Blog / Research

AI Notetaker Consent & Privacy in User Research

By Vadim Glazkov August 30, 2026 10 min read

A practical 2026 playbook for AI notetaker consent and privacy in user research: what to disclose, how to capture valid consent, retention rules and vendor

On this page

Before a user interview you used to ask one thing: “Is everyone happy for me to record this?” AI notetakers have outgrown that question. They join calls on their own, transcribe every word, and some build a biometric voiceprint that identifies a speaker in later meetings — a bigger ask than a stored video file.

Research sessions hold more sensitive material than a sales call, too: participant personal data, unreleased roadmap, candid off-the-record comments. The Otter.ai class action, where the court let the claims proceed into discovery in August 2026, is a concrete signal that consent shortcuts now carry legal risk.

Treat this as a research-operations compliance problem, not a tooling preference. What follows is a practical playbook for AI notetaker consent and privacy for user research teams: the three consent layers, what to disclose, how to capture consent that holds, retention and withdrawal, and vendor checks. It applies whether your sessions are human-moderated or use AI-moderated interviews.

Three separate regimes govern one AI-notetaker recording. Clear all three before anyone presses record.

Layer 1 — recording law. Jurisdictions split into one-party consent, where one person on the call can authorise recording, and all-party consent (sometimes called two-party), where everyone must agree. Around a dozen US states require all-party consent, among them California, Florida, Illinois, Washington and Pennsylvania. When participants sit across several states, hold the whole study to the strictest rule in the set.

Layer 2 — data protection. UK GDPR and EU GDPR require a lawful basis, plain transparency, and support for data-subject rights such as access and erasure. India’s Digital Personal Data Protection Act and California’s CCPA add their own transparency and deletion duties. A recording with an AI transcript is personal data; a voiceprint is biometric data and sits behind a higher bar.

Layer 3 — research ethics. An institutional review board (IRB) or ethics committee, and professional-body codes, often set a higher standard than local law allows. Permissive recording law does not release you from an ethical commitment to informed, revocable consent.

Satisfying one layer tells you nothing about the other two. Where the interview covers sensitive topics — health, finances, children — or processes personal data at scale, expect to complete a Data Protection Impact Assessment (DPIA) before fieldwork begins.

What to disclose: writing a transparent AI-notetaker notice

Consent is valid only when it is informed, specific and freely given. That means naming the AI tool, not just the fact of recording.

A transparent notice covers:

  • What is captured: audio, video, on-screen content and screenshots, and whether the tool builds a voiceprint.
  • Who processes it: name the third-party vendor, and say whether transcription is automated, human, or both.
  • Who can access it: your research team, co-investigators, wider stakeholders, or clients.
  • Where it is stored and for how long: the region, and the retention period for recordings, transcripts and AI summaries.
  • Whether content trains AI models: state it plainly. This is the disclosure teams skip most often, and the one participants care about once they hear it.

Separate the recording that is essential to taking part from anything optional. If someone can join without the AI notetaker running, say so. Consent stops being free when declining the tool costs the participant the session or the incentive.

Write the notice in plain language and put it in the recruitment message, not a form opened seconds before the call. Weighing an automated moderator? AI-moderated vs human-moderated research covers the extra disclosure it needs.

Consent has to cover the whole lifecycle. Recording, transcription, storage, sharing with co-investigators, and any secondary use are separate processing events. One yes at the start of the call does not cover them all.

Verbal script (copy and adapt):

“Before we start: this session will be recorded, and an AI tool called [name] will transcribe it and write a summary. The recording and transcript sit in [region] for [period], then we delete them. Only our research team and [stakeholders] can access them. The vendor does not use your data to train its models. You can ask me to stop at any point, and you can ask us to delete the recording afterwards. Happy to continue on that basis?”

Written consent-form checklist:

  • Purpose of the recording and the AI processing
  • Vendor named, model-training stance stated
  • Access list and storage region
  • Retention period for each artefact
  • How to withdraw, and what withdrawal deletes
  • A dated signature or a recorded verbal yes

Log the consent moment with a timestamp; a scripted verbal yes on the recording is valid. Never let the meeting host or the platform consent for a participant. Build the disclosure and the consent step into your user research plan template so it is never improvised.

Data handling, retention and the right to withdraw

Data minimisation is the governing rule: collect what the study needs, keep it only as long as the analysis requires, and delete on a schedule rather than by neglect.

Write a retention schedule with a separate line for each artefact:

  • Raw recordings: delete once the transcript is checked, often within 30 days.
  • Transcripts: hold for the analysis and reporting window, then delete or fully anonymise.
  • AI-generated summaries: treat as personal data while they carry quotes or identifiers, and delete them with the transcript.

Explain withdrawal in concrete terms. A participant can withdraw after the session and ask you to delete the recording, the transcript, or both. Withdrawal means removing identifiable transcripts, including pseudonymised versions where context, role or a verbatim quote could still re-identify someone. Note any limits, such as analysis already published in aggregate, in the consent form.

