You’ve probably spent more time worrying about what to wear for a video interview than about what happens to the recording afterward. That’s understandable — the immediate pressure is to make a good impression, not to parse data retention policies. But the footage you produce during a remote interview doesn’t vanish when you close the browser tab. It lands on a platform’s servers, where it may sit for months or years, accessible to people you’ve never met, and in some cases used to train the very AI systems that might evaluate your next application. Understanding what these platforms actually do with your recording is becoming as relevant as knowing how to frame your camera shot.
Data PrivacyVideo Interview PlatformsCandidate RightsAI Hiring
The Recording Starts Before You Click “Agree”
Every autonomous AI interviewer platform — Mercor, Apriora, Ribbon — and every async AI-scored video platform like HireVue records video and audio by default. Some also capture screen activity during technical assessments. The consent mechanism is nearly always bundled into the act of continuing: you see a notice, you click past it, and that click is treated as informed consent to recording, storage, and — depending on the platform — reuse for model training. The disclosure is usually accurate but rarely prominent. And almost no platform offers a meaningful opt-out that doesn’t also disqualify you from the role. So the choice becomes: participate on the platform’s terms or don’t participate at all.
You aren’t really consenting if the only alternative is withdrawing your application. That’s the practical reality most platforms design around, and it’s worth naming plainly.
Mercor, for example, records video, audio, and generates an AI transcript used for evaluation and candidate-employer matching. The company states it does not use interview data to train third-party or external LLMs and does not sell recordings. Ribbon’s terms, by contrast, grant the company a broad license to use submitted content “to improve services, including training AI models” — a more aggressive stance that candidates may not realize they’ve agreed to until long after the interview is over.
Who Actually Watches Your Interview — and Who Doesn’t
Here’s a detail that might shift how you think about the process. In high-volume hiring — hundreds or thousands of applicants per role — a common pattern emerges: the AI model scores every candidate, then routes only the top-scoring tier and flagged or borderline cases to a human recruiter for review. The bottom third of the candidate pool is frequently scored, ranked, and rejected by the model alone, with no human ever opening the recording.
That means your interview may never be watched by a person. It’s evaluated by an algorithm, stored on a server, and potentially retained long after the hiring decision is made. The implications are worth sitting with: you’re being recorded for a human reviewer who may never exist in your case, while the recording itself persists as data. Your interview becomes a data asset before it ever becomes a human evaluation.
- Your recording may be scored by AI and never opened by a person — so treat the camera as your primary audience.
- If the role is highly competitive (hundreds of applicants), assume automated scoring determines the first cut.
- Borderline or high-scoring candidates are more likely to get human review — clarity and coherence matter more than polish.
This pattern is documented across platforms like HireVue, Mercor, and Ribbon, where the AI-first screening model is a feature, not a bug. Industry guidance suggests that employers adopting these tools should evaluate whether automated rejection without human review aligns with their own fairness standards — but from the candidate side, the system is largely opaque.
Three Years, Two Years, or “Until We Say So” — Retention Windows Explained
Retention periods vary dramatically by platform and are often set by the hiring company rather than disclosed to candidates as a fixed number. HireVue’s default retention is up to three years, but the actual window is configured by the employer — meaning the company interviewing you decides how long your footage sticks around. Ribbon’s privacy policy states recordings and transcripts are retained for up to 24 months unless the customer or candidate requests earlier deletion.
GDPR requires organizations to store personal data only as long as necessary for the purpose it was collected. But when retention is set by the hiring company and enforced by the platform, the candidate has limited visibility into what “necessary” actually means in practice. One HR compliance blog notes that without configurable retention settings, organizations rely on manual deletion workflows — and manual processes leave gaps that regulators could classify as avoidable risk.
⏱️
What Happens When a Platform Gets Breached
In March 2026, a supply-chain breach at a vendor connected to Mercor exposed recorded interview video and facial biometric data for roughly 40,000 candidates. Lawsuits followed alleging violations of Illinois BIPA and California CCPA, along with claims that the breach wasn’t disclosed quickly enough. Most of what’s documented here about the incident comes from reporting by Aceround’s analysis of platform practices, which covers the breach and its aftermath in detail.
