> ## Documentation Index
> Fetch the complete documentation index at: https://subtext.fullstory.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Mark Sensitive Elements with Privacy Classes

> Add FullStory privacy CSS classes like fs-exclude, fs-mask, and fs-unmask to your markup to exclude or mask sensitive elements from session capture.

FullStory marks elements as sensitive by CSS class name. Add a class directly to an element in your HTML or JSX and it takes effect on capture — no JavaScript API is required. Reach for these classes when you need to exclude an element from capture entirely, or mask the text inside it, such as a field that holds personal or otherwise sensitive data.

## Core classes

| Class        | Effect                                                                                 |
| ------------ | -------------------------------------------------------------------------------------- |
| `fs-exclude` | The element is excluded entirely. Its DOM tree and events are not recorded.            |
| `fs-mask`    | The element's shape is preserved, but visible text is replaced with masked characters. |
| `fs-unmask`  | Opt back in to capture inside an excluded or masked ancestor.                          |

```html theme={null}
<input type="email" class="fs-mask" />

<div class="fs-exclude">
  <span>This block never reaches FullStory.</span>
</div>

<section class="fs-mask">
  <p>masked</p>
  <p class="fs-unmask">visible inside a masked ancestor</p>
</section>
```

## Consent-aware variants

If your app has a consent flow, use the consent-aware variants. They behave the same as the core classes but apply only **until the user grants consent**. After the user grants consent via `FS('consent', true)`, the element is captured normally.

| Class                        | Behavior                                   |
| ---------------------------- | ------------------------------------------ |
| `fs-exclude-without-consent` | Excluded until consent.                    |
| `fs-mask-without-consent`    | Masked until consent.                      |
| `fs-unmask-with-consent`     | Opt back in to capture only after consent. |

## Rules

<Warning>
  Tagging is static. Changes only take effect for **new sessions captured after deploy**. Tagging in development does not retroactively mask sessions already recorded.
</Warning>

The class works the same in any framework — React, Vue, plain HTML, and so on. In React Native, use the `<FSExclude>` / `<FSMask>` components instead.

<Note>
  Tagging the wrong element silently masks too much (a false positive) or too little (a false negative). Confirm your tagging with a real [session review](/docs/session-review/overview), or let Subtext scan for PII automatically with `subtext privacy propose` — see the [privacy tools reference](/docs/privacy/tools-reference).
</Note>

## See also

* [Privacy overview](/docs/privacy/overview) — what to tag and what is safe to leave captured.
* [Identification](/docs/api/identification) — for tagging the user, not the DOM.