Who Owns the Data a Synthetic Panel Produces

Enterprise · 10 min read

TL;DR: Who owns synthetic research data is a contract question, not a copyright question. The US Copyright Office concluded in January 2025 that purely AI-generated material cannot be protected and that prompts alone do not supply the human control copyright requires. So the file a synthetic panel hands back has no author in the sense a report does. Three other mechanisms still reach it: the EU database right over the collection, trade secrecy while it stays confidential, and whatever your vendor agreement grants. The 2025 ICC/ESOMAR Code adds two duties most buyers have not read, one of which asks you to check published findings for copyright breaches related to AI training data. Six contract lines settle the rest.

Who owns the data a synthetic panel produces?

Your contract does, because copyright mostly does not reach it. Purely AI-generated material is not protected, and a prompt is not enough to make you its author. What you hold in a synthetic dataset is whatever the vendor agreement grants you, plus a database right over the collection and trade secrecy while the file stays private.

Procurement asks who owns synthetic research data at the point where the first study is about to leave the building. By then the question has three parts nobody separated: can we protect this file, publish it, resell it.

A traditional study produces a report you wrote and a dataset you paid a panel to collect. A synthetic study produces a file whose text came out of a model. Those sit in different places in intellectual property law.

This differs from the privacy argument for synthetic personas, which concerns respondents' personal data, and from who sees your concept on a synthetic panel, which concerns disclosure. Here the asset is the output. What follows describes published law and codes, not legal advice.

Is AI-generated survey data copyrightable?

Not the generated part. The US Copyright Office concluded in January 2025 that copyright does not extend to purely AI-generated material, and that prompts alone do not provide sufficient control over the expressive result. Your questionnaire, your selection and arrangement of the output, and your analysis of it remain protectable as your own work.

The United States Copyright Office set out its position in Copyright and Artificial Intelligence, Part 2: Copyrightability, published in January 2025. Three of its stated conclusions decide the question.

First: "Copyright does not extend to purely AI-generated material, or material where there is insufficient human control over the expressive elements."¹ Second: "Based on the functioning of current generally available technology, prompts do not alone provide sufficient control."¹ Third, closing the escape route: "The case has not been made for additional copyright or sui generis protection for AI-generated content."¹ The Office added that these questions "can be resolved pursuant to existing law, without the need for legislative change."¹

Read that against a finished study. The rows of ratings and written rationales were generated, and no amount of prompt engineering makes the person who wrote the brief their author. What you hold is everything around them. The Office is explicit that human authors keep copyright in "their works of authorship that are perceptible in AI-generated outputs, as well as the creative selection, coordination, or arrangement of material in the outputs, or creative modifications of the outputs."¹

So the questionnaire, the segments, the deck and the interpretation are yours. The raw file underneath is unowned expression. Two limits: this states US registration practice, and unowned is not the same as unprotected.

Can you protect a synthetic dataset without copyright?

Three mechanisms still reach it. The EU database right protects a collection where the maker shows substantial investment in obtaining, verifying or presenting the contents. Trade secrecy protects it while it stays confidential. Contract protects whatever the parties write down. Only the third one works reliably across jurisdictions today.

The European route does not depend on authorship. Directive 96/9/EC defines a database as "a collection of independent works, data or other materials arranged in a systematic or methodical way and individually accessible by electronic or other means."² A structured study file meets that.

It then gives two protections. Article 3(1) applies copyright where a database, "by reason of the selection or arrangement of their contents, constitute the author's own intellectual creation."² Article 7(1) needs no author at all: Member States must provide a right for "the maker of a database which shows that there has been qualitatively and/or quantitatively a substantial investment in either the obtaining, verification or presentation of the contents."²

That wording matters here. Nobody obtained the answers, so the argument sits in verification and presentation: the validation runs, the quality checks, the structuring of an archive. Whether a given file clears substantial investment is a question for counsel, not a claim for a methods note. Trade secrecy is the third mechanism, and it ends the moment you publish.

Can a synthetic verbatim contain someone else's copyrighted text?

It can, and the research measures how often. Language models reproduce long verbatim strings from their training data at low but non-zero rates, and alignment reduces the visibility of that behavior rather than removing it. A written rationale from a persona is generated text, so it carries the same small risk as any other model output.

This is the inbound version of a question usually asked the other way round. A confidentiality review worries about your material leaking out. The worry here is third-party material leaking in.

The measurement comes from extraction research. Nasr, Carlini and colleagues generated a billion tokens from each of several open models and found between 0.1 percent and 1 percent of generated tokens belonged to fifty-token sequences appearing verbatim in a web-scale reference corpus; their highest rate on a semi-closed model was 0.852 percent, on gpt-3.5-turbo-instruct.³ Their conclusion on safeguards is blunt: "current alignment techniques do not eliminate memorization."³

Read those numbers for what they are. They come from prompts built to elicit training text, not from survey questions, so they bound what is possible rather than estimate what sits in your open-ends. The 2025 survey of this literature adds a caution: it separates verbatim reproduction from "approximate/paraphrased memorization," where outputs are "similar to training data in content, structure, or phrasing without exact replication."⁴ That case never shows up in a string search.

The professional consequence is already written down. Article 11(b) of the 2025 ICC/ESOMAR Code requires that "researchers and clients must check that there is no privacy, or intellectual property (IP) infringement, such as a copyright breaches including that related to the application of AI and the training data, in the published research results and findings."⁵ That duty names clients, not only vendors.

