Consulting and recruiting
Do state privacy laws apply to market research respondents?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
State privacy laws often apply to market research respondents, and four tests decide coverage: whether a state law's applicability thresholds are met, whether respondents count as consumers or act in a work capacity, whether the agency acts for a client or for itself, and whether the data is truly deidentified. California covers B2B respondents; Virginia and Colorado generally do not.
Key takeaways
- Agencies can cross state thresholds through respondent and panel counts or revenue, not only through headcount.
- California has covered employee and B2B contact data since its exemptions expired on January 1, 2023; Virginia and Colorado generally exclude people acting in a commercial or employment context.
- An agency processing a client's sample usually acts as a service provider or processor; running its own panel usually makes it a business or controller.
- Public-interest research exemptions rarely fit commercial market research.
- Licensing respondent-level data for AI can count as a sale, while California's deidentified standard requires public commitments and recipient contract terms.
The short answer: four tests decide coverage#
State privacy laws apply to market research respondents when four tests line up: the agency or its client meets a state law's applicability thresholds, the respondents count as consumers under that law, the agency's role is defined, and the data remains personal rather than deidentified. Each test can change the answer for the same study.
The number of laws keeps growing. By MultiState's count, comprehensive consumer privacy laws were in effect in 20 states once Indiana, Kentucky and Rhode Island took effect on January 1, 2026, a total that includes Florida's narrower law. Definitions differ enough that one national study can fall under several regimes at once.
Which thresholds bring an agency into scope?#
Applicability thresholds bring an agency into scope through revenue, the number of people whose data it handles, or revenue from selling data. Secondary guides report that California's revenue threshold was adjusted to $26,625,000 from January 2025, alongside alternatives of buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning 50% or more of annual revenue from selling or sharing personal information.
Most other state laws use thresholds based on the number of residents whose data a business controls or processes, often with a lower bar for businesses that earn revenue from selling data. A mid-size agency with a large consumer panel can cross a count threshold even where revenue alone would not, so count panel members and study respondents by state of residence.
Are B2B respondents covered?#
B2B respondents, such as IT buyers, purchasing managers or executives answering in their work role, are covered in some states and excluded in others. The difference matters for agencies that run professional panels or recruit decision-makers through business networks and lists.
A December 2022 law firm alert noted that the other comprehensive state laws then enacted, in Colorado, Connecticut, Utah and Virginia, did not apply to employment-context data, which made California the first state to regulate it comprehensively. More states have legislated since, so read each new statute rather than generalizing.
| State | B2B and employee-context respondents | What to check |
|---|---|---|
| California | Covered since the employee and B2B exemptions expired on January 1, 2023 | Consumer rights apply to professional respondents of covered businesses |
| Virginia | Generally excluded: the law does not apply to people acting in a commercial or employment context | Current consumer definition and any amendments since enactment |
| Colorado | Excluded: the Attorney General says the law does not cover people acting in a commercial or employment context | Current statute text and rules |
| Other states with comprehensive laws | Varies with each law's definition of consumer | Read the consumer definition before assuming a B2B exclusion |
Service provider or business: what the agency's role changes#
The agency's role changes which duties it carries. When an agency fields a study for a client using the client's customer list, it usually acts as a service provider or processor: it handles data on the client's instructions, under a contract that limits its own use. When it recruits and runs its own panel, it usually acts as a business or controller with direct duties to respondents.
The last row of the table matters most for AI. A service provider that uses client-sourced personal data for its own product development may step outside that role, so reuse plans need checking against both the client contract and the statute.
| Scenario | Likely role | Practical consequence |
|---|---|---|
| Survey of a client's customers from the client's list | Service provider or processor | Use the data only for the client's project; the client answers most respondent requests |
| Study fielded on the agency's own panel | Business or controller | The agency gives notice, honors rights requests and sets retention |
| Sample bought from a third-party panel | Often shared or layered roles | Contracts should say who handles notices and requests |
| Reusing client study data for the agency's own AI tools | May fall outside the service provider role | Needs client permission and a fresh legal review |
Do research exemptions cover market research?#
Research exemptions in state privacy laws rarely cover commercial market research. Where they exist, they generally address public or peer-reviewed scientific, historical or statistical research in the public interest, often with ethics oversight, which is a different activity from a brand tracker or a pricing study.
Deidentified data is the more realistic route for agencies. California's standard has three parts: reasonable measures so the data cannot be associated with a consumer or household, a public commitment to keep it deidentified and not attempt reidentification, and contract terms obliging every recipient to comply. Swapping respondent IDs while keeping a lookup key does not meet that bar.
