diff --git a/.changeset/config.json b/.changeset/config.json
index 6adb6ae8b7..21a0165fc0 100644
--- a/.changeset/config.json
+++ b/.changeset/config.json
@@ -25,7 +25,8 @@
       "@rrweb/rrweb-plugin-canvas-webrtc-record",
       "@rrweb/rrweb-plugin-canvas-webrtc-replay",
       "@rrweb/rrweb-plugin-network-record",
-      "@rrweb/rrweb-plugin-network-replay"
+      "@rrweb/rrweb-plugin-network-replay",
+      "@rrweb/rrweb-plugin-privacy-detectors"
     ]
   ],
   "linked": [],
diff --git a/.changeset/privacy-at-capture-detectors.md b/.changeset/privacy-at-capture-detectors.md
new file mode 100644
index 0000000000..7f240f1f32
--- /dev/null
+++ b/.changeset/privacy-at-capture-detectors.md
@@ -0,0 +1,26 @@
+---
+"@rrweb/rrweb-plugin-privacy-detectors": minor
+"rrweb": minor
+"rrweb-snapshot": minor
+"@rrweb/types": minor
+---
+
+Privacy at Capture: opt-in heuristic PII detectors (**experimental** -- no
+production mileage in any shipped session-replay recorder).
+
+- Add `@rrweb/rrweb-plugin-privacy-detectors` (email, phone, Luhn-valid card,
+  SSN-like, IPv4): masks a whole page text node on match, at snapshot time
+  and on live `characterData` mutations. Never implied by a preset; opt in
+  via the plugin or `applyPrivacyDetectors`. Attribute values and custom
+  detector patterns are not supported. The plugin logs a one-time
+  `console.info` ("privacy-detectors active: input values record as
+  length-only stars") the first time it applies its policy.
+- While any detector is active, every input value is occluded to its length
+  regardless of preset (no unmask escape reopens one) -- scanning a value as
+  typed would leak it through keystroke prefixes.
+- Add the `RecordPlugin.applyPrivacyPolicy` hook so a plugin can transform
+  the policy before `record()` compiles it; see the plugin's README for known
+  limitations.
+- Rebased onto the renamed rule actions: a policy handed to
+  `applyPrivacyDetectors` or the plugin uses `mask`/`block`/`unmask`, and
+  `vendorCompat` is carried through untouched.
diff --git a/docs/recipes/plugin-api.md b/docs/recipes/plugin-api.md
index e61be76eb0..649f12490e 100644
--- a/docs/recipes/plugin-api.md
+++ b/docs/recipes/plugin-api.md
@@ -12,6 +12,7 @@ The plugin API is designed to enable extending the functionality of rrweb withou
 - [@rrweb/rrweb-plugin-canvas-webrtc-replay](packages/plugins/rrweb-plugin-canvas-webrtc-replay): A plugin for playing streamed `<canvas>` via WebRTC.
 - [@rrweb/rrweb-plugin-network-record](packages/plugins/rrweb-plugin-network-record): A plugin for recording network requests (xhr/fetch).
 - [@rrweb/rrweb-plugin-network-replay](packages/plugins/rrweb-plugin-network-replay): A plugin for replaying network requests (xhr/fetch).
+- [@rrweb/rrweb-plugin-privacy-detectors](packages/plugins/rrweb-plugin-privacy-detectors): Opt-in heuristic PII matching (email, phone, card, SSN, IPv4).
 
 ## Interface
 
diff --git a/guide.md b/guide.md
index 1e4880569c..a3e2bad413 100644
--- a/guide.md
+++ b/guide.md
@@ -261,8 +261,8 @@ of preset or configuration.
 Masking an input value also suppresses the `selected` flag on the
 `<option>` elements of a `<select>`: which option is selected discloses the
 select's value just as the value itself does, so both follow one decision.
-This applies under `balanced`/`strict` and (as before) under
-`maskAllInputs` or `maskInputOptions.select`.
+This applies under `balanced`/`strict`, whenever a heuristic detector is
+active, and (as before) under `maskAllInputs` or `maskInputOptions.select`.
 
 CSS is never masked, on any preset or code path: `style`/`_cssText`
 attributes and `<style>` element text are exempt from every masking branch,
@@ -531,6 +531,62 @@ record({
 });
 ```
 
+##### Heuristic PII detectors
+
+Heuristic PII detection (email, phone, Luhn-valid payment card, SSN-like,
+IPv4) is never implied by a preset. Opt in with
+`@rrweb/rrweb-plugin-privacy-detectors` (or its `applyPrivacyDetectors`
+helper), which masks the whole text node when a detector matches -- there is
+no character-range masking and no support for custom detector patterns.
+Detection scans **page text only**, at snapshot time and on later live text
+mutations. It only applies to text that would otherwise be recorded unmasked
+-- text already masked by a preset, selector, or manual option keeps that
+masking (including a trusted manual `maskTextFn` output). Attribute values
+are not scanned; use the presets' masked-attribute defaults or policy rules
+for those.
+
+Input values are never scanned. Instead, **while detectors are active every
+input value is occluded to its length** (`'*'.repeat(value.length)`),
+whatever the preset -- the plugin's policy compiles to `maskAllInputs: true`
+even on a `minimal` base, and no unmask escape reopens it: neither
+`unmaskTextSelector`, nor a policy `unmask` rule, nor `.rr-unmask`
+reveals an input value. Scanning one would be worse than useless: a value is
+re-examined on every input event, so a card number is recorded verbatim in
+every prefix shorter than the first Luhn-valid length, and a value that
+scans clean still discloses every kind of PII the fixed pattern set does not
+model (passport numbers, non-US phone formats, dates of birth, account
+numbers, free text). Page text is different in kind -- already rendered, not
+accumulated a character at a time -- which is why scanning still applies
+there.
+
+```js
+import { getRecordPrivacyDetectorsPlugin } from '@rrweb/rrweb-plugin-privacy-detectors';
+
+record({
+  emit(event) {
+    // store event
+  },
+  plugins: [getRecordPrivacyDetectorsPlugin()],
+});
+```
+
+Once loaded, text detection runs independently of the active preset --
+including `minimal` -- on top of whatever masking that preset already applies,
+and input occlusion is unconditional. The first time the plugin applies its
+policy, it logs a one-time `console.info` ("privacy-detectors active: input
+values record as length-only stars") as a visible confirmation that input
+occlusion is in force.
+
+> **Experimental.** Unlike the rest of Privacy at Capture, whole-value
+> heuristic detection on live text mutations has no production mileage in a
+> shipped session-replay recorder. Two limitations are known and unfixed: a
+> plugin whose policy transform fails to compile silently falls back to your
+> own, less restrictive policy with only a `console.error` (which also drops
+> the forced input occlusion); and any text over 10,000 characters is masked
+> wholesale without being scanned. See the plugin README for details. Treat
+> detectors as a backstop, not as the control protecting a field you already
+> know is sensitive.
+
 ##### Attribute and input masking callbacks
 
 For unusual attribute-bearing applications, `maskAllElementAttributes` is the
@@ -546,8 +602,9 @@ and can only
 narrow what the callback chose to keep, never restore something the policy
 would otherwise mask. `style`/`_cssText` are exempt from all of this.
 Likewise, under `minimal`, `maskInputFn`'s return value is trusted verbatim;
-under `balanced`/`strict`, `maskInputFn` output is star-replaced -- the
-callback controls length, never content. Every callback fails closed the
+under `balanced`/`strict` -- or with the detectors plugin loaded, which forces
+the same posture -- `maskInputFn` output is star-replaced: the callback
+controls length, never content. Every callback fails closed the
 same way: a `maskInputFn` or `maskTextFn` that throws, or returns anything
 other than a string, yields stars for the raw value instead of aborting the
 snapshot or recording the value. Protected inputs (see above) never reach
@@ -645,11 +702,11 @@ Breaking changes versus pre-2.0 masking, for anyone upgrading:
   `shouldMaskInputWithPrivacy`, `maskAttributeWithPrivacy`,
   `protectSerializedAttribute`, `getPrivacyAction`, and
   `mergeBlockSelectors`.
