Internet Research

The last fifteen years has seen an explosion in internet research. It has gone from a rarity,  with the computer being used to assist in administering measures, to internet activities being the focus of research. This course presents an overview of the use of the internet in research. We will discuss the federal definition of human subjects research related to internet research. Data protection and storage issues will be discussed. Finally risk reduction in internet research will be presented. Objectives:

  • Review federal definition of research with human subjects related to internet research
  • Examine internet research subject recruitment & privacy
  • Review identifiable information issues and concerns related to internet research
  • Discuss Internet-specific ethical considerations
  • Examine autonomy in Internet research
  • Examine minimization of risk in the online environment
  • Discuss data storage, data mining and protection of data

Internet Research


The last fifteen years has seen an explosion in internet research. It has gone from a rarity, with the computer being used to assist in administering measures, to internet activities being the focus of research. This module presents an overview of the use of the internet in research. We will discuss the federal definition of human subjects research related to internet research. Data protection and storage issues will be discussed. Finally risk reduction in internet research will be presented.


There are three basic types of research activities that are being conducted on the internet. These include: 1) recruiting of subjects, 2) observation of internet and mobile communication activities, and 3) data collection on the internet. (ref 79) Because of the popularity of the internet and the wide reach of the internet, researchers may use the internet in multiple ways to recruit their subjects. If you belong to social networking sites or are a member of online chat rooms or bulletin boards, you’ve probably seen recruitment for research studies in these places. Subjects may also be recruited through the use of internet e-mail lists. This can allow researchers to get the word out about their research to many more subjects than is possible through the more traditional avenues of hard-copy print ads or real-world posted fliers. The evolution of the internet has led to a variety of types of business and social interactions being carried out in the online environment. Researchers may observe interactions that occur in chat rooms, on social networking sites, and even in environments like massively multiplayer online role-playing games (MMORPG) like World of Warcraft or Lord of the Rings Online, and 3D Virtual Reality Platforms like Second Life or Active Worlds. These are unique online social environments which can be the object of research specifically focusing on social interactions in such environments. Text messaging using Short Message Service (SMS) available on most cellular phones and providers is commonplace. Smartphone technology and applications provide additional means of communication using text, video and audio. Communication through these mobile applications is increasing. In 2012, 19 billion messages were sent each day using mobile applications (this does not include SMS). It is projected that mobile chat users will send 50 billion messages a day in 2014. Collection of data using these sources has unique ethical considerations for researchers. Researchers can also use the internet to collect data. It is quite common for researchers to use online survey sites to administer surveys to large numbers of subjects very quickly. Just like online recruitment, administering surveys online has the advantage of being able to collect large amounts of data from many subjects in a short period of time. Most survey sites also offer some level of analysis and the creation of charts and graphs based on the data, virtually eliminating the need for researchers to enter data and reducing the need for basic analysis. Many such survey sites also offer recruitment support, making them very appealing for researchers.

Federal definition of research with human subjects related to internet research

The Code of Federal Regulations 46 CFR 45 46.102(d) defines research as “. . .a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. Activities which meet this definition constitute research for purposes of this policy, whether or not they are conducted or supported under a program which is considered research for other purposes . . .” and 46.102 (f) defines human subject as “. . . a living individual about whom an investigator (whether professional or student) conducting research obtains (1) Data through intervention or interaction with the individual, or (2) Identifiable private information.” Conducting research on the internet does not alter these definitions; the research is still subject to federal regulation in the same way that other research is subject to federal regulation. A bit more challenging is understanding what constitutes intervention or interaction in an online environment, as well as what would be considered identifiable private information. What a person thinks may be private information online may not be private at all, and with many linkages between identities online, a person’s identity may be more easily discovered than they realize. Facebook, for example, is linked to many online identities that might otherwise be considered private or anonymous.

Internet-Specific Ethical Considerations

Internet research has all of the same ethical concerns as traditional research, and there are additional internet-specific ethical considerations. Cohen (ref 79) mentions that there are concerns regarding reliability and validity (can we replicate the results we obtain? Can we accept the data that is collected as good data?), skewed subject populations (because not everyone can access the internet), problems with participation of minors (how do we really know who is participating in the research?), risk resultant of participation in the research (we have limited ways in which to gauge whether or not our subjects are experiencing distress) and risk related to breaches of confidentiality (individually identifiable data may be accessed by unauthorized persons). Some participants may share personal information without a clear understanding that the information may be used for potential research or ongoing research if the primary website is not a research website. Support groups, disease specific information sites, and commercial sites often provide forum or discussion areas. While the terms of use, privacy and service agreements are often posted, they may not be specific and most users do not read them. (ref 89)

