So, again, the use cases here are varied. For the most common, which is understanding user behavior, you'll do something like:

- I'm going to capture 5% of users sessions as they progress through a purchase funnel

- I capture data for a few days after a design change, and look at behavioral changes, such as spending more time in a particular step of the funnel

- Where there's something weird going on, I'll watch an aggregate view of people's mouse behaviors - I can then see that a lot of people are hovering between two different buttons, or highlighting a particular sentence

- Based on that feedback, I'll do an A/B test of changing the button textx or the dialogue message

- Capture more data, did that change?

It's not "Let's go look at john smith's website behavior" except in the support example, where you get a user's consent to do that, and you usually only do it for internal corporate applications where there's a dedicated helpdesk.

Usually if someone complains to support, their session can be tracked down and sent to the devs.

o.O that goes massively against data protection laws.

Data protection laws? Provide some examples.

Google does this on all of their products. And people that have left Google have made their own versions of this software for others to use. For example: https://www.fullstory.com/

There are definitely SaaS tools that let you watch a user's session on your site. They stitch together page transitions, show you the mouse cursor moving around, what they type. It's like watching a remote desktop session. Creepy as hell.