This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
Overview
Online and digital research encompasses a wide range of methods including online surveys, digital ethnography, analysis of social media data, web scraping, and digital experiments. These methods raise specific ethical considerations relating to consent, privacy, and re-identification.
Consent in online research
The consent requirements of the National Statement apply to online research as to other forms. Where research is conducted entirely online, for example through an unsolicited survey distributed via email or social media, researchers must ensure that potential participants receive adequate information and have a genuine opportunity to decide whether to participate.
Online consent mechanisms, including checkbox confirmation, continuation past an information screen, or completion of a survey, may be acceptable where approved by the review body. The adequacy of such mechanisms depends on the risk level and the nature of the research.
Privacy considerations
Online research may collect more data than is apparent to participants, including metadata, IP addresses, browser fingerprinting data, and behavioural traces. Researchers must identify and address these data collection points in their data management plans and disclose them to participants (NS 2.2.6(f)). Collection of metadata beyond what is necessary for the research is inconsistent with data minimisation principles.
IP addresses are a common example: most survey platforms collect them automatically, and they sit on the identifiability continuum the National Statement describes at Chapter 3.1, Element 4, rather than being simply "identifiable" or "not identifiable". See IP address data in online research for detailed guidance on when IP collection is justified, how long it should be retained, and what to tell participants.
Social media and publicly available online data
Data from publicly accessible social media platforms may be subject to terms of service that restrict its use for research, regardless of whether individual posts are publicly visible. Researchers should assess both the legal and ethical basis for using social media data. Content posted publicly is not necessarily content that individuals have consented to having analysed and reported in research. Particular care is required where social media data is used to draw inferences about individual users or where content can be linked to identifiable individuals.
Quality control and industry standards
Many online research providers operate under ISO 20252, the international standard for market, opinion, and social research, which requires appropriate quality control procedures, including measures to detect duplicate or fraudulent responses. ISO 20252 certification is evidence of operational quality; it does not substitute for ethics review, and researchers still need to address consent, privacy, and data management in their application. See ISO 20252 for how the standard relates to ethical review.
Related resources
This page was last updated on 16 September 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.