a drop-off at a specific step, a bug report you can't reproduce. Replay shows the individual session; analytics shows the aggregate.
Get replay sampling configured before it becomes a bill.
We scope sampling strategy and masking so replay stays a debugging tool, not a runaway cost line.