-- `rrweb-snapshot`'s barrel now also re-exports three internals --
-  `splitSelectorList`, `stars`, and `validateSelector`. They are `@internal`
-  and **unstable**: exported for cross-package use and direct unit testing,
-  not part of the supported API, and free to change or disappear without a
-  major bump.
+- `rrweb-snapshot`'s barrel now also re-exports four internals --
+  `splitSelectorList`, `stars`, `passesLuhn`, and `validateSelector`. They
+  are `@internal` and **unstable**: exported for cross-package use and direct
+  unit testing, not part of the supported API, and free to change or
+  disappear without a major bump.
 
 ##### For event consumers
 
diff --git a/packages/plugins/rrweb-plugin-privacy-detectors/README.md b/packages/plugins/rrweb-plugin-privacy-detectors/README.md
new file mode 100644
index 0000000000..4dc442c673
--- /dev/null
+++ b/packages/plugins/rrweb-plugin-privacy-detectors/README.md
@@ -0,0 +1,124 @@
+# @rrweb/rrweb-plugin-privacy-detectors
+
+Opt-in heuristic PII matching for rrweb Privacy at Capture — inspired by the
+automatic PII redaction found in commercial session-replay tooling:
+whole-value masking of a **page text node** when a detector matches (email,
+phone, Luhn-valid payment card, SSN-like, IPv4). Detection covers the full
+snapshot and later live text mutations.
+
+**Input values are never scanned. While this plugin is loaded, every input
+value is occluded to its length instead** (`'*'.repeat(value.length)`),
+whatever privacy preset you configured — including none at all. The one
+exception follows from how the guarantee works: occlusion is driven by the
+compiled detector set, so loading the plugin with every detector flag
+disabled compiles to no detectors and does not force input occlusion. See
+[Why inputs are occluded rather than scanned](#why-inputs-are-occluded-rather-than-scanned).
+
+Attribute values are not scanned either -- attribute masking is handled by
+the privacy presets and policy rules instead.
+
+No privacy preset implies detection on its own. `balanced` and `strict` mask
+form values and honor `data-privacy` / policy rules, but neither one scans
+page text for emails, phones, cards, SSNs, or IP addresses unless this plugin
+(or `applyPrivacyDetectors`) is used.
+
+## Installation
+
+```bash
+npm install @rrweb/rrweb-plugin-privacy-detectors
+```
+
+## Usage
+
+```js
+import { record } from '@rrweb/record';
+import { getRecordPrivacyDetectorsPlugin } from '@rrweb/rrweb-plugin-privacy-detectors';
+
+record({
+  emit(event) {
+    // store event
+  },
+  privacyPolicy: {
+    version: 1,
+    preset: 'balanced',
+  },
+  plugins: [
+    getRecordPrivacyDetectorsPlugin(),
+    // or disable one class of match:
+    // getRecordPrivacyDetectorsPlugin({ ipAddress: false }),
+  ],
+});
+```
+
+If `privacyPolicy` is omitted, the plugin keeps the `minimal` preset (existing
+`maskTextFn` / `maskInputOptions` behavior) -- and still detects: detection is
+independent of preset, so a bare `record({ plugins: [getRecordPrivacyDetectorsPlugin()] })`
+with no `privacyPolicy` at all masks any page text node a detector matches,
+at snapshot time and on live text mutations, on top of whatever `maskTextFn`
+already does. Detectors only inspect text that would otherwise be recorded
+unmasked: where a manual option already masks (e.g. a trusted `maskTextFn`
+composition), that output is kept as-is.
+
+Input values are the exception to "independent of preset": the plugin's
+policy compiles to `maskAllInputs: true` even on a `minimal` base, so form
+values are occluded to length regardless of what you configured.
+
+For snapshot-only use (no recorder):
+
+```js
+import { snapshot } from 'rrweb-snapshot';
+import { applyPrivacyDetectors } from '@rrweb/rrweb-plugin-privacy-detectors';
+
+snapshot(document, {
+  privacyPolicy: applyPrivacyDetectors({ version: 1, preset: 'balanced' }),
+});
+```
+
+## Why inputs are occluded rather than scanned
+
+Two reasons, and neither is fixable by a better pattern set.
+
+**Scanning a value as it is typed records raw prefixes.** An input value is
+re-examined on every input event. A payment card number does not trip the
+`paymentCard` detector until it is long enough for Luhn to pass, so every
+keystroke before that is recorded verbatim and the full number is trivially
+reconstructable from the prefixes -- even though the final value comes out
+masked. The same holds for an email that is only an email once the `@` and
+the domain arrive.
+
+**A clean scan is still a disclosure.** Deciding to record a value because
+no detector matched publishes everything the detectors do not model:
+passport and national ID numbers outside the SSN shape, non-US phone
+formats, dates of birth, account and policy numbers, addresses, free-text
+answers. A fixed pattern set cannot enumerate PII, so "nothing matched" is
+never evidence that a value is safe.
+
+Occluding the value to its length sidesteps both: no prefix is ever recorded,
+and the decision does not depend on the pattern set being complete. Text
+nodes are different in kind -- page copy is already rendered and static, is
+not accumulated a character at a time, and is overwhelmingly not PII -- which
+is why scanning still applies there.
+
+If you know a field is sensitive, say so directly with `data-privacy="mask"`,
+a policy rule, or a `balanced`/`strict` preset. Detectors are a backstop, not
+a control.
+
+## Known limitations (not yet production-proven)
+
+This plugin is **experimental**. Unlike the mechanisms in the core Privacy at
+Capture policy, whole-value heuristic detection on live text mutations has no
+production mileage in a shipped session-replay recorder. Two limitations are
+known and unfixed:
+
+- **A plugin whose policy transform fails to compile silently downgrades
+  protection.** If `applyPrivacyPolicy` returns something
+  `compilePrivacyPolicy` cannot compile, `record()` falls back to the user's
+  own (less restrictive) policy and continues recording, reporting the
+  problem only through a `console.error`. Recording does not stop and no
+  callback is invoked, so a broken transform can go unnoticed in production.
+  Note that this also drops the forced input occlusion, since that rides on
+  the transformed policy.
+- **Text over 10,000 characters is masked wholesale without scanning.**
+  `MAX_SCAN_LENGTH` bounds the work each detector does; anything longer fails
+  closed and is starred in full rather than being inspected. This is safe but
+  lossy — a long, entirely benign text node is destroyed in the replay.
