Session replay works by continuously capturing DOM mutations, mouse movement, scrolling, and input events, then reconstructing the session for later viewing.
It is genuinely useful for diagnosing behaviour nobody can describe. It also means a script on your page is recording everything a visitor does, which brings consent obligations, masking requirements for sensitive fields, meaningful payload weight, and a large new category of data you are now responsible for.
The alternative is to collect only what someone deliberately writes down. You lose the ability to watch what happened; you gain a tool that needs no consent banner and creates no recording to secure.
Why it matters
Session replay is often adopted for the feedback button that came bundled with it. Those are separable decisions, and they carry very different privacy costs.