Encryption in transit and at rest, EU or UK data residency, and per-record deletion should be defaults, not paid upgrades. A vendor that charges extra to delete one person’s data is telling you something.

Industry surveys suggest only around 34% of organisations have formal consent and retention policies. A one-page schedule, linked from your research operations hub, puts you ahead of most teams.

Vendor due-diligence checklist before you deploy

Run every AI notetaker through the same checks, whether you build the workflow in-house or an agency runs it. The bar does not move.

Contract

  • A signed Data Processing Agreement (DPA) that lists sub-processors, names the transfer mechanism for any data leaving the UK or EU, guarantees per-record deletion, and returns or destroys data when the contract ends.

Security and AI practice

  • SOC 2 Type 2, which tests controls over a period, not only SOC 2 Type 1, which is a point-in-time snapshot.
  • A documented model-training stance. Prefer zero-retention or explicit opt-in. Opt-out by default means participants’ words feed a model unless someone remembers to change a setting.

Data location

  • EU or UK data residency as a configurable option.
  • A current, public sub-processor list.
  • On-device transcription where offered — data that never leaves the participant’s machine is the strongest privacy position.

Call behaviour

  • Check how the bot joins. Does it auto-join every meeting on a linked calendar?
  • Can every participant decline the bot, or only the host? Host-only control is the pattern behind the current wave of litigation.

If a vendor cannot answer these in writing, that is your answer. To decide who should own this work, see outsource research vs in-house.

In a recent jobs-to-be-done (JTBD) study for a learning product, we ran 28 interviews across 15 US states over three iterations. Several participants sat in all-party consent states, so we held the whole study to all-party rules.

The workflow followed the playbook above. The recruitment message named the notetaker, the vendor, the storage region and the retention period, and confirmed the vendor did not train models on the data. The moderator read the verbal script at the start of each session, and we kept the timestamped yes on the recording. The study resolved into four clear user segments.

When a participant withdraws after a session, we delete the raw recording, the transcript and the AI summary, and pull any quotes already copied into the analysis document.

We screen vendors on this checklist before fieldwork. We have ruled out a tool that trained on transcripts by default, with the opt-out buried in admin settings, and moved to a zero-retention vendor with UK data residency. Participants who trust the process speak more freely, so protecting that trust protects the data. The consent trail also supports our work on detecting fake & AI participants.

Your 2026 AI-notetaker compliance checklist

Work through this before each study, not once a year.

Consent layers

  • Recording law: identify every participant’s jurisdiction and apply the strictest rule.
  • Data protection: confirm your lawful basis and run a DPIA if the topic is sensitive.
  • Ethics: check the study against your IRB or professional-body standard.

Disclosure

  • Name the AI tool, the vendor and the model-training stance in the recruitment message.

Consent capture

  • Read the verbal script and log the timestamped yes; the host cannot consent for others.

Retention and withdrawal

  • Publish a per-artefact deletion schedule and state what withdrawal removes.

Vendor

  • DPA, SOC 2 Type 2, data residency, per-record deletion, and participant-level control over the bot.

Consent is ongoing, not a one-time checkbox: reconfirm at the session, and honour withdrawal whenever it lands. Next step: turn this into a template your study plan inherits, so no researcher rebuilds it from memory.

Frequently asked questions

Do participants need to consent to AI transcription specifically, or is general recording consent enough?

General “this is recorded” consent is not enough. AI processing is a distinct event: tell participants an automated tool will process their words, name the vendor, and say whether the data trains models. Agreeing to “a recording” is not agreeing to automated analysis or model training.

Can the meeting host consent on behalf of everyone on the call?

No. Consent must be informed, specific and freely given by each person, and a host cannot waive another attendee’s rights. Host-only consent is the core issue in the Otter.ai litigation. Reconfirm with every attendee at the start of the session, and check anyone who joins late.

What happens to recordings and transcripts if a participant withdraws?

Under consent-based GDPR research, delete the recording and any identifiable transcript, including pseudonymised versions where context, role or verbatim quotes could re-identify the person. Remove quotes already copied into working documents, and record any limits — such as findings already published in aggregate — in the consent form.

How long can we keep AI-generated research recordings and notes?

GDPR sets no fixed period, and data minimisation favours short, defined retention. Publish a schedule: raw recordings deleted within about 30 days, transcripts kept for the reporting window, summaries treated as personal data while they carry identifiers. Prefer vendors that offer per-record deletion and zero retention.

About Glasgow Research — Glasgow Research helps B2B SaaS teams turn customer and market research into product decisions. Work with us.

Author

About Vadim Glazkov

Vadim Glazkov is the founder of Glasgow Research and a product research expert working with founders and B2B SaaS teams on customer interviews, JTBD, market validation, and decision-ready research.

View author page