diff --git a/packages/plugins/rrweb-plugin-privacy-detectors/package.json b/packages/plugins/rrweb-plugin-privacy-detectors/package.json
new file mode 100644
index 0000000000..cafe12fc1a
--- /dev/null
+++ b/packages/plugins/rrweb-plugin-privacy-detectors/package.json
@@ -0,0 +1,66 @@
+{
+  "name": "@rrweb/rrweb-plugin-privacy-detectors",
+  "version": "2.1.1",
+  "description": "Opt-in heuristic PII detectors for rrweb Privacy at Capture",
+  "type": "module",
+  "main": "./dist/rrweb-plugin-privacy-detectors.umd.cjs",
+  "module": "./dist/rrweb-plugin-privacy-detectors.js",
+  "unpkg": "./dist/rrweb-plugin-privacy-detectors.umd.cjs",
+  "jsdelivr": "./umd/rrweb-plugin-privacy-detectors.js",
+  "typings": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/rrweb-plugin-privacy-detectors.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/rrweb-plugin-privacy-detectors.umd.cjs"
+      }
+    }
+  },
+  "files": [
+    "umd",
+    "dist",
+    "package.json"
+  ],
+  "scripts": {
+    "dev": "vite build --watch",
+    "test": "vitest run",
+    "test:watch": "vitest watch",
+    "build": "yarn turbo run prepublish",
+    "check-types": "tsc -noEmit",
+    "prepublish": "tsc -noEmit && vite build"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rrweb-io/rrweb.git"
+  },
+  "keywords": [
+    "devtools",
+    "product-analytics",
+    "real-user-monitoring",
+    "rrweb",
+    "privacy"
+  ],
+  "author": "rrweb Core Team <maintainers@rrweb.com>",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/rrweb-io/rrweb/issues"
+  },
+  "homepage": "https://github.com/rrweb-io/rrweb#readme",
+  "devDependencies": {
+    "@rrweb/types": "^2.1.1",
+    "rrweb-snapshot": "^2.1.1",
+    "typescript": "^5.4.5",
+    "vite": "^6.0.1",
+    "vite-plugin-dts": "^3.9.1",
+    "vitest": "^1.4.0"
+  },
+  "peerDependencies": {
+    "@rrweb/types": "^2.1.1",
+    "rrweb": "^2.1.1",
+    "rrweb-snapshot": "^2.1.1"
+  }
+}
diff --git a/packages/plugins/rrweb-plugin-privacy-detectors/src/index.ts b/packages/plugins/rrweb-plugin-privacy-detectors/src/index.ts
new file mode 100644
index 0000000000..1470257baa
--- /dev/null
+++ b/packages/plugins/rrweb-plugin-privacy-detectors/src/index.ts
@@ -0,0 +1,41 @@
+import type { RecordPlugin } from '@rrweb/types';
+import {
+  applyPrivacyDetectors,
+  DEFAULT_PRIVACY_DETECTORS,
+  type PrivacyPolicy,
+} from 'rrweb-snapshot';
+
+export type PrivacyDetectorsPluginOptions = Partial<
+  typeof DEFAULT_PRIVACY_DETECTORS
+>;
+
+export const PLUGIN_NAME = 'rrweb/privacy-detectors@1';
+
+export { applyPrivacyDetectors, DEFAULT_PRIVACY_DETECTORS };
+
+let loggedActiveOnce = false;
+
+/** Heuristic PII matching over page text; opt in explicitly. See the README for input-occlusion rationale and known limitations. */
+export const getRecordPrivacyDetectorsPlugin: (
+  options?: PrivacyDetectorsPluginOptions,
+) => RecordPlugin<PrivacyDetectorsPluginOptions> = (options = {}) => {
+  const _options = { ...DEFAULT_PRIVACY_DETECTORS, ...options };
+
+  return {
+    name: PLUGIN_NAME,
+    applyPrivacyPolicy(policy) {
+      if (!loggedActiveOnce) {
+        loggedActiveOnce = true;
+        console.info(
+          'privacy-detectors active: input values record as length-only stars',
+        );
+      }
+      const portable = (policy as PrivacyPolicy | undefined) || {
+        version: 1 as const,
+        preset: 'minimal' as const,
+      };
+      return applyPrivacyDetectors(portable, _options);
+    },
+    options: _options,
+  };
+};
diff --git a/packages/plugins/rrweb-plugin-privacy-detectors/test/index.test.ts b/packages/plugins/rrweb-plugin-privacy-detectors/test/index.test.ts
new file mode 100644
index 0000000000..e6954e8a64
--- /dev/null
+++ b/packages/plugins/rrweb-plugin-privacy-detectors/test/index.test.ts
@@ -0,0 +1,155 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { describe, expect, it, vi } from 'vitest';
+import {
+  applyPrivacyDetectors,
+  getRecordPrivacyDetectorsPlugin,
+  PLUGIN_NAME,
+} from '../src/index';
+import {
+  compilePrivacyPolicy,
+  detectSensitiveValue,
+  maskInput,
+  type PrivacyPolicy,
+} from 'rrweb-snapshot';
+
+describe('privacy detectors plugin', () => {
+  it('opts heuristic detectors onto a balanced policy', () => {
+    const plugin = getRecordPrivacyDetectorsPlugin();
+    expect(plugin.name).toBe(PLUGIN_NAME);
+    expect(
+      plugin.applyPrivacyPolicy?.({
+        version: 1,
+        preset: 'balanced',
+      }),
+    ).toMatchObject({
+      version: 1,
+      preset: 'balanced',
+      detectors: {
+        email: true,
+        phone: true,
+        paymentCard: true,
+        ssn: true,
+        ipAddress: true,
+      },
+    });
+  });
+
+  it('lets policy flags disable a detector the plugin would enable', () => {
+    expect(
+      applyPrivacyDetectors(
+        {
+          version: 1,
+          preset: 'balanced',
+          detectors: { email: false },
+        },
+        { email: true },
+      ).detectors,
+    ).toMatchObject({
+      email: false,
+      phone: true,
+    });
+  });
+
+  it('does not upgrade an omitted recorder policy to balanced', () => {
+    const plugin = getRecordPrivacyDetectorsPlugin();
+    expect(plugin.applyPrivacyPolicy?.(undefined)).toMatchObject({
+      version: 1,
+      preset: 'minimal',
+      detectors: {
+        email: true,
+        phone: true,
+        paymentCard: true,
+        ssn: true,
+        ipAddress: true,
+      },
+    });
+  });
+
+  it('plugin with no user policy yields a minimal policy whose compiled detectors are active', () => {
+    const plugin = getRecordPrivacyDetectorsPlugin();
+    const policy = plugin.applyPrivacyPolicy!(undefined) as PrivacyPolicy;
+    expect(policy.preset).toBe('minimal');
+    const compiled = compilePrivacyPolicy(policy);
+    expect(compiled.detectors.length).toBeGreaterThan(0);
+    expect(detectSensitiveValue('bob@example.com', compiled)).toBe(true);
+  });
+
+  it.each(['minimal', 'balanced', 'strict'] as const)(
+    'forces maskAllInputs on a %s base policy',
+    (preset) => {
+      const plugin = getRecordPrivacyDetectorsPlugin();
+      const policy = plugin.applyPrivacyPolicy!({
+        version: 1,
+        preset,
+      }) as PrivacyPolicy;
+      const compiled = compilePrivacyPolicy(policy);
+      // Input values are occluded to length, never scanned -- so the posture
+      // does not depend on which preset the page configured.
+      expect(compiled.maskAllInputs).toBe(true);
+      expect(compiled.preset).toBe(preset);
+    },
+  );
+
+  it('an unmask escape never reopens an input value', () => {
+    const plugin = getRecordPrivacyDetectorsPlugin();
+    const policy = plugin.applyPrivacyPolicy!({
+      version: 1,
+      preset: 'minimal',
+      rules: [
+        {
+          target: { type: 'selector', selector: '.rr-unmask' },
+          action: 'unmask',
+        },
+      ],
+    }) as PrivacyPolicy;
+    const compiled = compilePrivacyPolicy(policy);
+    expect(compiled.unmaskTextSelector).toContain('.rr-unmask');
+    // The unmask selector reopens text and the preset's masked attributes;
+    // `maskAllInputs` is consulted with no unmask escape at all.
