Conducting Online Research

The distinction between public and private online information isn’t always clear. People often don’t have an expectation of privacy for public records, public social media posts/blogs/vlogs/videos, open chat rooms, etc. But for best ethical practices, you should try to protect the privacy and rights of individuals and their information gathered from online sources.  

Does a dataset or site require an account and password to access? If so, the data owner and/or participants may have a reasonable expectation of privacy. Likewise, if you need permission to join an online group moderated by administrators, the community guidelines might restrict research activities or prohibit (directly or indirectly) reproducing site material. In such cases, you’ll need permission to use site data for research purposes, as well as participant consent to observe and/or collect data. Terms of use or agreement and website policies might also limit access and protect data.

Can you determine whether easily accessible data was distributed in good faith? Even if you have unrestricted access to data, you should still exercise caution. Don’t reproduce personally identifiable data or even partial identifiers, unless necessary. The individuals involved might not have authorized the data’s release or distribution (e.g., materials reposted on social media). Or data without identifiers might have come from a private source and should not have been disclosed.

What about participant “friends” on social media? An individual might give consent allowing you to access the content of their social media account(s). But such accounts typically include posts or comments from “friends” or “followers” (on the participant’s “wall” or “feed”). Before recording or using data from this broader population, you likely will need to obtain their individual consent. Even if a social media account is set to public, so that individuals don’t have a reasonable expectation of privacy, you might choose to seek consent to use more sensitive or highly identifiable data.

When you don’t interact directly with participants through video or audio, you might not know whether individuals are misrepresenting themselves. Sometimes individuals might record information or post previously recorded information for which they do not have the right. This creates risks for those who may not have provided consent to record or share, especially if the content involves illegal, embarrassing, or otherwise undesirable actions. You should consider whether using or recording this information for research purposes heightens risk for individuals.

How about already existing data and databases intended for public use? You do not need HRPP/IRB consideration to access and use such data. But if any data contain identifiers and are not publicly available, or if you intend to interact directly with individuals, you will likely need to submit an HRPP application for your study. Contact the HRPP if you have questions.
 

Even if community guidelines don’t state explicit privacy policies, do members have an expectation that their posts are private? A public group might exist as a safe place to discuss shared identities, interests, or experiences, e.g., fertility concerns, substance use disorders, disordered eating, lifestyle activities, unique demographics. Members might use the community as a support place and expect a higher level of confidentiality if they believe others in the group share their connection. Consult with a group administrator to find out community expectations and seek permission before posting recruitment requests or collecting data.

If you have a group administrator’s permission or if community guidelines do not restrict research activities, you should still show sensitivity to the community. Group members may consider your presence as a researcher as intrusive. They will be more likely to trust you if you have prior experience with and connection to the online community you wish to study. Clearly inform participants that you are conducting observations of Internet-based interactions for research purposes. Explain that you will not identify any participants individually without explicit permission and will use/present data only in aggregate or summary.

If participants in an online forum or chatroom express discomfort with your presence as a researcher, you should respect their concerns. You might consider creating a separate chatroom and invite individuals to participate in the study. You could then obtain informed consent to use their input for research purposes.

Depending on the degree of sensitivity of a topic or potential expectations of privacy, the HRPP may review studies in online spaces at the Expedited level.

Multiple factors can increase identifiability and re-identifiability of individuals through their online presence. Even a few data points could reasonably increase the possibility of reidentifying someone. The following information distinguishes some different types of data related to identifiability, which you should treat with care if recording and using, particularly if linked to other data. Whenever possible, report results in an anonymous and aggregate form. (Remember: never collect direct or indirect identifiers that your study doesn’t reasonably require.) —

Usernames: Individuals might use part or all of their legal names, so consider replacing them with pseudonyms if you collect data from a site.

IP addresses: While you might not intentionally collect these unique device identifiers, some survey software such as Qualtrics can collect them unless you change the settings. When paired with other information, IP addresses can make data highly identifiable.

Purchase history and habits: With so many people engaging in online shopping, an individual’s online purchasing pattern(s) could represent identifiable information, especially if reidentification is more likely due to unique history and habits.

Digital images (audio/video): Digital images showing someone’s face or body (even if partial) are nearly always identifiable. You will need to obtain them in a way that protects a person’s identity unless the data is clearly intended for public access and use.

Avatars or profile pictures: While someone’s user image might not be a real photograph, it might resemble and individual to the point of being recognizable and thus identifiable.

