When you carry out online research and never meet your participants, you need to be clear about how important it is to your research that participants are who they say they are and belong to the demographic groups to which they claim to belong. There is always a risk that someone will deceive you, especially in a study for which you are offering incentives. If you can recruit your participants from a restricted community (such as Colorado College students), you are more likely to avoid this kind of deception. If your research involves strangers and it is crucial that you avoid being deceived by potential participants, you may need to think through ways of identifying your participants. (In such a case, you cannot promise participants anonymity, so you may need to weigh the two issues to determine which is more important.)

If you are using social media communities or groups to find participants or carry out research, you have an ethical obligation to treat members of these communities and groups with respect. Find out the norms, expectations, and culture of the group before carrying out research. Do not lurk online in spaces where users can reasonably expect privacy; this amounts to using deception to gain access to the community and is ethically unacceptable. Do not collect information by intervening in such a community without a solid consent process (or an IRB-approved waiver or alteration of the consent process, which may be acceptable in some circumstances).

For online research, your consent process needs to take the online component of the research into account. For example, the traditional consent form language about participation involving "no greater risk than everyday activities" might need to be modified to read "We anticipate that your participation in this study presents no greater risk than everyday use of the internet" (or some equivalent). Your consent form and process should also acknowledge the risks of hacking or other kinds of data insecurity, perhaps by using language something like the following:

 - Although every reasonable effort has been made, confidentiality during actual internet communication procedures cannot be guaranteed.

 - Your confidentiality will be protected to the degree permitted by the technology being used. No guarantees can be made regarding the interception of data sent via the internet by third parties.

 - You have the right to know that email transmissions are not provided and therefore transmission of information through this form [or process] cannot be guaranteed to remain confidential.

If you are carrying out a research project using Amazon Mechanical Turk (mTurk), you should know that an mTurk data security vulnerability has been discovered, meaning that mTurk worker IDs can be connected to personally-identifying information that workers post on their Amazon profile pages. (Please see the paper "Mechanical Turk is Not Anonymous"). Your consent form needs to address this issue. You should use language like the following: "Please be aware that any work performed on Amazon mTurk can potentially be linked to information about you on your Amazon public profile page, depending on the settings you have for that profile. We will not be accessing any personally identifying information about you that you may have put on your Amazon public profile page. We will store your mTurk worker ID separately from the other information you provide to us."

Social media sites such as Facebook and Twitter, survey platforms such as Qualtrics and SurveyMonkey, and "worker" programs such as mTurk have various rules and terms of service. While federal law does not require that academic researchers comply with these rules, your participants may have their accounts closed if they participate in research that breaks the rules or fails to meet the terms of service. To find out more information and to make sure that your research project is in line with the rules and policies of a particular platform, go to that platforms' website and look up information on the following:

 - EULA (End User License Agreement)

 - Statement of rights and responsibilities

 - Terms of Service

 - Privacy Policy

 If you are carrying out online research involving children younger than 13, please see the information about COPPA, the Children's Online Privacy Protection Act discussed on the IRB page about research with children.

Finally, please read this document, which goes into much greater detail about ethical and legal issues related to internet/social media research.