+    expect(compiled.maskAllInputs).toBe(true);
+    expect(
+      maskInput({
+        element: document.createElement('input'),
+        tagName: 'input',
+        type: 'text',
+        value: 'Visible Name',
+        maskInputOptions: {},
+        privacy: compiled,
+      }),
+    ).toBe('*'.repeat('Visible Name'.length));
+  });
+});
+
+/**
+ * The module-level once-flag means this only reads cleanly against a fresh
+ * module instance -- `vi.resetModules()` plus a dynamic re-import isolates
+ * it from every other test in this file that already exercised
+ * `applyPrivacyPolicy`.
+ */
+describe('privacy-detectors active info log', () => {
+  it('logs once at first policy application, across plugin instances', async () => {
+    vi.resetModules();
+    const info = vi.spyOn(console, 'info').mockImplementation(() => undefined);
+    try {
+      const fresh = await import('../src/index');
+      const plugin = fresh.getRecordPrivacyDetectorsPlugin();
+      plugin.applyPrivacyPolicy?.({ version: 1, preset: 'minimal' });
+      plugin.applyPrivacyPolicy?.({ version: 1, preset: 'minimal' });
+      const secondPlugin = fresh.getRecordPrivacyDetectorsPlugin();
+      secondPlugin.applyPrivacyPolicy?.({ version: 1, preset: 'minimal' });
+
+      const activeLogs = info.mock.calls.filter(([msg]) =>
+        String(msg).includes('privacy-detectors active'),
+      );
+      expect(activeLogs).toHaveLength(1);
+      expect(activeLogs[0][0]).toContain(
+        'input values record as length-only stars',
+      );
+    } finally {
+      info.mockRestore();
+      vi.resetModules();
+    }
+  });
+});
diff --git a/packages/plugins/rrweb-plugin-privacy-detectors/tsconfig.json b/packages/plugins/rrweb-plugin-privacy-detectors/tsconfig.json
new file mode 100644
index 0000000000..3412c6c7aa
--- /dev/null
+++ b/packages/plugins/rrweb-plugin-privacy-detectors/tsconfig.json
@@ -0,0 +1,17 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "include": ["src"],
+  "exclude": ["vite.config.ts", "vitest.config.ts", "test"],
+  "compilerOptions": {
+    "rootDir": "src",
+    "tsBuildInfoFile": "./tsconfig.tsbuildinfo"
+  },
+  "references": [
+    {
+      "path": "../../rrweb-snapshot"
+    },
+    {
+      "path": "../../types"
+    }
+  ]
+}
diff --git a/packages/plugins/rrweb-plugin-privacy-detectors/vite.config.ts b/packages/plugins/rrweb-plugin-privacy-detectors/vite.config.ts
new file mode 100644
index 0000000000..6d7a9c8ea1
--- /dev/null
+++ b/packages/plugins/rrweb-plugin-privacy-detectors/vite.config.ts
@@ -0,0 +1,3 @@
+import config from '../../../vite.config.default';
+
+export default config('src/index.ts', 'rrwebPluginPrivacyDetectors');
diff --git a/packages/plugins/rrweb-plugin-privacy-detectors/vitest.config.ts b/packages/plugins/rrweb-plugin-privacy-detectors/vitest.config.ts
new file mode 100644
index 0000000000..3e58ef7356
--- /dev/null
+++ b/packages/plugins/rrweb-plugin-privacy-detectors/vitest.config.ts
@@ -0,0 +1,16 @@
+/// <reference types="vitest" />
+import { defineProject, mergeConfig } from 'vitest/config';
+import { resolve } from 'node:path';
+import configShared from '../../../vitest.config.ts';
+
+export default mergeConfig(
+  configShared,
+  defineProject({
+    resolve: {
+      alias: {
+        'rrweb-snapshot': resolve(__dirname, '../../rrweb-snapshot/src'),
+        '@rrweb/types': resolve(__dirname, '../../types/src'),
+      },
+    },
+  }),
+);
diff --git a/packages/rrweb-snapshot/src/privacy.ts b/packages/rrweb-snapshot/src/privacy.ts
index a14c0ae076..91e7939c9b 100644
--- a/packages/rrweb-snapshot/src/privacy.ts
+++ b/packages/rrweb-snapshot/src/privacy.ts
@@ -1,7 +1,9 @@
 import type {
+  CompiledDetector,
   CompiledPrivacyPolicy,
   MaskAttributeFn,
   MaskTextFn,
+  PrivacyDetectorOptions,
   PrivacyPolicy,
   VendorCompatId,
 } from './types';
@@ -252,6 +254,90 @@ export const FORM_VALUE_TAGS = new Set([
   'TEXTAREA',
 ]);
 
+const CARD_CANDIDATE = /(?:^|[^0-9-])((?:\d[ -]?){12,18}\d)(?:$|[^0-9-])/;
+const SSN_PATTERN = /\b(?!000|666|9\d{2})\d{3}-?(?!00)\d{2}-?(?!0000)\d{4}\b/;
+const EMAIL_PATTERN =
+  /[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]{1,64}@[a-zA-Z0-9-]{1,63}(?:\.[a-zA-Z0-9-]{1,63})+/;
+const PHONE_PATTERN = /(?:^|\s)\+?\d{0,3}[\s.-]?\(?\d[\d ().-]{5,13}\d(?:$|\s)/;
+const IPV4_PATTERN = /\b(?:\d{1,3}\.){3}\d{1,3}\b/;
+const MAX_SCAN_LENGTH = 10_000;
+
+export const DEFAULT_PRIVACY_DETECTORS: Required<PrivacyDetectorOptions> = {
+  email: true,
+  phone: true,
+  paymentCard: true,
+  ssn: true,
+  ipAddress: true,
+};
+
+/** Opts into heuristic PII detectors; see guide.md "Heuristic PII detectors". EXPERIMENTAL: see the plugin README for known limitations. */
+export function applyPrivacyDetectors(
+  policy: PrivacyPolicy | undefined,
+  options?: PrivacyDetectorOptions,
+): PrivacyPolicy {
+  const base: PrivacyPolicy = policy || { version: 1, preset: 'minimal' };
+  return {
+    ...base,
+    detectors: {
+      ...DEFAULT_PRIVACY_DETECTORS,
+      ...options,
+      ...base.detectors,
+    },
+  };
+}
+
+export function buildDetectors(
+  options: PrivacyDetectorOptions | undefined,
+): CompiledDetector[] {
+  const opts = options || {};
+  const detectors: CompiledDetector[] = [];
+  if (opts.email)
+    detectors.push({ name: 'email', test: (v) => EMAIL_PATTERN.test(v) });
+  if (opts.phone)
+    detectors.push({
+      name: 'phone',
+      test: (v) => {
+        const m = PHONE_PATTERN.exec(v);
+        if (!m) return false;
+        const digits = m[0].replace(/\D/g, '');
+        return digits.length >= 10 && digits.length <= 15;
+      },
+    });
+  if (opts.paymentCard)
+    detectors.push({
+      name: 'payment-card',
+      test: (v) => {
+        const m = CARD_CANDIDATE.exec(v);
+        return !!m && passesLuhn(m[1]);
+      },
+    });
+  if (opts.ssn)
+    detectors.push({ name: 'ssn', test: (v) => SSN_PATTERN.test(v) });
+  if (opts.ipAddress)
+    detectors.push({
+      name: 'ip-address',
+      test: (v) => {
+        const m = IPV4_PATTERN.exec(v);
+        return !!m && m[0].split('.').every((p) => Number(p) <= 255);
+      },
+    });
+  return detectors;
+}
+
+/** Runs the compiled detectors over one text node or `characterData` mutation value. */
+export function detectSensitiveValue(
+  value: string,
+  privacy: CompiledPrivacyPolicy,
+): boolean {
+  if (!privacy.detectors.length || !value) return false;
+  if (value.length > MAX_SCAN_LENGTH) return true;
+  const { detectors } = privacy;
+  for (let index = 0; index < detectors.length; index += 1) {
+    if (detectors[index].test(value)) return true;
+  }
+  return false;
+}
+
 /** Occludes text content, preserving whitespace so layout survives; contrast `stars`, which occludes to length. */
 function starText(value: string): string {
   return value.replace(/[\S]/g, '*');
@@ -264,6 +350,7 @@ export function resolveTextValue({
   parentTagName,
   needsMask,
   maskTextFn,
+  privacy,
   exemptScript,
 }: {
   value: string;
@@ -273,13 +360,15 @@ export function resolveTextValue({
   parentTagName?: string;
   needsMask: boolean;
   maskTextFn: MaskTextFn | undefined;
+  privacy: CompiledPrivacyPolicy | undefined;
   exemptScript: boolean;
 }): string {
   if (!value) return value;
   const tagName = parentTagName ?? untaintedTagName(parent);
   if (tagName === 'STYLE') return value;
+  const isScript = tagName === 'SCRIPT';
   if (needsMask) {
-    if (tagName === 'SCRIPT' && exemptScript) return value;
+    if (isScript && exemptScript) return value;
     if (!maskTextFn) return starText(value);
     // A callback that throws or returns a non-string fails closed to stars.
