Privacy Filter

A privacy filter is a verification step that removes personal information from a text before anyone else gets to see it. This includes things like names, home addresses, phone numbers, account details, or medical diagnoses. The filter searches for such spots and deletes them, replaces them with placeholders, or obscures them. “My name is Lena Hoffmann, I live at Ahornstraße 12” then becomes something like “My name is [NAME], I live at [ADDRESS]”. The rest of the sentence remains intact so the content stays understandable. You can think of it like a black marker pen used by an authority to redact individual lines in a document before releasing it.

What happens when nobody filters

Large language models learn from massive amounts of text sourced from the internet, books, and user conversations. If real personal data is embedded in these texts, the model can learn it as well. Researchers have repeatedly shown that such data can later be coaxed back out: in one well-known experiment, older models responded to certain prompts by outputting real email addresses and phone numbers from their training data. The model didn’t hack anything in the process. It simply repeated what it had seen.

On top of that comes legal pressure. In the EU, the General Data Protection Regulation, or GDPR for short, governs how companies may handle personal data. Violations can cost fines in the millions. Anyone operating a chatbot must therefore be able to prove that they are not indiscriminately storing customer data. A privacy filter is one of the few measures that can be technically demonstrated and logged in this regard.

For companies, there is a second reason, and it is often the decisive one. Employees regularly type things into chatbots that are actually confidential: draft contracts, salary lists, unpublished figures. Several corporations have therefore temporarily banned AI tools entirely. A filter is the milder solution, because it keeps the tool usable while still catching the sensitive parts.

Pattern recognition, models, and the boundary between them

The simplest design works with fixed search patterns. An IBAN always has the same structure, a German postal code consists of five digits, an email address contains an @ sign. Such patterns can be formulated as rules and reliably detected. This method is fast, costs almost nothing, and makes hardly any mistakes with clearly formed data.

With names and places, this isn’t enough. “Baker” can be an occupation or a surname, “Essen” can be a city or a meal. This is where a second, small AI model comes into play, one that evaluates the sentence context. It has been trained to flag people, organizations, and places in texts. Experts call this task Named Entity Recognition. Modern filters combine both approaches: rules for the unambiguous, a model for the ambiguous.

There is an important distinction between two modes of operation. With redaction, the information disappears permanently. With pseudonymization, the system remembers, in a separate, protected table, which placeholder belongs to which real value. This allows a support system to reattach the correct name to the answer at the end. This is more practical, but also riskier, because this mapping table is itself a valuable target for attackers.

From corporate chatbot to street-view camera

Privacy filters are most commonly encountered in enterprise versions of well-known AI services. There, the filter sits between the input field and the actual model. Hospitals use it to make doctors' letters usable for research without revealing patient names. Banks deploy it in front of log files so that developers troubleshooting issues don’t get to see real account data.

Nearly everyone regularly encounters the most well-known case: in mapping services like Google Street View, faces and license plates are automatically blurred. This is the same idea, just applied to images. Video conferencing tools that automatically generate transcripts also filter names out of the summary on request.

A common misconception is that a privacy filter makes a system compliant with data protection law. It does not. No filter catches everything, and individuals can sometimes be reconstructed from seemingly harmless remnants: place of residence, birth year, and occupation are often enough in small communities. The term should also not be confused with the privacy screen protector for laptop displays, which is also called a “privacy filter” in stores. In the AI context, it always refers to the software, not the screen protector.