Which respondent rights does an agency need to handle?#
Respondent rights under state laws generally include access, deletion, correction and opting out of sale, sharing or targeted advertising, plus consent or opt-out rules for sensitive data. An agency acting as a business needs a working process for each right, tied to its panel platform and every place respondent data is stored.
- Map where respondent data lives: survey platform, panel database, analysis files, verbatim exports and backups.
- Set retention by study and delete raw personal data when the purpose ends.
- Flag sensitive categories collected in screeners, such as health, ethnicity or precise location, and confirm the consent basis for each.
- Review incentive programs with counsel, since some states have rules on financial incentives tied to personal data.
- Write role terms into client and vendor contracts so each party knows who answers which requests.
What changes when respondent data is licensed for AI#
Licensing respondent data for AI changes the analysis, because disclosing personal information to another company for value can count as a sale under several state laws. That brings opt-out rights, notice duties and, for sensitive data, consent questions into play, on top of whatever respondents were told at the time they answered.
For most agencies, the practical path is to keep respondent-level personal data out of any license and focus on deidentified data that meets the applicable standard, or on the agency's own process records. Which laws may apply is assessed deal by deal with counsel.
Illustrative: a fictional agency with about 200 employees runs a B2B technology panel and a consumer panel. Counsel finds that California members are covered in both panels, while Virginia and Colorado members of the B2B panel are largely excluded. The agency extends one rights process to all panels rather than running two, and keeps panel data out of an AI licensing discussion, offering only questionnaire libraries and fieldwork quality logs.
How SourceX handles respondent data#
SourceX deals with respondent data before anything leaves the agency: Rights and Preparation come second and third in the SourceX five-step transaction, after a fit check that uses descriptions of systems and studies rather than respondent files. The privacy record in the SourceX Evidence Packet documents which laws were considered, how data was deidentified and what recipients must commit to, and the agency approves every step.
Frequently asked questions
Does the CCPA apply to an agency with fewer than 500 employees?
It can. California's thresholds are based on revenue, the number of consumers or households whose data is handled, and revenue from selling or sharing data, not on headcount. A mid-size agency with a large panel or substantial revenue can be covered even with a modest staff.
If the client is covered, is the agency automatically covered too?
Not automatically, but the agency usually carries duties through the contract. A service provider must use the data only for the client's purposes and support the client's compliance. If the agency also runs its own panel, it may be covered in its own right for that activity.
Do state laws cover respondents outside the US?
State laws protect residents of those states. Respondents in other countries fall under their own laws, such as GDPR in Europe, which apply on their own terms. Multinational studies usually need a privacy review for each market in the sample plan.
Are paid incentives a problem under state privacy laws?
They can raise questions. Some laws regulate financial incentives or price differences tied to personal data, and incentive programs collect payment details. Have counsel review incentive terms and notices, especially for panels where members earn points over time.
Do we need a new privacy notice before using respondent data with AI tools?
If the use goes beyond what the current notice describes, update the notice before collecting new data and treat older data under the notice that applied when it was collected. FTC staff have warned that quietly expanding data uses through retroactive changes to terms or privacy policies may be unfair or deceptive.
Sources
- Comprehensive consumer privacy laws in Indiana, Kentucky and Rhode Island took effect on January 1, 2026, bringing the number of states with such laws in effect to 20 by MultiState's count, which includes Florida's narrower law. Source
- Secondary guides report the CCPA's annual gross revenue threshold was adjusted to $26,625,000 effective January 2025, alongside thresholds of buying, selling or sharing personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information. Source
- The CCPA employee and business-to-business personal information exemptions expired on January 1, 2023. Source
- The Virginia Consumer Data Protection Act generally does not apply to information about a natural person acting in a commercial (B2B) or employment context. Source
- The Colorado Attorney General states that the Colorado Privacy Act does not cover personal data of individuals acting in a commercial or employment context. Source
- A December 2022 Kutak Rock alert notes that the comprehensive state privacy laws then enacted in Colorado, Connecticut, Utah and Virginia do not apply to employment-context data. Source
- Under Cal. Civ. Code 1798.140(m), deidentified information requires reasonable measures against reidentification, a public commitment not to reidentify, and contractual obligations on recipients. Source
- FTC staff warned on February 13, 2024 that adopting more permissive data practices through a surreptitious, retroactive change to terms or a privacy policy may be unfair or deceptive. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.