Overview
How might we design privacy filters so people can trust and act on AI output?
When this pattern fits
- Essential for enterprise applications, healthcare systems, and platforms handling sensitive data where automatic PII detection and masking protects user privacy.
When to skip or lighten it
- Creative tools where users intentionally paste private drafts and need full fidelity.
- Admin audit views that are already access-controlled and must show raw values.
- Offline local models with no outbound risk and no compliance requirement to mask.
States
State model coming soon
Key UX elements
Key UX elements coming soon
Anti-patterns to avoid
Silent dropping of PII with no indication anything was removed.
Masking that breaks copy/paste for roles that are allowed to see the value.
False confidence: labeling content safe when detection coverage is partial.
Blurring screenshots in marketing while leaving the same PII in exportable text.
How products use it
| Product | Implementation |
|---|---|
| Glean | Enterprise search controls that respect ACL and sensitive fields. |
| Healthcare AI tools | PHI masking in transcripts and generated notes. |
| Financial platforms | Account and card redaction in AI summaries and support views. |
| Enterprise chatbots | Prompt and response filters for emails, phones, and IDs. |
Implementation
Copy this prompt to generate a production-ready implementation in Cursor, Claude Code, Lovable, or any AI coding agent.
Generate a production-ready implementation of the "Privacy Filters" AI interface design pattern.
Pattern Definition:Frequently asked questions
What are privacy filters in AI UX?
Privacy filters detect sensitive data (names, emails, IDs, secrets) and mask or redact it in the UI, often with a control for privileged users to reveal values.
Should masking happen on input, output, or both?
Both when risk is high. Mask before retrieval or logging on the way in, and again on generated text on the way out.
How do users know filtering ran?
Show a clear redacted chip or placeholder, plus a short note like “2 fields hidden.” Invisible filtering erodes trust when something looks missing.
How does this relate to data ownership?
Data ownership covers retention and deletion rights. Privacy filters are the real-time display and processing control for sensitive fields.