I didn't work on the integration directly at the time so it's certainly possible some of my details are incorrect. That said, from what I remember of the demos that were given there was the ability to set regions of pages which contained PII that were not collected but this was entirely up to us to configure. Otherwise, it was possible to watch an individual user's full session on the website.

This was years ago too so maybe it has changed since, but my issue is with the whole premise of products like Fullstory that make it possible to essentially watch your user's over their shoulder without being given proper notification that level of monitoring is occurring.