Yes, users have to give their consent. Similar to other web analytics tools, session replay requires disclosure to users. This can be done by adding lines to your privacy policy, or prompting users to agree with a pop-up notification. If you use other analytic tools such as Google Analytics, you may already have a disclosure.