     let masked: unknown;
@@ -290,6 +379,8 @@ export function resolveTextValue({
     }
     return typeof masked === 'string' ? masked : starText(value);
   }
+  if (isScript) return value;
+  if (privacy && detectSensitiveValue(value, privacy)) return starText(value);
   return value;
 }
 
@@ -414,6 +505,8 @@ export function compilePrivacyPolicy(
     console.warn(
       '[rrweb privacy] vendorCompat has no effect under the minimal preset; use balanced or strict, or add the classes as mask/block rules.',
     );
+  const detectors = buildDetectors(effective.detectors);
+  const maskAllInputs = managed || detectors.length > 0;
   const maskedAttributes = new Set(managed ? MASKED_ATTRIBUTE_DEFAULTS : []);
   const blockMedia = preset === 'strict';
 
@@ -470,10 +563,11 @@ export function compilePrivacyPolicy(
     ignoreEventsSelector: managed
       ? joinSelectors([vendorCompatSelector(compatVendors, 'ignoreEvents')])
       : null,
-    maskAllInputs: managed,
+    maskAllInputs,
     maskedAttributes,
     attributePolicyInert: !blockMedia && maskedAttributes.size === 0,
     blockMedia,
+    detectors,
   };
 }
 
@@ -565,6 +659,24 @@ export function resolvePrivacyContext({
   };
 }
 
+export function passesLuhn(candidate: string): boolean {
+  const digits = candidate.replace(/[ -]/g, '');
+  if (!/^\d{13,19}$/.test(digits) || /^(\d)\1+$/.test(digits)) return false;
+
+  let sum = 0;
+  let double = false;
+  for (let index = digits.length - 1; index >= 0; index -= 1) {
+    let digit = Number(digits[index]);
+    if (double) {
+      digit *= 2;
+      if (digit > 9) digit -= 9;
+    }
+    sum += digit;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+
 let maskAttributeConflictWarned = false;
 
 /** Occludes a value to its length; contrast `starText`, which preserves whitespace/layout. */
diff --git a/packages/rrweb-snapshot/src/snapshot.ts b/packages/rrweb-snapshot/src/snapshot.ts
index a8e6124ea9..a3938e2aa4 100644
--- a/packages/rrweb-snapshot/src/snapshot.ts
+++ b/packages/rrweb-snapshot/src/snapshot.ts
@@ -555,6 +555,7 @@ function serializeNode(
         maskTextFn,
         rootId,
         cssCaptured,
+        privacy,
       });
     case n.CDATA_SECTION_NODE:
       return {
@@ -587,9 +588,10 @@ function serializeTextNode(
     maskTextFn: MaskTextFn | undefined;
     rootId: number | undefined;
     cssCaptured?: boolean;
+    privacy?: CompiledPrivacyPolicy;
   },
 ): serializedNode {
-  const { needsMask, maskTextFn, rootId, cssCaptured } = options;
+  const { needsMask, maskTextFn, rootId, cssCaptured, privacy } = options;
   const parent = dom.parentElement(n);
   const parentTagName = dom.untaintedTagName(parent);
   let textContent: string | null = '';
@@ -613,6 +615,7 @@ function serializeTextNode(
       parentTagName,
       needsMask,
       maskTextFn,
+      privacy,
       exemptScript: true,
     });
   }
diff --git a/packages/rrweb-snapshot/src/types.ts b/packages/rrweb-snapshot/src/types.ts
index 8267b105bb..3e0b9377ee 100644
--- a/packages/rrweb-snapshot/src/types.ts
+++ b/packages/rrweb-snapshot/src/types.ts
@@ -82,6 +82,8 @@ export type {
   PrivacyRule,
   PrivacyTarget,
   VendorCompatId,
+  PrivacyDetectorOptions,
+  CompiledDetector,
   CompiledPrivacyPolicy,
 } from '@rrweb/types';
 
diff --git a/packages/rrweb-snapshot/test/privacy-integration.test.ts b/packages/rrweb-snapshot/test/privacy-integration.test.ts
index 452306d95f..76caf46d38 100644
--- a/packages/rrweb-snapshot/test/privacy-integration.test.ts
+++ b/packages/rrweb-snapshot/test/privacy-integration.test.ts
@@ -191,6 +191,58 @@ describe('text masking v2', () => {
     expect(out).not.toContain('hidden');
   });
 
+  it('detectors mask the whole text node under minimal when configured', () => {
+    const withDetectors: PrivacyPolicy = {
+      version: 1,
+      preset: 'minimal',
+      detectors: { paymentCard: true, phone: true },
+    };
+    const out = serialize(
+      '<p>call 5551234567 4111 1111 1111 1111 now</p>',
+      withDetectors,
+    );
+    expect(out).not.toContain('4111 1111 1111 1111');
+  });
+
+  it('detectors occlude every input value at snapshot time, clean or not', () => {
+    const withDetectors: PrivacyPolicy = {
+      version: 1,
+      preset: 'minimal',
+      detectors: { email: true },
+    };
+    const out = serialize(
+      '<input type="text" value="bob@example.com">' +
+        '<input type="text" value="Visible Name">',
+      withDetectors,
+    );
+    expect(out).not.toContain('bob@example.com');
+    expect(out).toContain('*'.repeat('bob@example.com'.length));
+    // The clean value is occluded too: input values are never scanned, so
+    // "no detector matched" is not a reason to record one.
+    expect(out).not.toContain('Visible Name');
+    expect(out).toContain('*'.repeat('Visible Name'.length));
+  });
+
+  it('an unmask rule cannot reveal an input value while detectors are on', () => {
+    const withDetectors: PrivacyPolicy = {
+      version: 1,
+      preset: 'minimal',
+      detectors: { email: true },
+      rules: [
+        {
+          target: { type: 'selector', selector: '.rr-unmask' },
+          action: 'unmask',
+        },
+      ],
+    };
+    const out = serialize(
+      '<input class="rr-unmask" type="text" value="Visible Name">',
+      withDetectors,
+    );
+    expect(out).not.toContain('Visible Name');
+    expect(out).toContain('*'.repeat('Visible Name'.length));
+  });
+
   it('keeps masking inherited from an ancestor outside the shadow root', () => {
     withShadowRoot(
       '<div class="rr-mask"><div id="host"></div></div>',
@@ -227,7 +279,7 @@ describe('text masking v2', () => {
     expect(out).not.toContain('secret');
   });
 
-  it('minimal leaves text untouched', () => {
+  it('minimal without detectors leaves text untouched', () => {
     expect(serialize('<p>bob@example.com</p>', undefined)).toContain(
       'bob@example.com',
     );
@@ -414,6 +466,79 @@ describe('maskInput v2', () => {
       }),
     ).toBe('plain');
   });
+  it('detectors occlude every input value to length, matched or not', () => {
+    const withDetectors = compilePrivacyPolicy({
+      version: 1,
+      preset: 'minimal',
+      detectors: { email: true },
+    });
+    expect(withDetectors.maskAllInputs).toBe(true);
+    expect(
+      maskInput({
+        element: input(),
+        tagName: 'input',
+        type: 'text',
+        value: 'bob@example.com',
+        maskInputOptions: {},
+        privacy: withDetectors,
+      }),
+    ).toBe('*'.repeat('bob@example.com'.length));
+    // A value no detector matches is occluded just the same: input values are
+    // never scanned, so a clean scan is never the reason one gets recorded.