Keystroke dynamics/typing biometrics: An individual’s detailed keystroke timing/rhythm (when and how each key is pressed and released) represents a unique identifier that can be nearly as identifiable as a fingerprint or a signature.

Other biometrics: Eye trackers or other devices that record individual digital interactions could produce data that alone might not be identifiable, but stored together with other information, becomes an identifiable data set.

Always review and follow the privacy policies, Terms of Service (TOS)/ Terms of Agreement (TOA), or Terms and Conditions of Use of any sites or apps you plan to use for research purposes. If you don’t, violation of policies or terms could result in data loss, reputational damage for you and/or WWU, and possibly even legal action. If applicable, your consent language should include whether the app/third-party will have access to participant data, and whether individuals who participate in the research must agree to TOS/TOA.

Typically, you can post study information on your own social media feeds and ask friends to share recruitment announcements as well. But before recruiting in private groups or other online forums, contact site moderators to find out whether you need permission and whether any restrictions exist. Be sure to explain these steps in your HRPP application. Remember that others may share your study information, but no one should provide you with contact information of potential participants without those individuals’ explicit permission.

Recruitment information must clearly explain that online surveys are part of a research study, any inclusion/exclusion criteria, an approximate timeframe for completing the survey, and any payment/incentive information. Always include “Western Washington University” and your department/program, and your contact information (for best practices, always provide your WWU email).

Whether you use a brief blurb in a social media post or a recruitment website, keep study information neutral and fact-based. Avoid claiming that the research is critical, important, or that “everyone is talking about it,” etc. Don’t use bold formatting or highlighting for any incentive information.

If you use email to send study information, place recipient addresses in the BCC line. This practice avoids targeting individuals, who might feel freer to decline participation. This approach also prevents the dreaded “Reply All” responses.
Inform participants how they will access online surveys. With increasing concerns about fake websites, phishing, malware, etc., participants need to feel confident about accessing any links or QR codes you provide.

Using WWU resources such as Qualtrics or secure crowdsourcing platforms (e.g., Prolific) will help increase trust in your survey’s authenticity.

A separate first page (without any survey questions) should include consent language appropriately tailored for online data collection. (See HRPP guidance on Informed Consent and download an online consent template.)

Don’t combine separate research activities into one consent form. For example, in the initial consent (whether at the start of a survey or if provided by email), you can explain that a study will include an online survey and a subsequent 60-minute interview. You can also indicate any inclusion/exclusion criteria for varying research activities. But you need a separate consent form (or information sheet) and process for each activity. For pre-/post-surveys, you can shorten the consent language on the second survey (you don’t have to provide as much introductory information), but it should still tell participants how much time will be involved, that they can skip questions or stop at any time, etc.

Use brief, clear language with shorter sentences, smaller paragraphs, and clean visual formatting with ample white space between chunks of text.

Encourage participants to print a copy of the consent page for their records.

At the end of the consent language, include a statement such as “By clicking through to the survey I agree that I am over 18 and consent to participate in this research.” Then provide an “I agree” button and an “Opt out” button that redirects the person to a page thanking them and indicating they will not be part of the research. This way, individuals are actively opting in or out of survey participation. (To address unintentional opt outs, consider adding, “If you opted out by mistake, you can return to the survey here.”)

Clarify any plans for future data use by stating one of the following conditions:

• After removing all identifying information, I may use your de-identified for future research studies or distribute it to other researchers without additional consent. OR
• Even after I remove all identifying information, I will not distribute or use study data for future research.

If your study needs a signed consent form (e.g., you will collect highly sensitive, identifiable data), you can email the consent form and have participants return it using a verifiable electronic signature. Or you can mail or email the consent form to participants, who can print, sign, and return it in hard copy via mail or as a scanned document via email or fax. Typed names do not constitute signatures.

Many online surveys are simple and straightforward. But certain best practices can enhance ethical online data collection and improve the participant experiences.

Always include previous and next buttons on each survey screen, unless your methodology precludes allowing participants to revise responses.

Don’t force responses, even on demographic sections, unless you provide a “Decline to answer” or “Prefer not to answer” option. If your study methodology requires responses to any questions, you must include that information in the consent language. For example, “We need to collect certain information to understand [explain], so you will not be able to skip all the questions. But you can always stop the survey if you don’t want to answer.”

If your survey includes sensitive or triggering questions or images, alert participants and remind them that they can skip questions or stop at any time. (Consider putting such questions or images on a subsequent page, so the individual can choose voluntarily whether to continue.)

