Isn't this expected to happen? Especially back then... It might not fly in this day and age I guess.
One javascript import statement and you are recording your users entire session activity
There are whole startups offering this service to other startups