User research interviews and recordings: can they be licensed?

Can user research recordings be licensed?#

User research recordings can be licensed only when participant consent covers that use, and in most software companies it does not. Typical consent forms say sessions will be recorded and used to improve the company's products, which describes internal use, not licensing recordings to an AI developer.

That does not put the whole research program off-limits. Researcher-written notes, synthesized insight reports and tagged findings carry far less personal data than recordings, and some may be considered once counsel confirms what the consent, the research platform terms and any customer agreements allow.

The type of research matters too. Moderated interviews with named customers are the most sensitive, while unmoderated usability tests on a prototype, where participants mostly click and think aloud, still capture voice and screen but less personal history.

What the consent form decides#

The consent form decides who may use a session, for what purpose, for how long and whether anyone outside the company may see it. Read every version actually used over the years, because forms often change between research leads, agencies and tools.

Re-consent is possible in principle but often impractical: past participants are hard to reach, and the request can damage trust. Where it is attempted, it should be specific, optional and documented participant by participant.

Recordings, transcripts and notes carry different risk#

Recordings, transcripts and notes carry different levels of risk because they hold different amounts of identifying detail. The closer an artifact is to the raw session, the harder it is to license and the more preparation it would need.

Rights that sit on top of consent#

Rights beyond consent come from the tools and partners involved in the research. Research repository and testing platforms such as Dovetail have their own terms on data use and export, recruiting panels often restrict how sessions with their members may be used, and agencies may own or control recordings under their contracts.

In B2B research, participants often describe their employer's processes and systems, so the customer agreement and any NDA with that customer also apply. GDPR, CCPA and other privacy laws may apply depending on where participants live, and some state laws on recording consent or biometric data may be relevant to voice and video; counsel assesses these deal by deal.

Check what each platform's export actually includes. Exports differ, and if the original media, tags or consent records are not part of it, proving which consent form applied to which session becomes harder after the subscription ends.

Sessions run over video calls add another layer. Zoom lets admins and users set cloud recordings to delete after a specified number of days, so older interviews may already be gone, which settles their status. Zoom's cancellation guidance also advises downloading cloud recordings before a cancellation takes effect. Check both settings before assuming a recording still exists or can be retained.

If anything is used: a notes-only approach#

A notes-only approach licenses nothing recorded and treats researcher-written material as the only candidate. It keeps the most useful part of research, the reasoning about where users struggled and what the team decided, while leaving faces and voices out entirely.

Automated detection helps but is not enough on its own. Presidio, an open-source SDK for PII identification and anonymization, states in its own documentation that there is no guarantee it will find all sensitive information and that additional systems and protections should be employed.

• 1Map each session to its consent form version, and drop sessions without a form.
• 2Exclude recordings, transcripts, clips, screeners and participant lists.
• 3Remove names, employers, job titles and quotes that could identify a participant.
• 4Run automated detection, then have a person review every document.
• 5Link findings to product decisions, such as Jira issues or decision records, where that adds context.
• 6Record the consent basis and every exclusion in the package's privacy record.

Illustrative: a restaurant software company reviews its research repository#

Illustrative: a fictional restaurant inventory software company has years of recorded interviews and usability sessions with kitchen managers, stored in a research repository with tags and highlight reels. Leadership asks whether any of it could join a planned license of product and engineering records.

The general counsel finds three consent form versions, all limited to internal product improvement, and a recruiting panel whose terms bar third-party use. Recordings, transcripts, clips and every panel session are excluded.

What remains are synthesized research reports the team wrote about how kitchen managers handle stock counts and supplier substitutions. Counsel agrees those reports may be considered after restaurant names and identifying quotes are removed, and they are linked to the product decision records they shaped.

How SourceX treats research data#

SourceX treats research data as carrying a high privacy burden by default. In the SourceX Enterprise Data Value Framework, privacy burden and preparation cost reduce net value, so recordings rarely make sense to include even when drivers such as domain expertise and human-generated signal are strong.

In the SourceX five-step transaction, the Rights step reviews consent form versions, platform and panel terms, and customer agreements before Preparation begins. The privacy record in the SourceX Evidence Packet documents the consent basis for anything included and the reason for each exclusion.

Where research material does qualify, it is usually a small supporting part of a larger package built around engineering, support or product records, adding context about why particular product decisions were made.