At the end of the survey, thank the participants for their time and repeat your contact information. Then provide an option for participants to submit their data for study inclusion and an option to discard their data. (If you have set your survey to save data from partial surveys, you must disclose in the consent form that once participants begin the survey, their data will be stored. If they opt at the end to discard their data, you may not retain any previously stored responses.)

In both the informed consent and final survey page, advise participants to close their browser window after finishing or when stopping. Depending on the sensitivity of the research, you might also suggest that they clear their cache if using a shared device.

The HRPP recommends using WWU Qualtrics for hosting online surveys unless you have a clear reason for using another resource (which you’ll need to explain in your protocol application). You can still recruit participants through a crowdsourcing platform such as Amazon Mechanical Turk (MTurk), Prolific, Redcap, etc. Avoid using unsecure such as Google Forms or Docs, Survey Monkey, etc.

Always review confidentiality measures and data security policies for third-party survey hosting sites. For online research that may collect responses from individuals living in the European Union, you will need to comply with the EU General Data Protection Regulation. Qualtrics provides guidance to help ensure GDPR-compliance.

Check software settings and set them to the maximum privacy level. Do not say that your survey is “anonymous” if you have not established anonymous settings. (Qualtrics provides guidance on anonymizing responses.) You should not collect IP addresses or any geolocations unless you clarify these intentions in your informed consent.

Data collected through MTurk remains subject to Amazon Services Conditions of Use agreement. If you collect data entirely within MTurk’s platform (e.g., you do not redirect to a Qualtrics survey), those data are not anonymous because they are connected to an individual’s MTurk Worker ID. Likewise, Prolific requires an individual ID for payment purposes. 

If you recruit via a crowdsourcing platform but collect data through an external site such as Qualtrics, data are anonymous only if you do not ask for any identifying information (including name, email, date of birth, Worker ID, IP address), or responses do not include enough indirect participant information to re-identify an individual. (Even temporarily linked data cannot be called anonymous.)
Unless you have a clear reason to promise and can establish anonymity, use the term “confidential” instead. See further HRPP guidance on Anonymity, Confidentiality, and Privacy.

Generally, best practices in social-behavioral-educational research (SBER) recommend against offering participant incentives. But if you believe it will improve your response rate or want to thank participants for their time, consider providing a small gift e- card or perhaps a drawing for a larger incentive. (Avoid the word “raffle,” which relates to gambling.)

To collect contact information for incentives or credit, provide another link at the end of the survey that takes participants to a different location from their responses. There, they can enter their email to receive an e-card or enter a drawing, or in the case of WWU students, provide their name or W Number to receive course credit from instructors. Don’t link this information to survey responses or retain it after providing the incentive.

Participant reimbursements on crowdsourcing platforms (MTurk, Prolific) might vary significantly. Consider what compensation amount would be appropriate to avoid exploiting participants (by offering too little) or unduly influencing participants (with higher amounts). Include time to review the consent form in deciding a reimbursement amount.

Explain any prorating plans (i.e., partial payment for incomplete surveys) in the consent materials and your HRPP application.

Post-quarantine, people increasingly use Teams, Zoom, WhatsApp, etc. to conduct interviews and focus groups. These options allow individuals to participate in research from convenient locations but require measures to address confidentiality and privacy concerns.
Use your WWU Teams or Zoom account and require a passcode to enter the online space. Enable a waiting room to admit individuals instead of automatic joining. (Avoid non-secure platforms such as WhatsApp. While Google Chat gives privacy assurances, you should avoid using personal accounts for research.) 

Ideally, individuals should participate from a space where others can’t hear or see the researcher and/or the participant—especially with online focus groups. If individuals can’t participate from a private space, they might need to use headphones and/or use a blurred or virtual background.

If you will audio or video record interviews or focus groups, you must include that information in your recruitment and consent materials. Tell potential participants whether they can opt out of recording, or whether it’s required for the study. Inform participants when you are about to start recording and be sure no unconsented individuals (e.g., children, co-workers, roommates) are present who might accidentally become part of recorded data, even temporarily. (Pets are an exception and are frequently welcomed.)

Record only when necessary for obtaining a transcription or other justifiable purposes (which you should explain in your protocol application), and not only for convenience. In the consent material and your protocol application, clarify how you will secure the recording, who will have access, and how long you will retain it (e.g., only until transcription takes place?).

