Informed Consent for AI in Market Research: What to Say

Informed consent forms in market research mention recording, not AI. What GDPR, LGPD, ICC/ESOMAR and MRS require, what is good practice, and what to add.

Before a focus group starts, the moderator reads the consent form aloud or sends it to sign. The session will be recorded on audio and video. The recording will be transcribed. The research team and the client will see the material. Names stay out of the report, and the files are deleted after the project. Participants nod, sign, and the discussion begins. That form is the core of informed consent in market research. In many agencies it was written before the recording ever went to a transcription service, or to a language model run by another company.

Key Takeaways

• Article 13 of the GDPR requires the controller to tell participants, when data is collected, who receives it and how long it is kept. A transfer outside the EU must be stated too.
• Brazil's LGPD says consent is void if the information was not presented beforehand, clearly and transparently.
• MRS guidance requires members to tell participants before data collection when AI is used to process their personal data in ways they might not expect.
• The 2025 ICC/ESOMAR Code requires researchers to tell clients when AI is used in analysis and to state the extent of human oversight.
• Whether a voice recording counts as biometric data depends on how it is processed. Vendors read that question more cautiously than the text of the GDPR.

What informed consent covers in a research interview

Informed consent is a participant's agreement to take part, given after clear information about what will be collected and how it will be used. The GDPR defines consent as a freely given, specific, informed and unambiguous indication of the person's wishes. The 2025 ICC/ESOMAR Code uses almost the same words, with consent given in response to clear information about the collection, processing and use of the data.

Two more terms matter here. The controller is the organization that decides why and how personal data is processed, usually the agency running the study. A processor is an organization that handles the data on the controller's behalf. Examples are a transcription service, or the provider of a language model reached through an API. An API is a direct connection between two systems.

The ICC/ESOMAR Code also lists a picture, a sound recording and a video recording as direct identifiers. A recorded group discussion is personal data from the first second.

How the consent form is handled today

PERSONAL EXPERIENCE In the agencies I have worked with, the consent form is one of the oldest documents in the project folder. It was written for audio recorders and typists, reviewed once by a lawyer, and copied into every study since. It says the session is recorded and transcribed. It says who sees the material.

What changed is everything after the recording. The file now goes to an online transcription service. The transcript goes into a language model tool for a first pass of coding, a summary or a highlight list. Sometimes that tool is a company licence. Sometimes it is a personal account, with the risks set out in why a general chatbot is not a research platform. The form still says "transcribed by the research team".

Nobody hid anything. The form was simply never reopened, because nothing in the project plan asks anyone to reopen it.

What the law requires, and what it does not

This section describes what the texts say. It is not legal advice, and the data protection officer of the controller has the last word on any specific study.

Article 13 of the GDPR lists what the controller must give the person at the time when personal data are obtained. The list includes the purposes and the legal basis, and the recipients or categories of recipients. It also covers any transfer outside the EU, how long the data will be stored, and the right to withdraw consent. A transcription service and a model provider are recipients. A model hosted outside the EU means a transfer.

Article 7 adds two conditions when the study relies on consent. A consent request inside a document that covers other matters must be clearly distinguishable from the other matters, in clear and plain language. Withdrawing must be as easy as giving consent. Article 28 says a processor shall not engage another processor without the controller's written authorization. That matters when the transcription service itself calls a model from someone else.

Brazil's LGPD goes in the same direction. Article 9 requires clear information on the specific purpose, the form and duration of processing and any shared use of the data. Its first paragraph says consent is void if the information was not presented beforehand with transparency, clearly and unambiguously.

None of these texts uses the words "artificial intelligence". They do not need to. They ask who receives the data, where it goes, for what, and for how long. A language model in the process changes every one of those answers.

What the professional codes add

The codes are not law. Members agree to follow them, and the ICC/ESOMAR Code encourages a clause in contracts confirming that every party complies.

The MRS guidance on AI, revised in April 2025, is the most direct of the codes. Requirement 26 says practitioners must inform participants, prior to data collection, when AI is used to process personal data and what the consequences are. It applies when the use is one participants might not expect. Requirement 17 bars sharing personal data with AI systems that train on it unless expressly agreed with clients. The same document recommends checking that settings such as "improve the model for everyone" are switched off.

