diff --git a/app/src/types/generated/firewall_pb.d.ts b/app/src/types/generated/firewall_pb.d.ts
index 2d15559b..f2739fb0 100644
--- a/app/src/types/generated/firewall_pb.d.ts
+++ b/app/src/types/generated/firewall_pb.d.ts
@@ -15,6 +15,11 @@ export class PrivacyMapConversionRequest extends jspb.Message {
   getInput(): string;
   setInput(value: string): void;
 
+  getGroupId(): Uint8Array | string;
+  getGroupId_asU8(): Uint8Array;
+  getGroupId_asB64(): string;
+  setGroupId(value: Uint8Array | string): void;
+
   serializeBinary(): Uint8Array;
   toObject(includeInstance?: boolean): PrivacyMapConversionRequest.AsObject;
   static toObject(includeInstance: boolean, msg: PrivacyMapConversionRequest): PrivacyMapConversionRequest.AsObject;
@@ -30,6 +35,7 @@ export namespace PrivacyMapConversionRequest {
     realToPseudo: boolean,
     sessionId: Uint8Array | string,
     input: string,
+    groupId: Uint8Array | string,
   }
 }
 
@@ -89,6 +95,11 @@ export class ListActionsRequest extends jspb.Message {
   getEndTimestamp(): string;
   setEndTimestamp(value: string): void;
 
+  getGroupId(): Uint8Array | string;
+  getGroupId_asU8(): Uint8Array;
+  getGroupId_asB64(): string;
+  setGroupId(value: Uint8Array | string): void;
+
   serializeBinary(): Uint8Array;
   toObject(includeInstance?: boolean): ListActionsRequest.AsObject;
   static toObject(includeInstance: boolean, msg: ListActionsRequest): ListActionsRequest.AsObject;
@@ -112,6 +123,7 @@ export namespace ListActionsRequest {
     sessionId: Uint8Array | string,
     startTimestamp: string,
     endTimestamp: string,
+    groupId: Uint8Array | string,
   }
 }
 
diff --git a/app/src/types/generated/firewall_pb.js b/app/src/types/generated/firewall_pb.js
index 76fdae11..e8cdc0ed 100644
--- a/app/src/types/generated/firewall_pb.js
+++ b/app/src/types/generated/firewall_pb.js
@@ -69,7 +69,8 @@ proto.litrpc.PrivacyMapConversionRequest.toObject = function(includeInstance, ms
   var f, obj = {
     realToPseudo: jspb.Message.getFieldWithDefault(msg, 1, false),
     sessionId: msg.getSessionId_asB64(),
-    input: jspb.Message.getFieldWithDefault(msg, 3, "")
+    input: jspb.Message.getFieldWithDefault(msg, 3, ""),
+    groupId: msg.getGroupId_asB64()
   };
 
   if (includeInstance) {
@@ -118,6 +119,10 @@ proto.litrpc.PrivacyMapConversionRequest.deserializeBinaryFromReader = function(
       var value = /** @type {string} */ (reader.readString());
       msg.setInput(value);
       break;
+    case 4:
+      var value = /** @type {!Uint8Array} */ (reader.readBytes());
+      msg.setGroupId(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -168,6 +173,13 @@ proto.litrpc.PrivacyMapConversionRequest.serializeBinaryToWriter = function(mess
       f
     );
   }
+  f = message.getGroupId_asU8();
+  if (f.length > 0) {
+    writer.writeBytes(
+      4,
+      f
+    );
+  }
 };
 
 
@@ -242,6 +254,45 @@ proto.litrpc.PrivacyMapConversionRequest.prototype.setInput = function(value) {
 };
 
 
+/**
+ * optional bytes group_id = 4;
+ * @return {!(string|Uint8Array)}
+ */
+proto.litrpc.PrivacyMapConversionRequest.prototype.getGroupId = function() {
+  return /** @type {!(string|Uint8Array)} */ (jspb.Message.getFieldWithDefault(this, 4, ""));
+};
+
+
+/**
+ * optional bytes group_id = 4;
+ * This is a type-conversion wrapper around `getGroupId()`
+ * @return {string}
+ */
+proto.litrpc.PrivacyMapConversionRequest.prototype.getGroupId_asB64 = function() {
+  return /** @type {string} */ (jspb.Message.bytesAsB64(
+      this.getGroupId()));
+};
+
+
+/**
+ * optional bytes group_id = 4;
+ * Note that Uint8Array is not supported on all browsers.
+ * @see http://caniuse.com/Uint8Array
+ * This is a type-conversion wrapper around `getGroupId()`
+ * @return {!Uint8Array}
+ */
+proto.litrpc.PrivacyMapConversionRequest.prototype.getGroupId_asU8 = function() {
+  return /** @type {!Uint8Array} */ (jspb.Message.bytesAsU8(
+      this.getGroupId()));
+};
+
+
+/** @param {!(string|Uint8Array)} value */
+proto.litrpc.PrivacyMapConversionRequest.prototype.setGroupId = function(value) {
+  jspb.Message.setProto3BytesField(this, 4, value);
+};
+
+
 
