The IRB must review and approve all recruitment materials used for internet research.

Examples of internet-based recruitment methods include:

• Email
• Websites and webpages
• Online chatroom or discussion boards
• Video Blogs or blogs
• Online advertising
• List servs

Proper identification and qualification of subjects is a challenge in Internet-based research. Without face-to-face or voice-to-voice interaction, it is difficult for investigators to be sure that participants are not misrepresenting themselves. Investigators should discuss measures taken to authenticate subjects. These situations may include studies for which authentication of subjects is important to the validity of the data or that consist of particularly sensitive topics.

Here are a few examples of recruitment safeguards:

• After initial online recruitment, conduct an in-person information session to ensure potential research participants meet the criteria.
• Ask for certain types of verifications such as a student number or employee number in order to verify identity.
• Provide each participant with a PIN number that can be used for authentication.

• For anonymous internet-based surveys, include I agree or I do not agree buttons on the website for participants to click or some other electronic method for indicating consent.
  •  For anonymous surveys sent to and returned by participants through email, include an information sheet with consent information and inform participants that submitting the completed survey implies their consent.
• If the IRB determines that written consent is required, the consent form can be mailed or emailed to the participant who can then sign the form and return it via fax, postal mail, or scanned and emailed back. 
• If conducting web-based research be careful not to make guarantees of confidentiality or anonymity, as the security of online transmissions is not guaranteed. 

A statement in the informed consent form indicating the limits to confidentiality is typically required.  

Internet-based data collection can range from using existing data and online observations to interventions, surveys, and interviews.

Existing Data

• Research that utilizes data that is both existing and public is not considered human subjects research and does not require IRB approval.
• The investigator must decide if there exists an exception to privacy with existing data.
• If it's been determined that the data was not intended for public use, even if it is publicly available, the data should be considered private.

Surveys & Questionnaires

In order to respect the autonomy of research participants, surveys & questionnaires must be designed in a way that allows participants to:

• Voluntarily bypass questions they do not want to answer.

Include wording like Skip this question or Decline to answer as possible responses to questions in order to prevent any undue pressure participants might feel towards answering a specific question in order to complete the survey or questionnaire.

•  Withdraw from the study during their participation.

Give participants the option to withdraw from the study up until they submit their answers. Use phrases like if you wish to withdraw from the study at any point while completing the survey, simply close your browser and your data will not be collected.

Online Interviews

Conducting an online interview allows researchers to gather information from respondents who are difficult to contact otherwise.

• Interviews can be conducted over the internet using Zoom, Google Chat, Skype, etc.
• The researchers need to state in the protocol which method of communication they will use.
• Researchers need to treat participants with the same level of respect and consideration had the interview taken place in person.

Keep in mind the researcher may need to clarify questions in order to accurately interpret responses. Additional information may need to be provided in order to be sure the participants understand the questions.

Online Observations

Research involving the observation of people in online public spaces is exempt from IRB review ONLY in cases where research involves:

• No direct interaction with individuals
• No identifying information
• Where the individual has no reasonable expectation of privacy.

When storing or transferring participants’ data online, it is imperative that researchers take the appropriate steps to protect their participants’ data from being accessed by non-authorized parties and from being intercepted online.

To this end, all data stored online (e.g., Google Drive, Microsoft Cloud, Dropbox, etc.) should be at the very least password protected.

Researchers may be required to take several further steps to protect the data:

• Anonymize the information.
• House data on a professionally managed server
• Require two-factor authentication for accessing data

If the participant's data is sensitive or personal, or likely to bring harm to the participant if accessed outside the study, researchers may be required to store and transfer electronic data using hard drives or USBs.

Investigators must consider additional data-security issues when conducting Internet-based research and provide information regarding the transmission and storage of the data in their IRB application.

• Researchers must take special care to protect online identities (personas or avatars) and their corresponding character names just like real ones.
  • People care about the reputation of their personas and these aliases can usually be traced back to real-world names.
• Even when it is not the intention of the researcher to collect identifiable information, Internet protocol (IP) addresses are potentially identifiable; thus, if IP addresses will be collected, proper confidentiality measures must be in place in order to protect the subject’s identity. These measures include password protection and encryption.
• The level of security should be appropriate to the risk.
  • Research involving sensitive topics may require additional protections such as certified digital signatures for informed consent, encryption of data transmission, technical separation of identifiers and data, or housing data on a professional manager server.
  • For most research, standard security measures like encryption and secure socket layer (SSL) will suffice.
• All identifiable or coded data transmitted over the Internet must be encrypted.
  • This helps ensure that any data intercepted during transmission cannot be decoded and that individual responses cannot be traced back to an individual respondent.
  • It is important to note that encryption standards vary from country to country, and there are legal restrictions regarding the export of certain encryption software outside US boundaries.
  • It is the investigator’s responsibility to research possible restrictions and plan data security measures accordingly.