So treat synthetic text as evidence of a pattern rather than a quotable voice, the rule in what counts as a finding in synthetic open-ends. A theme carried into your own words raises no question. A pull quote set in a brand typeface raises two.

What do the research codes say about who owns synthetic output?

Nothing. The 2025 ICC/ESOMAR Code defines synthetic data and synthetic personas and imposes disclosure duties to clients and to the public, but no article allocates ownership of a deliverable between researcher and client. The two main trade-body papers on synthetic respondents address provenance and transparency and are silent on ownership.

The 2025 revision of the ICC/ESOMAR International Code is the first to name this technology, defining a synthetic persona as "a digital representation of a person generated to mimic the behaviours, preferences, and characteristics of real people or groups."⁵

Two duties follow, both easy to breach by omission. Article 7(e): "The client must be informed when AI or other emerging technologies are to be used in the compilation of datasets, analysis, reporting or interpretation of findings. This includes the use of synthetic data and synthetic personas. In such situations, the extent of human oversight must be stated."⁵ Article 9(b) extends the same disclosure to the public, covering any "significant role in sampling, deployment, analysis, or interpretation of the data."⁵

What the Code does not do is say who owns the result. It requires confidentiality of client results under Article 8(e), and compliance with "any intellectual property (IP) restrictions, such as copyright" relating to re-use of the data under Article 8(b).⁵ Neither allocates a right. The wider duty picture is in which standards duties apply to a synthetic panel.

The trade-body literature is the same. The MRS Delphi Group report warns that "what an LLM tells us is a synthesis of data from a range of sources which may be hard to trace and qualify,"⁶ and the ESOMAR Congress 2024 paper sets out validation and vendor selection criteria.⁷ Neither addresses ownership.

That silence is the finding. Where a published rule would sit there is a blank, and a blank in a code is filled by whoever drafted the contract.

What should a synthetic research contract say about the output?

Six lines. An express grant of rights in the generated dataset, a reuse and resale permission, a training exclusion, a statement of what the personas are built from, an allocation of third-party infringement risk, and the methodology record you need to meet the 2025 Code's disclosure duties.

Five of the six are standard procurement work. The fourth is the one teams skip, and it decides what the other five are worth.

Provenance settles whose rights are already in the chain. A file fitted to a real survey dataset inherits whatever terms govern that dataset. The ESOMAR Congress 2024 paper is explicit that the approach needs a seed: "The AI model must be trained on a minimum original field of 300 respondents."⁷ That is a sensible methodological limit, and also a third-party panel licence sitting upstream of your deliverable.

A census-specified panel has a shorter chain. PersonaHive personas are grounded in national census data, country-specific across nine countries, built from aggregated public statistics rather than fitted to a respondent file, and validated against real surveys. No panel provider's licence terms travel into the output, which makes the provenance line short to answer and the reuse line easier to grant. That is a contract difference, not an accuracy claim.

The smallest useful next step costs nothing: take one synthetic study you have already run and answer all six lines from documents you hold today. The ones you cannot answer are your exposure.

What else do legal and procurement teams ask?

Four questions recur once the ownership gap is visible: whether a vendor can claim the output, whether you can publish synthetic findings, whether an infringement indemnity is reasonable to ask for, and what belongs in the methods note. Short answers follow.

Can a vendor claim ownership of our dataset? It can try, and some standard terms grant a broad licence to use outputs for product improvement. Since copyright may not vest in the generated rows, the position is whatever the agreement says.

Can we publish synthetic findings publicly? Yes, with two duties attached. Article 9(b) requires disclosure of the significant role synthetic data played and the extent of human oversight; Article 11(b) requires you and your vendor to check the findings for IP infringement relating to AI and training data.⁵

Is an infringement indemnity reasonable to ask for? It is normal in software procurement and unusual in research procurement, which is why it gets omitted. Measured reproduction rates are low,³ and small unpriced risks are what indemnities are for.

What belongs in the methods note? Four lines: that the study used synthetic respondents, what the personas were specified from, the extent of human oversight, and the date of the IP check.

PersonaHive runs census-grounded synthetic panels across nine countries, and new accounts get free credits without a card. Run one study while the six lines are still open, and you will learn which your own governance can already answer.

Sources

• Copyright and Artificial Intelligence, Part 2: Copyrightability — Register of Copyrights, United States Copyright Office
• Directive 96/9/EC of 11 March 1996 on the legal protection of databases — Official Journal of the European Union
• Scalable Extraction of Training Data from (Production) Language Models — Milad Nasr, Nicholas Carlini and colleagues, arXiv
• The Landscape of Memorization in LLMs: Mechanisms, Measurement, and Mitigation — Alexander Xiong, Xuandong Zhao, Aneesh Pappu and Dawn Song, arXiv
• ICC/ESOMAR International Code on Market, Opinion and Social Research and Data Analytics, 2025 revision — International Chamber of Commerce and ESOMAR
• Using synthetic respondents for market research — Colin Strong and contributors, MRS Delphi Group, Market Research Society
• Synthetic Data in Marketing Studies: Exploring the promise of generative AI and synthetic data — Samuel Cohen and Thomas Duhard, ESOMAR Congress 2024