 /**
  * Generated by JsPbCodeGenerator.
@@ -441,7 +492,8 @@ proto.litrpc.ListActionsRequest.toObject = function(includeInstance, msg) {
     countTotal: jspb.Message.getFieldWithDefault(msg, 8, false),
     sessionId: msg.getSessionId_asB64(),
     startTimestamp: jspb.Message.getFieldWithDefault(msg, 10, "0"),
-    endTimestamp: jspb.Message.getFieldWithDefault(msg, 11, "0")
+    endTimestamp: jspb.Message.getFieldWithDefault(msg, 11, "0"),
+    groupId: msg.getGroupId_asB64()
   };
 
   if (includeInstance) {
@@ -522,6 +574,10 @@ proto.litrpc.ListActionsRequest.deserializeBinaryFromReader = function(msg, read
       var value = /** @type {string} */ (reader.readUint64String());
       msg.setEndTimestamp(value);
       break;
+    case 12:
+      var value = /** @type {!Uint8Array} */ (reader.readBytes());
+      msg.setGroupId(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -628,6 +684,13 @@ proto.litrpc.ListActionsRequest.serializeBinaryToWriter = function(message, writ
       f
     );
   }
+  f = message.getGroupId_asU8();
+  if (f.length > 0) {
+    writer.writeBytes(
+      12,
+      f
+    );
+  }
 };
 
 
@@ -824,6 +887,45 @@ proto.litrpc.ListActionsRequest.prototype.setEndTimestamp = function(value) {
 };
 
 
+/**
+ * optional bytes group_id = 12;
+ * @return {!(string|Uint8Array)}
+ */
+proto.litrpc.ListActionsRequest.prototype.getGroupId = function() {
+  return /** @type {!(string|Uint8Array)} */ (jspb.Message.getFieldWithDefault(this, 12, ""));
+};
+
+
+/**
+ * optional bytes group_id = 12;
+ * This is a type-conversion wrapper around `getGroupId()`
+ * @return {string}
+ */
+proto.litrpc.ListActionsRequest.prototype.getGroupId_asB64 = function() {
+  return /** @type {string} */ (jspb.Message.bytesAsB64(
+      this.getGroupId()));
+};
+
+
+/**
+ * optional bytes group_id = 12;
+ * Note that Uint8Array is not supported on all browsers.
+ * @see http://caniuse.com/Uint8Array
+ * This is a type-conversion wrapper around `getGroupId()`
+ * @return {!Uint8Array}
+ */
+proto.litrpc.ListActionsRequest.prototype.getGroupId_asU8 = function() {
+  return /** @type {!Uint8Array} */ (jspb.Message.bytesAsU8(
+      this.getGroupId()));
+};
+
+
+/** @param {!(string|Uint8Array)} value */
+proto.litrpc.ListActionsRequest.prototype.setGroupId = function(value) {
+  jspb.Message.setProto3BytesField(this, 12, value);
+};
+
+
 
 /**
  * Generated by JsPbCodeGenerator.
diff --git a/app/src/util/tests/sampleData.ts b/app/src/util/tests/sampleData.ts
index e178a9d5..bc043b26 100644
--- a/app/src/util/tests/sampleData.ts
+++ b/app/src/util/tests/sampleData.ts
@@ -906,6 +906,7 @@ export const litListSessions: LIT.ListSessionsResponse.AsObject = {
       sessionType: LIT.SessionType.TYPE_UI_PASSWORD,
       createdAt: '253300000000',
       accountId: '',
+      groupId: '',
       revokedAt: '453300000000',
       autopilotFeatureInfoMap: [
         [
@@ -986,6 +987,7 @@ export const litListSessions: LIT.ListSessionsResponse.AsObject = {
       sessionType: LIT.SessionType.TYPE_UI_PASSWORD,
       createdAt: '253300000000',
       revokedAt: '453300000000',
+      groupId: '',
       accountId: '',
       autopilotFeatureInfoMap: [
         [
diff --git a/proto/firewall.proto b/proto/firewall.proto
index af2df19d..9f429b78 100644
--- a/proto/firewall.proto
+++ b/proto/firewall.proto
@@ -36,14 +36,20 @@ message PrivacyMapConversionRequest {
     bool real_to_pseudo = 1;
 
     /*
+    Deprecated, use group_id.
     The session ID under which to search for the real-pseudo pair.
     */
-    bytes session_id = 2;
+    bytes session_id = 2 [deprecated = true];
 
     /*
     The input to be converted into the real or pseudo value.
     */
     string input = 3;
+
+    /*
+    The group ID under which to search for the real-pseudo pair.
+    */
+    bytes group_id = 4;
 }
 
 message PrivacyMapConversionResponse {
@@ -120,6 +126,11 @@ message ListActionsRequest {
     considered.
     */
     uint64 end_timestamp = 11 [jstype = JS_STRING];
+
+    /*
+    If specified, then only actions under the given group will be queried.
+    */
+    bytes group_id = 12;
 }
 
 message ListActionsResponse {