A company is entitled to use session recording or session replaying as long as their marketing and analytics needs require so. However, as enticing the recording of everything the user does at all times can be, even within the existing regulations, there is a high chance that doing so will quickly push the data towards a non-compliant realm. And even in cases where regulations may not be explicit on the matter, we see more and more how the industry is leaning towards discouraging these practices.