+    expect(
+      maskInput({
+        element: input(),
+        tagName: 'input',
+        type: 'text',
+        value: 'plain',
+        maskInputOptions: {},
+        privacy: withDetectors,
+      }),
+    ).toBe('*****');
+  });
+  it('every keystroke prefix is occluded at its own length', () => {
+    // The leak this replaced: a value scanned per input event records every
+    // prefix shorter than the first Luhn-valid length verbatim.
+    const withDetectors = compilePrivacyPolicy({
+      version: 1,
+      preset: 'minimal',
+      detectors: { paymentCard: true },
+    });
+    const card = '4111111111111111';
+    for (let i = 1; i <= card.length; i++) {
+      expect(
+        maskInput({
+          element: input(),
+          tagName: 'input',
+          type: 'text',
+          value: card.slice(0, i),
+          maskInputOptions: {},
+          privacy: withDetectors,
+        }),
+      ).toBe('*'.repeat(i));
+    }
+  });
+  it('a maskInputFn controls length only while detectors are on', () => {
+    // Under a bare minimal policy the fn's output is trusted verbatim; with
+    // detectors active the policy forces the balanced/strict posture, so the
+    // fn keeps its say over length and loses its say over content.
+    const withDetectors = compilePrivacyPolicy({
+      version: 1,
+      preset: 'minimal',
+      detectors: { email: true },
+    });
+    expect(
+      maskInput({
+        element: input(),
+        tagName: 'input',
+        type: 'text',
+        value: 'bob@example.com',
+        maskInputOptions: { text: true },
+        maskInputFn: () => '[redacted]',
+        privacy: withDetectors,
+      }),
+    ).toBe('*'.repeat('[redacted]'.length));
+  });
   it('protected inputs always mask, even minimal with no options', () => {
     expect(
       maskInput({
@@ -1303,6 +1428,19 @@ describe('<option selected> follows the select value decision', () => {
     expect(out).not.toContain('"selected"');
   });
 
+  /**
+   * Detectors force `maskAllInputs` whatever the preset, so the flag has to
+   * follow even on a `minimal` base.
+   */
+  it('an active detector suppresses it even under minimal', () => {
+    const out = serialize(OPTIONS, {
+      version: 1,
+      preset: 'minimal',
+      detectors: { email: true },
+    });
+    expect(out).not.toContain('"selected"');
+  });
+
   it('minimal with no input masking still records it', () => {
     const out = serialize(OPTIONS, { version: 1, preset: 'minimal' });
     expect(out).toContain('"selected":true');
diff --git a/packages/rrweb-snapshot/test/privacy.test.ts b/packages/rrweb-snapshot/test/privacy.test.ts
index bb58f97838..f1ac368553 100644
--- a/packages/rrweb-snapshot/test/privacy.test.ts
+++ b/packages/rrweb-snapshot/test/privacy.test.ts
@@ -7,6 +7,8 @@ import {
   validateSelector,
   mergeSelectors,
   resolvePrivacyContext,
+  detectSensitiveValue,
+  buildDetectors,
   splitSelectorList,
   resolveTextValue,
   isEventIgnored,
@@ -48,6 +50,34 @@ describe('compilePrivacyPolicy v2', () => {
     expect(c.maskAllInputs).toBe(false);
     expect([...c.maskedAttributes]).toEqual([]);
     expect(c.attributePolicyInert).toBe(true);
+    expect(c.detectors).toEqual([]);
+  });
+  it('any active detector forces maskAllInputs, even on a minimal base', () => {
+    const c = compilePrivacyPolicy({
+      version: 1,
+      preset: 'minimal',
+      detectors: { email: true },
+    });
+    expect(c.preset).toBe('minimal');
+    expect(c.maskAllInputs).toBe(true);
+    // ...and nothing else about the minimal preset moves.
+    expect(c.maskTextSelector).toBeNull();
+    expect([...c.maskedAttributes]).toEqual([]);
+  });
+  it('a detectors block with every flag off leaves the preset alone', () => {
+    const c = compilePrivacyPolicy({
+      version: 1,
+      preset: 'minimal',
+      detectors: {
+        email: false,
+        phone: false,
+        paymentCard: false,
+        ssn: false,
+        ipAddress: false,
+      },
+    });
+    expect(c.detectors).toEqual([]);
+    expect(c.maskAllInputs).toBe(false);
   });
   it('balanced masks inputs and attributes but not text', () => {
     const c = compilePrivacyPolicy({ version: 1, preset: 'balanced' });
@@ -1187,6 +1217,100 @@ describe('merge helpers validate the record()-level selector', () => {
     expect(warn).toHaveBeenCalled();
   });
 });
+
+describe('detectSensitiveValue', () => {
+  const withDetectors = compilePrivacyPolicy({
+    version: 1,
+    preset: 'minimal',
+    detectors: {
+      email: true,
+      phone: true,
+      paymentCard: true,
+      ssn: true,
+      ipAddress: true,
+    },
+  });
+
+  it('detects a Luhn-valid card adjacent to other digits (review regression)', () => {
+    expect(
+      detectSensitiveValue(
+        'call 5551234567 4111 1111 1111 1111 now',
+        withDetectors,
+      ),
+    ).toBe(true);
+  });
+
+  it('detects email, ssn, ip; passes clean prose', () => {
+    expect(detectSensitiveValue('contact bob@example.com', withDetectors)).toBe(
+      true,
+    );
+    expect(detectSensitiveValue('ssn 123-45-6789', withDetectors)).toBe(true);
+    expect(detectSensitiveValue('host 192.168.0.1', withDetectors)).toBe(true);
+    expect(detectSensitiveValue('the quick brown fox', withDetectors)).toBe(
+      false,
+    );
+  });
+
+  it('rejects UUIDs and version strings as cards/ssns (false-positive guard)', () => {
+    expect(
+      detectSensitiveValue(
+        'id 550e8400-e29b-41d4-a716-446655440000',
+        withDetectors,
+      ),
+    ).toBe(false);
+    expect(detectSensitiveValue('v1.2.3.4000 build', withDetectors)).toBe(
+      false,
+    );
+  });
+
+  it('detects regardless of preset (works under minimal)', () => {
+    expect(withDetectors.preset).toBe('minimal');
