Redact PII from Langfuse traces with a masking function and control trace sampling before data leaves the application

Documented steps

1. Python (recommended in v4): pass `mask_otel_spans=` to the `Langfuse()` constructor with signature `def mask_otel_spans(*, params: MaskOtelSpansParams) -> Optional[MaskOtelSpansResult]`. Iterate `params.spans.items()`, inspect `span.attributes`, build a `replacements` dict of masked values, and return `MaskOtelSpansResult(span_patches={identifier: OtelSpanPatch(set_attributes=replacements)})`.
2. Example redaction pattern in Python: `credit_card_pattern = re.compile(r"\b(?:\d[ -]*?){13,19}\b")`, then substitute matches with `"[REDACTED CREDIT CARD]"` inside `mask_otel_spans`.
3. Python legacy signature (still supported, narrower coverage): the `mask=` parameter taking `def masking_function(*, data: Any, **kwargs: Any) -> Any` and returning the masked value.
4. JS/TS: configure `mask` on the `LangfuseSpanProcessor` constructor: `new LangfuseSpanProcessor({ mask: ({ data }) => data.replace(/\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b/g, "***MASKED***") })`. This also applies to spans flowing through LangChain JS/TS, since they route through the same processor.
5. Know the coverage boundary. `mask_otel_spans` covers raw OpenTelemetry span attributes from both Langfuse SDK spans and third-party instrumentations exported by that client. Legacy `mask` covers only data passed through Langfuse SDK APIs (`start_observation()`, `update()`, `set_trace_io()`) and does not inspect raw third-party span attributes.
6. To reduce ingestion volume and cost, set `LANGFUSE_SAMPLE_RATE` as an env var or pass `sample_rate=0.5` to `Langfuse(...)` in Python. Default is 1 (100% of traces collected); valid range is 0 to 1.
7. JS/TS sampling is configured at the OpenTelemetry NodeSDK level alongside the span processor: `import { TraceIdRatioBasedSampler } from "@opentelemetry/sdk-trace-base"; new NodeSDK({ sampler: new TraceIdRatioBasedSampler(0.2), spanProcessors: [new LangfuseSpanProcessor()] });`.
8. Understand that sampling decides at the trace (root) level: if a trace is sampled in, all of its observations and scores are sent; if not, no data for that trace is transmitted at all.
9. Verified against current official docs on 2026-07-29: https://langfuse.com/docs/observability/features/masking , https://langfuse.com/docs/observability/features/sampling