With extensive interactions on these platforms, especially among younger populations, researchers might be increasingly interested in collecting data from these spaces, which require considerations related to the virtual vs. actual person. People often operate in online virtual worlds as a certain character or persona.  

Treat such online identities (avatars and personas) as you would the real person because individuals often care deeply about their online character’s reputation. Assess how easily one might be able to trace these identities back to a specific person. 
Consider whether the user might be presenting themselves differently (demographics, personality, etc.) than in real life and how that might impact your research goals. For example, could any minors be responding to your survey or other online data collection, and do you reasonably have a way to screen them out or obtain parental permission?

Decide whether your avatar/persona will closely reflect your identity and how you will disclose that you are a researcher. If you will conceal either of these factors, your protocol application will need to address incomplete disclosure or deception use.
Understand that the consent process might be more complicated. Often, you can obtain consent from the human controller or their proxy avatar, but depending on the community and the role of virtual personas, you might need consent from both the online and human identities.

If online community members might be in international locations (particularly the European Union, which has strict privacy guidelines), consider whether you can reasonably determine this and whether additional protections might be needed.

Transmitting and collecting data online runs the risk of third-party interception and involvement, but using sites with security assurances (such as Qualtrics) will help reduce such risks. Even so, do not promise confidentiality or anonymity to participants, when the security of online transmissions can’t be guaranteed.

Always disclose limitations to confidentiality in consent materials. For example:

• “We will maintain confidentiality to the degree permitted by the technology used, but whenever you provide information online, your data could be intercepted. We’re using a secure system to collect data [elaborate if desired – Qualtrics, etc.] but can’t eliminate this risk completely.”
• And/or (if applicable) “Data may exist on backups or server logs beyond the timeframe of this research project.”
  In both the informed consent and final survey page, advise participants to close their browser window after finishing or when stopping.

Depending on the sensitivity of the research, you might also suggest that they clear their cache if using a shared device.

Many online surveys sites allow collecting IP addresses, date and time of survey completion, etc., which can potentially identify a participant. Collect only the information you need for your study and deselect (or select) appropriate options for the highest security levels.

Keep all applications and the operating system up to date. You should encrypt any identifiable or coded sensitive datasets before sharing them over the Internet to protect against hacking or decoding data that could be retraced back to a specific individual. No system is completely secure and hack-proof, however, so for communicating with participants about sensitive topics or sharing highly identifiable information, encrypt email or use a platform such as WWU Qualtrics to collect data.

When conducting research as a WWU affiliate, always use WWU Outlook email (not your personal Gmail, Hotmail, etc.). Do not store data in Qualtrics (or other survey hosting software). Download results to a password-protected folder in WWU OneDrive or SharePoint, then delete survey results from the hosting platform, and store the data according to your approved protocol plan. For collaborative research projects, read guidance on creating shared password-protected folders.

If you are a student using your own WWU Qualtrics account, you must add your faculty/staff advisor using the “collaboration” feature. Download data to a shared OneDrive folder and fully deidentify or delete it before graduation. If your study has federal funding and you collected identifiable data, then before graduation you must transfer it (and any signed consent forms) to your faculty advisor for retention as described in your approved protocol. Followed the same method for any survey platform if you did not use Qualtrics.

For more information, read the HRPP guidance on Data Security and Storage.

When individuals use their smartphones or other mobile devices to participate in research, or the data involves social media apps that require installation onto and network with a device, you need be aware of additional concerns.

Don’t collect location information or other data not explicitly described or outlined in the protocol application or consent form.

If your study requires a participant to download an app for data collection, describe in the protocol how the app will be deactivated at the conclusion of the study: make deactivation part of study exit procedures or provide participants with instructions how to deactivate the app on the device. (Should the participant not properly deactivate the app, do not collect any data after study completion.)

The Children’s Online Privacy Protection Act (COPPA) protects children’s privacy and safety online. COPPA requires posting notifications about how a child’s data will be used and requires obtaining child assent and parent permission. If a minimal-risk study meets necessary criteria, you might be able to request a waiver of parental permission or its documentation in your HRPP application.

Be mindful of whether minors could be active on sites, forums, or chats in which you seek to conduct research—particularly with gaming platforms.

You also need to consider whether other vulnerable populations (e.g., incarcerated individuals, persons with decisional impairment) could be among online community members. Might reasonable ways exist to screen out these participants or not collect data from them in online communities? Or could you build in other safeguards for protections?