This isn’t an isolated hypothetical. A study published in ResearchGate found that 75% of HR professionals indicated that handling sensitive candidate information lacked adequate safeguards, increasing the risk of unauthorized access. Interview recordings contain a dense bundle of personal data: identity signals like face and voice, personal background details like employment history and location, and behavioral indicators including mannerisms and speech patterns. A breach of that material isn’t just a credential leak — it’s an exposure of biometric and behavioral data that can’t be replaced like a password.
Every platform says it. Fewer can prove it under scrutiny. Factor that into how much personal detail you volunteer beyond what the role requires — especially health disclosures, family details, or anything that touches on protected characteristics.
The legal risks for employers are equally real. According to analysis published in the National Law Review, interview recordings can contain far more personal information than traditional interview notes — candidates may discuss medical conditions, religious affiliation, or other protected characteristics in ways that create compliance exposure under CCPA, GDPR, and state-level privacy laws. An archive of interview videos is exactly the kind of overlooked data repository that breach attorneys look for.
Your Rights (and How to Actually Use Them)
Under GDPR, candidates have the right to access copies of their personal data — including video recordings and transcripts — and the right to request erasure. Most platforms accept deletion requests even if they don’t advertise the option. HireVue and most GDPR- and CCPA-compliant platforms will process deletion requests through candidate support channels. Ribbon and Mercor terms mention deletion rights, but the request flow isn’t prominent — you typically need to email support directly.
In practice, exercising these rights means knowing which privacy framework applies to your situation. If you’re a California resident, CCPA grants you rights over your data including the right to know what’s collected and to request deletion. If you’re in the EU or UK, GDPR applies with its broader set of protections. And if you’re in one of the roughly dozen US states that require two-party consent for recording, the legal landscape gets more complicated still — the organization conducting the interview may need consent from both the candidate and any employees involved before recording begins.
Send a direct email to the platform’s privacy or support address. Reference your name, the date of the interview, and the employer you interviewed with. State clearly that you’re requesting deletion under applicable privacy law (GDPR, CCPA, or your local equivalent). Most platforms will process the request within 30 days — but they may not confirm completion unless you follow up.
For employers, the compliance obligation runs deeper. GDPR requires a lawful basis for processing — either explicit informed consent or a legitimate interests assessment documented in advance. The National Law Review notes that organizations should develop policies covering how recordings are used, who has access, where they’re stored, and how long they’re kept — and then actually follow those policies. Without that infrastructure, a single candidate access request can expose gaps that regulators or litigators will find.
What a Secure Interview Platform Should Look Like
For both employers and candidates, knowing what signals a well-protected platform matters more as these tools become standard. Security checklists from industry sources point to several non-negotiable features: data encrypted in transit using modern TLS and at rest with strong encryption and managed key rotation; multi-factor authentication for all reviewers and administrators; role-based access control with granular permissions by department, role, or job requisition; and clear retention settings with reliable deletion workflows.
Certifications like SOC 2 Type II and ISO 27001 are common indicators of mature security programs — but they’re not guarantees. A platform should also provide current assurance documentation under NDA, demonstrate annual penetration testing and continuous vulnerability scanning, and maintain audit logs with incident response procedures. For AI-powered features, candidates must receive clear notification about automated analysis, and consent mechanisms must be explicit, documented, and revocable.
One practical measure that deserves more attention: the platform should allow recording directly to a local hard drive rather than only to a company server or cloud. Not all platforms offer this, but when they do, it gives the candidate or employer more direct control over the footage. If the only option is cloud-only storage, the data lives entirely on someone else’s infrastructure — and that infrastructure may be subject to access by third parties or legal compulsion.
The broader lesson from the research is that data privacy in remote hiring isn’t just a candidate concern or an employer concern — it’s a shared infrastructure question that affects both sides of the table. Employers who choose platforms with transparent security practices, enforceable access controls, and reliable retention and deletion features reduce their own legal exposure while respecting the candidates who trust them with their data.
If you’re job-hunting and encounter a video interview platform you haven’t researched, it’s reasonable to ask the recruiter two questions before the interview: how long the recording will be kept, and whether you can request its deletion after the hiring decision. The answers will tell you more about the company’s data culture than any privacy policy ever could.
The recording you produce in a video interview is more than an evaluation tool — it’s a data asset that outlives the hiring decision. Understanding what happens to it, who has access, and how long it persists is part of navigating remote work’s less visible infrastructure. You don’t need to become a privacy lawyer to job-hunt responsibly. But knowing which questions to ask — about retention, deletion, and what actually gets watched — puts you in a stronger position than most candidates will ever realize they need.