Reminds me of this research from Princeton, on the exfiltration of personal data via equivalent session-replay services for web:

https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfil...