Hospitality market research participants are protected by industry consent rules and by privacy laws including EU and California law. Those rules require voluntary consent, clear notice, data limits, and ways to withdraw or delete data.
For this topic, a participant is a hospitality guest asked to join a survey, panel, focus group, or paid study. The rules below explain what must happen before, during, and after you take part. They also show where the limits sit for guests and researchers.
Official resources:
- Explore the official data from Ca — Use this primary source to review the underlying data.
- Explore the official data from Esomar — Use this primary source to review the underlying data.
Table of Contents
- What must you agree to first?
- How must researchers handle your data?
- What extra test applies in Europe?
- What control do you keep after you respond?
- Do protections travel with you?
What must you agree to first?
ESOMAR states in its online research guideline that hospitality guests must give voluntary informed consent after learning the purpose. Researchers must let you withdraw. They cannot use research data for sales or marketing contact without further permission.
The Insights Association requires researchers to obtain consent for participation and personal-data collection. When the contact comes from a hotel client list, researchers must ensure that consent was properly obtained. Ask who shared your details and what the study covers before you agree.
How must researchers handle your data?
The Insights Association Code of Standards and Ethics, August 2025 version, requires transparency about personal-data collection. Researchers must collect data only with consent. They must protect confidentiality and security of participant data in transit and at rest.
In practice, expect a short notice that names what is collected and why. Expect limited questions tied to that purpose and secure storage afterward. Do not continue if the request adds marketing calls without a separate choice.
What extra test applies in Europe?
EU Regulation 2016/679, Art. 6, permits processing guest survey data only on a lawful basis. Valid bases include consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests.
The EU explains in its rules on consent conditions that GDPR consent must be freely given, specific, and informed. Withdrawal must be as easy as giving consent. Buried or bundled hotel check-in consent cannot support optional market research.
What control do you keep after you respond?
EU Regulation 2016/679, Arts. 15 and 17, gives participants rights of access, correction, erasure, restriction, portability, and objection to direct marketing.
You can seek erasure when you withdraw consent or when the data are no longer needed. To use these rights in a hotel study, keep the study name and researcher contact. Then state what you want changed, deleted, or stopped.
- Ask for a copy of your survey data.
- Ask for correction of wrong details.
- Ask for deletion after withdrawal and object to direct marketing.
Do protections travel with you?
EU Art. 3 extends GDPR to EU residents even when the hotel or researcher sits outside the EU. Coverage applies when the hotel or researcher offers goods or services there or monitors behavior there.
The California Attorney General explains in its CCPA overview that California residents hold rights to know, delete, and correct data since 1 Jan. 2023. They can also opt out of sale or sharing, limit sensitive data use, and avoid discrimination. Before you check in, check whether research consent is separate from booking terms and save the opt-out contact.
