You'd want to be really careful recording/replaying sessions on pages that capture personally identifiable information; then again, you probably wouldn't be running a third-party service like this if you were.
While we'd like that to be true it's sadly not in practice.
The most common example is websites with sensitive data in the URL (ex: PII query parameters) using third party analytics services that receive the entire URL as a metric.