The ICC/ESOMAR Code was revised in 2025 and is recognised by over 60 associations in more than 50 countries. It puts its explicit AI duty on the client side. Article 7(e) says the client must be informed when AI is used in analysis, reporting or interpretation, with the extent of human oversight stated. Toward participants the Code asks for clear and accurate information about the purpose and nature of the research. It also asks for a clear statement of how long and for what purpose data is kept.

What regulators are still working out

Two documents are often quoted as if they were rules. They are not, and the difference matters.

The European Data Protection Board's Opinion 28/2024, adopted in December 2024, answers questions from the Irish supervisory authority about AI models. Its most quoted line is that AI models trained with personal data cannot, in all cases, be considered anonymous. It also gives weight to what people can reasonably expect, given the information they received. That is a strong reason to state in the form whether participant material trains any model.

The UK Information Commissioner's Office published a call for evidence on purpose limitation in generative AI. The ICO itself calls it emerging thinking and says it should not be read as confirming that any processing is compliant. Its position is that training a model and building an application on it are different purposes. Each one has to be explained to the people whose data is used.

Four kinds of rule, four kinds of weight

Four stacked layers, from binding to optional, each naming its source. Layer one, law, binding on the controller: GDPR Article 13 requires recipients, transfers and retention to be stated at the time of collection; Article 7 requires a consent request that is distinguishable from other matters and withdrawal as easy as consent; LGPD Article 9 makes consent void if the information was not given beforehand. Layer two, professional codes, binding on members, with the ICC/ESOMAR Code encouraging a contract clause: MRS guidance requirement 26 says to tell participants before collection when AI processes their data in ways they might not expect; requirement 17 bars training use without client agreement; the ICC/ESOMAR Code Article 7(e) says to tell the client when AI is used, with the human oversight stated. Layer three, regulator opinion and consultation, guidance and not rules: EDPB Opinion 28/2024 says models trained on personal data are not anonymous in all cases; the ICO call for evidence says training a model and building an application are different purposes, and the ICO calls it emerging thinking. Layer four, vendor practice, a useful model and not a requirement: the MAXQDA template uses separate consent lines for automatic transcription and for AI analysis, and its reading of voice as biometric data is more cautious than the GDPR text. A closing band says none of the four uses the same words, and all four point to the same questions: who receives the data, where, for how long, and whether it trains a model. The figure contains no measured numbers.

Quoting a consultation as if it were law, or a vendor template as if it were a code, weakens the form. Each line in it should know which layer it answers to.

Is a voice recording biometric data?

This is where vendor advice and legal text part ways, and the gap is worth knowing.

MAXQDA's guide to consent for automatic transcription says voice recordings are classified as biometric data under Article 4(14) of the GDPR. That would make them special category data, which needs explicit consent. The text of Article 4(14) is narrower. It defines biometric data as data resulting from specific technical processing that allows or confirms the unique identification of a person. Article 9 lists biometric data among special categories when processed for the purpose of uniquely identifying a natural person. Recital 51 adds that photographs count as biometric data only when processed through specific technical means that allow unique identification.

UNIQUE INSIGHT Read together, the text points to the processing, not the file. A recording that is transcribed and coded is personal data. A recording run through voice or face matching to identify who is speaking may become biometric data. The cautious vendor reading costs little to follow in a consent form. It should still be presented as caution, not as what the law says.

What the consent form needs to say about AI

The methodology here is simple: walk the data path, stop by stop, and write one line for each. The checklist below mixes legal requirements and good practice, and each item says which is which. This is the sequence we recommend for the AI section of a consent form.

1. Say what is recorded: audio, video or both, and whether screens or documents are captured.
2. Name who transcribes the recording and who runs any language model on it. Article 13 asks for recipients or categories of recipients.
3. Say in which country the processing happens. A transfer outside the EU is an Article 13 item.
4. Say whether the material is used to train or improve any model. MRS requirement 17 makes this a professional duty, and the EDPB opinion explains why it matters.
5. Say how long recordings and transcripts are kept and when they are deleted, at each provider. Article 13 and the ICC/ESOMAR Code both ask for retention.
6. Say whether a person reviews what the model produces before it reaches the client. This is good practice, and Article 7(e) of the Code asks for it toward the client.
7. Say how to withdraw and what happens to data already processed. Article 7 requires withdrawal to be as easy as consent.