Internet research subject privacy

Privacy concerns arise with internet research, because even when individuals use pseudonyms, they can often be identified. Online identities may, therefore, require as much protection as actual identities. (ref 79) In this case, perhaps the greatest risk to subjects comes from the seemingly anonymous nature of the online environment. While they may believe they are engaging in online activities anonymously, individuals who are online often reveal much about their real identities. Additionally, IP addresses are often easily obtained-unless specific steps are taken to block the ability to access subject IP addresses. Most internet users are unaware that specific software must be used to allow IP addresses to remain anonymous. There is, essentially, a believe that people are more anonymous online than they really are, increasing the risk that information will be disclosed and assumed to be protected when in reality their identity is known or can be easily identified. Another concern that cannot be ignored is the risk of individuals who participate in online research revealing information about other individuals who have not consented to the research. This can be done intentionally or unintentionally; linkages to social media sites such as facebook or twitter can identify friends or acquaintances, so that information shared about another individual can be easily identified by researchers or other participants. Mobile communication devices allow for instantaneous status updates, video, pictures and audio uploads. This creates a challenge for researchers and informed consent. Simply obtaining consent from the individual uploading the content may not be enough if others are included. Researcher and the IRB should consider the population, risk and ethical issues when deciding the appropriate level of consent required for each study. (ref 90)

Review human subjects Interaction

Research that poses minimal risk to participants also tends to have minimal ethical concerns when conducted online. However, certain types of risk can be more problematic or present a higher level of risk when conducting research via the internet. Just as in traditional types of research, the online researcher needs to be concerned with human subjects interaction in online research, even when risks may otherwise seem minimal. This is especially a concern because, unlike the researcher who collects data in a face-to-face environment, the online researcher does not have the advantage of all of the visual cues subjects may give during research that they are experiencing distress. The online researcher may not be able to hear the subject cry or see a pained expression. Using a video or face-time link to conduct an interview online can allow a researcher to observe signs of distress in participants when researching sensitive topics, however in the event that a researcher does note significant signs of distress there is little that can be done from a distance. And while online subjects completing surveys or filling our questionnaires do have the ability to just close a web page and walk away, the researcher cannot rely upon subjects walking away or withdrawing themselves from the study if they are feeling distressed or upset. There is a real risk that participants in highly sensitive studies that are conducted online could be harmed and no one would know about it. With very sensitive social-behavioral research, it can be difficult to find a solution that allows participants to safely engage online.

Autonomy in Internet research

In any research with human subjects, individuals must be allowed to retain their autonomy as described in the Belmont Principles. Autonomy deals with an individual’s ability to make informed choices about their own actions. This, of course, deals with informed consent. (ref 41) Consent can pose particularly difficult issues when conducting internet research. For minimal risk research, this may not be a problem, but for research that poses greater than minimal risk, it can be challenging to obtain true informed consent. There are problems obtaining signed written documentation of consent, and researchers will frequently ask for a waiver of signature or documentation of informed consent. Often, online surveys provide consent language and then ask participants to “click here” to signify consent; basically waiving any documentation of consent. The problem with this approach is that it removes the process of informed consent. Rather than a process that allows time for questioning and verification that participants understand the risks of a given study, online research tends to focus on limited consent language and an assumption of understanding. This may interfere with a participant’s ability to make informed choices.

Internet recruitment

It is becoming increasing popular to use the internet to recruit research participants, whether the research will actually be conducted online or not. Researchers will frequent propose to use social media sites, email, blogs, listserves, and other internet groups to identify a wide range of participants. In many ways, this is a good thing; researchers can cast a wide net when recruiting through the internet, which can result in more reliable results and better science. For the most part, when a researcher will recruit on the internet, the Institutional Review Board will focus on the same issues that they would focus on with any other type of recruitment. (ref 79) There are some unique problems related to internet recruitment, especially when those recruited online will also be participating online and provide consent via the internet. For example, it is difficult to determine the actual age of participants if recruitment, consent, and engagement in the research all occur online. Similarly, researchers are unable to establish whether participants meet inclusion criteria if recruitment and consent occur online. Recruitment strategy becomes very important in these cases; closed online groups that have already verified the membership requirements of its members can be used to help ensure participants meet certain inclusion criteria. If the research involves a high-risk subject (dealing with illegal behaviors, for example), it can pose a risk to subjects to even visit the site where information about the research is posted—since IP addresses are routinely collected when a site is visited. New complications related to internet recruitment continue to come to light as researchers get more creative in their use of the internet in research.

Data storage, data mining and protection of data

When internet activity is observed it usually involves collecting demographic information or observing online activities (like participation in Second Life). The IRB is generally concerned with consent and disclosure issues and well as privacy and confidentiality. (ref 79) The key risk in internet research is breach of confidentiality. While researchers may attempt to offer anonymity in internet research, this can be difficult to actually provide, especially if there is e-mail involved. If a researcher is claiming to provide anonymity to subjects, then it must be explained how that anonymity is being provided, and researchers are tasked with the responsibility to understand the risks and barriers to true anonymity in an online environment, where every click and login is recorded and rarely is anything as private as it seems.