+    expect(detectSensitiveValue('4111 1111 1111 1111', withDetectors)).toBe(
+      true,
+    );
+  });
+
+  it('no detectors configured -> never detects', () => {
+    const none = compilePrivacyPolicy({ version: 1, preset: 'strict' });
+    expect(detectSensitiveValue('bob@example.com', none)).toBe(false);
+  });
+
+  it('fails closed on absurdly long input instead of scanning it', () => {
+    const clean = 'a'.repeat(10_001);
+    expect(detectSensitiveValue(clean, withDetectors)).toBe(true);
+  });
+
+  it('per-detector toggles work', () => {
+    const emailOff = buildDetectors({
+      email: false,
+      phone: false,
+      paymentCard: true,
+      ssn: false,
+      ipAddress: false,
+    });
+    expect(emailOff.some((d) => d.name === 'email')).toBe(false);
+    expect(emailOff.some((d) => d.name === 'payment-card')).toBe(true);
+  });
+
+  it('detects spaced phone format (fix regression)', () => {
+    expect(detectSensitiveValue('call 555 123 4567 now', withDetectors)).toBe(
+      true,
+    );
+  });
+
+  it('detects dashed phone format (fix regression)', () => {
+    expect(detectSensitiveValue('555-123-4567', withDetectors)).toBe(true);
+  });
+
+  it('detects parenthesized area code format (fix regression)', () => {
+    expect(detectSensitiveValue('(555) 123-4567', withDetectors)).toBe(true);
+  });
+
+  it('detects parenthesized area code with country code (fix regression)', () => {
+    expect(detectSensitiveValue('+1 (555) 123-4567', withDetectors)).toBe(true);
+  });
+});
+
 /**
  * `needMaskingText` is exported from the package root and its third parameter
  * changed shape (raw selector string -> pre-split `{maskAll, selector}`). An
diff --git a/packages/rrweb/src/index.ts b/packages/rrweb/src/index.ts
index 18b8f20f14..1bac245e3a 100644
--- a/packages/rrweb/src/index.ts
+++ b/packages/rrweb/src/index.ts
@@ -25,6 +25,7 @@ import './replay/styles/style.css';
 export type { recordOptions, ReplayPlugin } from './types';
 export type {
   PrivacyAction,
+  PrivacyDetectorOptions,
   PrivacyPolicy,
   PrivacyPreset,
   PrivacyRule,
diff --git a/packages/rrweb/src/record/index.ts b/packages/rrweb/src/record/index.ts
index c63b189433..59c51bfb98 100644
--- a/packages/rrweb/src/record/index.ts
+++ b/packages/rrweb/src/record/index.ts
@@ -3,6 +3,8 @@ import {
   slimDOMDefaults,
   type MaskInputOptions,
   createMirror,
+  compilePrivacyPolicy,
+  type CompiledPrivacyPolicy,
   resolvePrivacyContext,
 } from 'rrweb-snapshot';
 import { initObservers, mutationBuffers } from './observer';
@@ -114,8 +116,29 @@ function record<T = eventWithTime>(
     privacyPolicy,
   } = options;
 
-  const { privacy, blockSelector, maskTextSelector } = resolvePrivacyContext({
+  const portablePrivacyPolicy = (plugins || []).reduce(
+    (policy, plugin) =>
+      plugin.applyPrivacyPolicy
+        ? (plugin.applyPrivacyPolicy(policy) as typeof privacyPolicy)
+        : policy,
     privacyPolicy,
+  );
+  let compiledPrivacy: CompiledPrivacyPolicy;
+  try {
+    compiledPrivacy = compilePrivacyPolicy(portablePrivacyPolicy);
+  } catch (error) {
+    if (portablePrivacyPolicy !== privacyPolicy) {
+      console.error(
+        '[rrweb] plugin-transformed privacy policy failed to compile; using the user policy',
+        error,
+      );
+      compiledPrivacy = compilePrivacyPolicy(privacyPolicy);
+    } else {
+      throw error;
+    }
+  }
+  const { privacy, blockSelector, maskTextSelector } = resolvePrivacyContext({
+    privacy: compiledPrivacy,
     blockSelector: manualBlockSelector,
     maskTextSelector: manualMaskTextSelector,
     unmaskTextSelector: manualUnmaskTextSelector,
diff --git a/packages/rrweb/src/record/mutation.ts b/packages/rrweb/src/record/mutation.ts
index a48b322d52..1b156786fa 100644
--- a/packages/rrweb/src/record/mutation.ts
+++ b/packages/rrweb/src/record/mutation.ts
@@ -617,6 +617,7 @@ export default class MutationBuffer {
                     true, // checkAncestors
                   ),
                   maskTextFn: this.maskTextFn,
+                  privacy: this.privacy,
                   exemptScript: false,
                 })
               : value,
diff --git a/packages/rrweb/test/record.test.ts b/packages/rrweb/test/record.test.ts
index 93084c980b..0ae689b510 100644
--- a/packages/rrweb/test/record.test.ts
+++ b/packages/rrweb/test/record.test.ts
@@ -161,6 +161,50 @@ describe('record', function (this: ISuite) {
     expect(payload).toContain('*'.repeat('changed@example.com'.length));
   });
 
+  it('applies detector plugins to the initial full snapshot', async () => {
+    await ctx.page.setContent(`
+      <p id="contact">person@example.com</p>
+      <input id="name" type="text" value="Visible Name" />
+    `);
+    await ctx.page.evaluate(() => {
+      const { record } = (window as unknown as IWindow).rrweb;
+      record({
+        emit: (window as unknown as IWindow).emit,
+        privacyPolicy: { version: 1, preset: 'balanced' },
+        plugins: [
+          {
+            name: 'rrweb/privacy-detectors@1',
+            applyPrivacyPolicy(policy) {
+              const portable = (policy as { version: 1; preset: string }) || {
+                version: 1,
+                preset: 'minimal',
+              };
+              return {
+                ...portable,
+                detectors: {
+                  email: true,
+                  phone: false,
+                  paymentCard: false,
+                  ssn: false,
+                  ipAddress: false,
+                },
+              };
+            },
+            options: {},
+          },
+        ],
+      });
+    });
+    await waitForRAF(ctx.page);
+
+    const payload = JSON.stringify(ctx.events);
+    expect(payload).not.toContain('person@example.com');
+    // v2: masking is shape-free, star-only (no digit/letter-preserving mask).
