Can an agency use past survey responses to train AI or build synthetic panels?

Why past survey responses carry more strings than other agency records#

Past survey responses carry promises that most agency records do not. Each study came with a screener, a privacy notice and often panel terms, and many were paid for by a client under a contract that says who controls the data and what happens to it after the project.

Open-ended answers add another layer. Respondents write names, employers, towns, medical conditions and complaints into free-text boxes, and those details survive in exports long after the closed-ended data has been coded. A training set built from verbatims inherits both the consent question and the identification question.

Agency process records are different. Proposals, questionnaire drafts with review comments, fieldwork logs and quality-control notes describe how the agency works. They still need a confidentiality review, but they rarely depend on respondent consent.

The four-gate decision tree#

The four-gate decision tree runs each study, or each group of studies fielded under the same terms, through the same questions in order. A study moves forward only when it clears a gate; when it fails, it is excluded from that use and logged with the reason.

Run the gates once per use, not once per study. A study can clear them for training an internal coding model and still fail them for an outside license.

• 1Gate 1, consent scope: did the notice and consent respondents saw cover AI training, model building or product development, or only the named research project?
• 2Gate 2, client contract: does the client own or control the data, restrict reuse, or require return or destruction after delivery?
• 3Gate 3, de-identification: can direct identifiers and identifying free text be removed to a standard that holds up under the laws that may apply?
• 4Gate 4, code and disclosure: does the use fit the professional codes the agency follows, and will outputs be labeled honestly to clients?
• 5Result: studies that clear all four gates form the candidate set; everything else stays out until terms change or new consent is collected.

Gate 1: what respondents actually agreed to#

Respondent consent is judged by the notice each person saw when they answered, which means pulling archived screeners and panel terms by date. Today's privacy policy does not reach back to studies fielded under older wording.

FTC staff have warned that adopting more permissive data practices, such as using consumer data for AI training, and announcing them only through a quiet, retroactive change to terms or a privacy policy may be unfair or deceptive. New consent language can cover future studies; it does not repair past ones.

Gate 2: what the client contract allows#

The client contract decides whether a client-funded study can be reused at all. Look for clauses on ownership of data and deliverables, confidentiality, use restrictions, return or destruction at project end, and any carve-out letting the agency keep aggregated data for norms or benchmarks.

A norms carve-out is not automatically an AI-training right. Language allowing aggregated, anonymized results in benchmark databases was usually written with averages and indices in mind, not respondent-level records feeding a model. Where a clause is ambiguous, written client permission removes the doubt.

Some newer master service agreements also add AI-use clauses that bar the agency from putting client data into AI tools or training sets. Those clauses can reach studies already delivered, so check amendments as well as the original agreement.

Gate 3: is de-identified data enough?#

De-identified data clears the third gate only when the method holds up under the laws that may apply. California's privacy law, for example, treats information as deidentified only if the business takes reasonable measures against reidentification, publicly commits not to reidentify it, and contractually obliges recipients to the same terms.

For respondents in Europe, GDPR treats pseudonymized data that could be re-linked to a person with additional information as personal data. Replacing respondent IDs with new codes while keeping a lookup table does not take a study out of scope.

Synthetic panels raise a related problem. A model trained closely on a small study can reproduce rare combinations of answers, so the training data still needs de-identification and the outputs need testing for memorized records.

Three uses, three levels of risk#

Training an internal model, launching a synthetic panel product and licensing data to an outside AI developer are three different uses, and the gates apply more strictly as data moves further from the original research context.

Developers carry their own documentation duties. California's training-data transparency law requires developers of generative AI systems to publish documentation stating, among other things, whether training datasets were purchased or licensed and whether they include personal information, so expect a licensee to ask for exactly that record.

Illustrative: a consumer insights agency sorts its archive#

Illustrative: a fictional consumer insights agency with about 180 employees holds years of concept tests and usage-and-attitude studies. It wants to launch a synthetic panel for early concept screening and is also approached about licensing its archive.

The team groups studies by consent wording and sample source. Studies fielded on its own panel after it added model-building language to its notice pass Gate 1. Studies built on client customer lists fail Gate 2 unless the client signs off, and two clients do. Open-ends go through redaction, and the synthetic model is tested for reproduced verbatims before launch.

The outside license is narrowed to the agency's process records: questionnaire templates, review comments and fieldwork quality logs. Respondent-level data stays inside the agency.

How SourceX handles survey archives#

SourceX runs survey archives through the Rights and Preparation steps of the SourceX five-step transaction before anything is offered to a buyer. The gate results become part of the SourceX Evidence Packet, so the permitted use and privacy record for each included study are written down, and the agency approves every step from scoping to delivery.