Minimization of Risk

Minimization of risk during research on the internet presents some special issues that need to be addressed. The National Institute of Mental Health has published a risk minimization chart that can apply to internet research in general, although it was originally intended for use in research dealing specifically with mental health interventions., It addresses the following issues:

  • anonymity,
  • individuals posing as researchers obtaining information from vulnerable persons,
  • limited monitoring of research participant’s clinical status,
  • lack of in-person communication between researcher and participant,
  • limited information regarding consent,
  • uncertainty regarding adequate debriefing,
  • unintended limits to privacy and confidentiality,
  • breach of confidentiality,
  • biased sample selection,
  • generalizability (risk that results of the research may not be generalizable to populations without internet access) (ref 91)

Promises of anonymity in online research can have negative impacts, such as subjects providing potentially inaccurate information about themselves. For example, an online participant can pose as a different gender, as someone who has experienced some phenomenon that they have not actually experienced, as an older or younger person, or as a person with a mental or physical condition that they don’t actually have- to name just a few. This can lead to false results, as well as the potential for participants to engage in interactions with other participants with whom they believe to share a trait, condition, or group membership relevant to the research, when in fact someone is posing as a member of that group, When a researcher includes a face-to-face meeting with participants, they can ascertain the veracity of at least some of the information being provided by the subject. Researchers can also require a signature on the consent form or have subjects provide addresses/phone numbers which can be verified. Conversely, researchers can elect to include participants who are already known members of a population—for example, individuals who have had a transplant at a particular transplant center. (ref 91) There is also a risk that individuals posing as researchers may try to obtain information from vulnerable persons. This makes internet recruiting for legitimate researchers difficult, especially if they are attempting to work with a population that has experienced this kind of deception in the past. Researchers can provide participants with ways of verifying their identity and credentials, such as links to their CV or contact information for a verifiable organization, such as a university or research center. It is recommended that signed certificates and SSL is used for all data transfers over the internet. Participants can also be encouraged to call the study site, and contact information for the IRB allows another opportunity for potential participants to verify the identity of researchers. (ref 91) Because there is limited monitoring of research participant’s clinical status or distress over the internet, subjects may experience significant psychological trauma without it becoming known to the researchers. This can be dealt with by having clear procedures that participants should follow if they are distressed or need help and the researchers should discussed this information in advance, and the information should be repeated. Questions can be included in the protocol to screen for problems, and researchers should monitor these responses. If a subject becomes seriously distressed or traumatized by the research, they may tell the researcher they are seeking help but not actually do it. Procedures that not only provide clear information to participants about how and where to seek help, but also allow for verification that participants followed through can be difficult to develop and maintain. (ref 91) In internet research there is often a lack of in-person communication between researcher and participant. If this is the case, the research may not know whether or not the subject has the necessary skills to participate in the study. The participant may have limited literacy and may not understand portions of the study or the consent. Participants may also not understand how to use the computer. If this is the case, there can be face-to-face discussions or phone calls scheduled. The researchers should make sure that individuals with disabilities who are participating in the study understand the study and know how to use the computer. There should be parts of the protocol that specifically address computer literacy. (ref 91) There may be limited information regarding consent. The investigator might not know if the subjects truly understand the consent. There may not be opportunities for subjects to ask questions about the study as there are in more traditional research. Researchers can develop a questionnaire to assess participants understanding of the study and consent. Subjects can also be encouraged to contact the researcher to ask questions over the phone, via e-mail, or even in person. (ref 91) There can also be uncertainty regarding adequate debriefing in online research. If participants become angry during debriefing the researcher has no way of knowing. To address this concern, it might be helpful to conduct the debriefing over the internet (in real time), via phone or in person. (ref 91) Both subjects and researchers may be unaware of unintended limits to privacy and confidentiality online. Technical experts should be consulted with regarding internet security and a solid data security plan should be implemented. All servers that house data should be both electronically and physically protected. Subjects should be reminded about how to retain their privacy. Confidentiality may be breached if a public terminal or unsecure e-mail is used. Subjects should be reminded that they also need to be wary of threats to their personal information. (ref 91) Because access to computers is not equally distributed across the population, there are also concerns that sample selection can be biased. The risks and benefits of research might not be evenly distributed across the population in internet research. There may be other accessibility barriers, for example, physical or cognitive barriers. The results of the research may not be generalizable to populations that do not have good access to the Internet. It should be considered how different types of recruitment strategies can affect the sample before the study is conducted. Special training can be provided to subjects to access the computers. Funding can be included to address accessibility issues. Individuals should be widely recruited, so that many types of individuals are included. Non-internet recruitment should also be considered. (ref 91) Download PDF (ref 88)


This module presented an overview of the use of the internet in social and behavioral research. We discussed the federal definition of human subjects research related to internet research. Data protection and storage issues will be discussed. Finally risk reduction in internet research will be presented.