The data path the consent form has to describe

A flow of five stops, each paired on the right with the line the consent form should carry. Stop one, session recorded: audio, video, screens or documents are captured; the form says what is recorded and that a recording identifies the person. Stop two, transcription service: the file leaves the agency for the first time; the form says who transcribes, in which country, and when the audio is deleted there. Stop three, language model: coding, summaries or highlights are produced from the transcript; the form says who runs the model, where, and whether the material trains it. Stop four, analyst review: a person checks what the model produced; the form says that a person reviews outputs before they reach the client. Stop five, report and deletion: findings go to the client and files are kept or deleted; the form says the retention at each provider and how to withdraw at any point. A closing band says that if a stop is missing from the form, the participant agreed to a shorter path than the one the data took. The figure contains no measured numbers.

The form is a map of the path. Every provider the recording passes through is a line someone has to be able to read aloud.

Item 4 is the one most forms miss, and it is the one participants ask about. The answer lives in the provider's contract, not in the form. Someone has to read the contract before the form can say it.

Who answers when the form was silent

The agency is the controller in most studies, so it answers to the regulator. The moderator who read the form aloud answers to the participants in the room. The client answers for its brand being attached to the study.

The person with the least information is the participant, who agreed to a recording and a typist. MRS requirement 22 says participant rights, such as the right to withdraw, must not be weakened as a result of the use of AI. A withdrawal request is hard to honour if nobody knows which provider still holds the transcript.

Where Cassi.ai comes in

@Cassi.ai is a software engineering company specialized in the pains of market research, innovation and insights. It was founded by Cassiano Albuquerque after twenty years in market research. We automate research projects with or without language models.

Deskor is a Cassi.ai product that connects company knowledge, AI agents and workflows, so the team builds proposals, decks, reports and dashboards from what the company already knows.

Part of that work is deciding where the material runs. Our systems can run on private infrastructure: on the client's own servers, in a private cloud, or fully disconnected from the internet. When the model runs where the data already lives, the consent form can name one place and one retention rule. It can also state plainly that nothing trains an outside model. The trade-offs between open models run in-house and closed models reached over the internet are in open weight models in market research.

The form itself stays the agency's decision, signed off by its data protection officer. What engineering can do is make the data path short enough to describe in one honest paragraph. Then what the moderator reads aloud matches what the system does. The same habit of keeping each step traceable runs through qualitative coding without losing the evidence. More in the cassiai.com portfolio.

FAQ

Do research participants need to be told that AI will process their interview?

Under the GDPR, they must be told who receives their data and where it goes, which covers transcription and model providers. MRS guidance also requires telling them before collection when AI is used in ways they might not expect.

Does the ICC/ESOMAR Code require AI disclosure to participants?

Its explicit AI clause, Article 7(e), is toward the client. Toward participants, the Code requires clear information about the purpose and nature of the research and about retention.

Is a voice recording biometric data under the GDPR?

Only when it goes through specific technical processing that allows unique identification, under Article 4(14). Some vendors treat all voice recordings as biometric, which is a cautious reading.

Should the consent form say whether the data trains a model?

Yes. MRS requirement 17 bars training use without client agreement, and the EDPB says models trained on personal data are not always anonymous.

Can an old consent form cover a new AI step?

Under the LGPD, consent is void if the information was not given beforehand and clearly. If the AI step was not in the information participants received, update the form before the next session and have the data protection officer check it.

Before the next session is recorded

UNIQUE INSIGHT A consent form is a description of the data path. The path gained a transcription service and a language model. If the form stayed the same, it describes a study that no longer exists. The participant agreed to that older study.

If your agency uses a language model on interview material, open the current consent form and look for the provider's name. If it is not there, the form needs its AI section before the next session is recorded.

About the author

Cassiano Albuquerque is the founder of @Cassi.ai. He spent twenty years in market research operations before building software for research teams. To talk about the AI section of your consent forms and where your material is processed, contact him on LinkedIn.

Published by Cassi.ai. Read the full article at https://www.cassiai.com/blog/respondent-consent-ai-processing.