+    expect(payload).toContain('*'.repeat('person@example.com'.length));
+    expect(payload).not.toContain('Visible Name');
+    expect(payload).toContain('*'.repeat('Visible Name'.length));
+  });
+
   it('applies final attribute masking to snapshots and mutations', async () => {
     await ctx.page.setContent(`
       <div id="target" title="initial@example.com" style="color: red"></div>
diff --git a/packages/rrweb/test/record/privacy.test.ts b/packages/rrweb/test/record/privacy.test.ts
index 4eb48982e9..e1451c5c56 100644
--- a/packages/rrweb/test/record/privacy.test.ts
+++ b/packages/rrweb/test/record/privacy.test.ts
@@ -3,7 +3,37 @@
  */
 import { describe, expect, it, vi } from 'vitest';
 import record from '../../src/record';
-import { EventType, IncrementalSource, type eventWithTime } from '@rrweb/types';
+import {
+  EventType,
+  IncrementalSource,
+  type RecordPlugin,
+  type eventWithTime,
+} from '@rrweb/types';
+
+describe('record() privacy policy plugin fallback', () => {
+  it('a plugin returning a malformed policy falls back to the user policy instead of throwing', () => {
+    const badPlugin: RecordPlugin = {
+      name: 'bad@1',
+      applyPrivacyPolicy: () => ({ nonsense: true } as never),
+    };
+
+    let stop: (() => void) | undefined;
+    expect(() => {
+      stop = record({ emit: () => {}, plugins: [badPlugin] });
+    }).not.toThrow();
+    stop?.();
+  });
+
+  it('still throws when the user supplies their own invalid policy directly (no plugin involved)', () => {
+    expect(() => {
+      record({
+        emit: () => {},
+        // @ts-expect-error intentionally invalid for this test
+        privacyPolicy: { nonsense: true },
+      });
+    }).toThrow();
+  });
+});
 
 describe('record() and a <form> whose tagName is shadowed', () => {
   it('records an attribute mutation on the form without throwing', async () => {
@@ -55,6 +85,159 @@ describe('record() and a <form> whose tagName is shadowed', () => {
   });
 });
 
+describe('record() privacy detectors on live updates', () => {
+  const withEmailDetector = {
+    version: 1,
+    preset: 'minimal',
+    detectors: { email: true },
+  } as const;
+
+  it('masks a characterData mutation whose new text trips a detector', async () => {
+    document.body.innerHTML = '<p>hello</p>';
+    const textNode = document.querySelector('p')!.firstChild as Text;
+
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: withEmailDetector,
+    });
+    try {
+      textNode.data = 'contact bob@example.com';
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+
+    const textMutations = events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Mutation
+        ? event.data.texts
+        : [],
+    );
+    expect(textMutations.length).toBeGreaterThan(0);
+    expect(JSON.stringify(textMutations)).not.toContain('bob@example.com');
+  });
+
+  it('leaves a characterData mutation with clean text untouched under minimal', async () => {
+    document.body.innerHTML = '<p>hello</p>';
+    const textNode = document.querySelector('p')!.firstChild as Text;
+
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: withEmailDetector,
+    });
+    try {
+      textNode.data = 'still plain text';
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+
+    const textMutations = events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Mutation
+        ? event.data.texts
+        : [],
+    );
+    expect(JSON.stringify(textMutations)).toContain('still plain text');
+  });
+
+  it('never scans <style> text mutations, even with detectors on', async () => {
+    document.body.innerHTML = '<style>body{color:red}</style>';
+    const textNode = document.querySelector('style')!.firstChild as Text;
+
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: withEmailDetector,
+    });
+    try {
+      // an email-shaped token inside CSS content must never star the sheet
+      textNode.data = '/* bob@example.com */ body{color:blue}';
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+
+    const textMutations = events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Mutation
+        ? event.data.texts
+        : [],
+    );
+    expect(JSON.stringify(textMutations)).toContain('body{color:blue}');
+  });
+
+  /** The masked values the recorder emitted, in order. */
+  async function recordInputValues(
+    markup: string,
+    drive: (input: HTMLInputElement) => void,
+    options: { unmaskTextSelector?: string } = {},
+  ): Promise<string[]> {
+    document.body.innerHTML = markup;
+    const input = document.querySelector('input')!;
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: withEmailDetector,
+      ...options,
+    });
+    try {
+      drive(input);
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+    return events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Input
+        ? [event.data.text]
+        : [],
+    );
+  }
+
+  it('occludes a typed value at every keystroke length', async () => {
+    // The leak this replaced: scanning per input event recorded every prefix
+    // shorter than the first Luhn-valid length verbatim, so the full card
+    // number was reconstructable even though the final value came out masked.
+    const card = '4111111111111111';
+    const values = await recordInputValues('<input type="text">', (input) => {
+      for (let i = 1; i <= card.length; i++) {
+        input.value = card.slice(0, i);
+        input.dispatchEvent(new Event('input', { bubbles: true }));
+      }
+    });
+    expect(values.length).toBe(card.length);
+    values.forEach((value, i) => expect(value).toBe('*'.repeat(i + 1)));
+  });
+
+  it('occludes a pasted value, matched or not', async () => {
+    const values = await recordInputValues('<input type="text">', (input) => {
+      input.value = 'bob@example.com';
+      input.dispatchEvent(new Event('input', { bubbles: true }));
+      input.value = 'nothing sensitive here';
+      input.dispatchEvent(new Event('input', { bubbles: true }));
+    });
+    expect(values).toEqual([
+      '*'.repeat('bob@example.com'.length),
+      '*'.repeat('nothing sensitive here'.length),
+    ]);
+  });
+
+  it('no unmask escape reveals an input value while detectors are on', async () => {
+    const values = await recordInputValues(
+      '<input class="rr-unmask" type="text">',
+      (input) => {
+        input.value = 'Visible Name';
+        input.dispatchEvent(new Event('input', { bubbles: true }));
+      },
+      { unmaskTextSelector: '.rr-unmask' },
+    );
+    expect(values).toEqual(['*'.repeat('Visible Name'.length)]);
+  });
+});
+
 /**
  * The mutation path used to decide "is this `value` an input value?" purely by
  * tag name, so a component library's `<ion-input type="password">` -- a custom
diff --git a/packages/types/src/index.ts b/packages/types/src/index.ts
index 73a419dc32..a98fdcb3fa 100644
--- a/packages/types/src/index.ts
+++ b/packages/types/src/index.ts
@@ -318,6 +318,7 @@ export type PrivacyPolicy = {
   rules?: PrivacyRule[];
   /** Opt in to recognizing other session-replay tools' privacy classes/attributes; off by default. `true` recognizes every verified vendor; an array recognizes only the named ones. */
   vendorCompat?: boolean | VendorCompatId[];
+  detectors?: PrivacyDetectorOptions;
 };
 
 /** A vendor whose mask/block conventions `vendorCompat` can recognize; see guide.md's "Vendor class recognition" table. */
@@ -363,6 +364,20 @@ export type PrivacyTarget = {
   selector: string;
 };
 
+/** Explicit opt-in flags for built-in heuristic detectors; presets do not enable these. */
+export type PrivacyDetectorOptions = Partial<{
+  email: boolean;
+  phone: boolean;
+  paymentCard: boolean;
+  ssn: boolean;
+  ipAddress: boolean;
+}>;
+
+export type CompiledDetector = {
+  name: string;
+  test: (value: string) => boolean;
+};
+
 /** Runtime form of a compiled policy, shared by snapshot and incremental observers. */
 export type CompiledPrivacyPolicy = {
   preset: PrivacyPreset;
@@ -376,7 +391,7 @@ export type CompiledPrivacyPolicy = {
   ignoreSelector: string | null;
   /** vendorCompat input-ignore tokens: input events from a matching element are suppressed, and nothing else changes — no masking implied, unlike `data-privacy="ignore"`. Matched on the element itself, mirroring the vendors' own input observers. */
   ignoreEventsSelector: string | null;
-  /** true under balanced/strict */
+  /** true under balanced/strict, and whenever any heuristic detector is active. */
   maskAllInputs: boolean;
   /** ['title','placeholder','aria-label'] under balanced/strict, else empty */
   maskedAttributes: Set<string>;
@@ -384,6 +399,8 @@ export type CompiledPrivacyPolicy = {
   attributePolicyInert: boolean;
   /** true under strict; the `strict` preset alias every media gate reads */
   blockMedia: boolean;
+  /** Populated by an opt-in detector plugin; [] otherwise. */
+  detectors: CompiledDetector[];
 };
 
 export type RecordPlugin<TOptions = unknown> = {
@@ -394,6 +411,12 @@ export type RecordPlugin<TOptions = unknown> = {
     options: TOptions,
   ) => listenerHandler;
   eventProcessor?: <TExtend>(event: eventWithTime) => eventWithTime & TExtend;
+  /**
+   * Transform the portable privacy policy before it is compiled. Used by
+   * opt-in detector plugins so heuristic PII matching is not core recorder
+   * behavior.
+   */
+  applyPrivacyPolicy?: (policy: unknown) => unknown;
   getMirror?: (mirrors: {
     nodeMirror: IMirror<Node>;
     crossOriginIframeMirror: ICrossOriginIframeMirror;
diff --git a/tsconfig.json b/tsconfig.json
index ebf327addc..55cd06565d 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -30,6 +30,9 @@
     {
       "path": "packages/plugins/rrweb-plugin-network-replay"
     },
+    {
+      "path": "packages/plugins/rrweb-plugin-privacy-detectors"
+    },
     {
       "path": "packages/rrvideo"
     },