Bioethics Forum Essay

Social Media, Privacy, and Research: A Muddled Landscape

The advent of social media technology has opened many new avenues of research in population health, demographics, psychology, and the social sciences. It is crucial to consider whether researchers conducting observational research using social media need to obtain consent from their research subjects, and whether the current research regulations in the United States establish effective, ethical procedures for obtaining consent for such studies. To determine how to regulate research conducted using social media and the Internet, we must consider whether social media and other digital spaces are public or private domains.

The U.S. Supreme Court has traditionally supported a distinction between public domains, in which information is visible to virtually anyone, and private domains, in which one has “a reasonable expectation of privacy,” i.e., one would not think one’s activities could be observed or reported. Whether or not the expectation of privacy is reasonable is very subjective: the courts have never specified who defines reasonability, and what is considered reasonable depends on the public’s evolving attitudes toward privacy. While many are aware that advertisers and social media platforms can gain access to some elements of our data, millions of Facebook users were surprised to learn that Cambridge Analytica, a political research firm, had accessed user data on behalf of the Trump campaign. What might once have been considered a reasonable expectation of privacy could not be considered so in the future as public knowledge of the policies and practices of social media providers and users has changed. At the same time, it is widely acknowledged that once someone shares information on social media without restricting access to that information, the person no longer controls how it is used or who sees and, therefore, does not have a reasonable expectation of privacy.

While there may not be direct precedent that refers to social media and internet privacy issues in the research context, some courts have considered them in other domains. The Supreme Court has declined to pronounce specific rules, but in City of Ontario v. Quon, an employment case, it stated that “rapid changes in the dynamics of communication and information transmission [are] evident not just in the technology itself but in what society accepts as proper behavior” and that there will be “difficulty in predicting how employees’ privacy expectations will be shaped by those changes or the degree to which society will be prepared to recognize those expectations as reasonable.”

The most complicated cases involve private chat spaces into which users must be invited or have a password to participate. In Pietrylo v. Hillstone Restaurant Group (2009), employees were fired after a restaurant manager observed messages in a private chat that disclosed information about illegal activities and contained disparaging comments about customers and management. The jury ruled that the employees did not have a reasonable expectation of privacy despite the fact that the chat space was password-protected.

The terms of service for many sites acknowledge that they may collect your data, but also afford users the option to restrict access to that data. Once individuals post information under “public” settings (such as on Facebook), users are not considered to have a reasonable expectation of privacy (Romano v. Steelcase, 2010).

But what do social media users themselves think? A 2013 study by Pew Research Center and the Berkeman Center for Internet & Society at Harvard found that only 9% of teenage users describe themselves as “very concerned” about third parties accessing their data and “60% of teen Facebook users keep their profiles private, and most report high levels of confidence in their ability to manage their settings.” Other Pew Studies noted that 91% of Americans believe they lack control over whether social media entities collect their data and the ways that data may be used, as few as “9% of social media users were ‘very confident’ that social media companies would protect their data,” and that roughly two-thirds of Americans are interested in stronger privacy regulations.  According to a study by Abil, Levin, and Riego, millennial employees “generally want privacy from unintended eyes, and yet they share a significant amount of personal information online, knowing it could become available to employers and others.” The effect is that users typically feel they have greater privacy than they may in fact have, and that users might wish for third parties to abstain from accessing their data without consent as a form of good manners.

What should researchers make of this muddled landscape? For studies that involve any sort of direct interaction with individual subjects, consent should be obtained as with other such studies. However, studies that involve mere observation are much more ambiguous. Although current ethics regulations like the Common Rule might not explicitly forbid researchers from observing online activities without alerting subjects, the spirit of professional and research ethics goes beyond the minimum standards enshrined in law, and should account for the lived experiences and perceptions of potential research subjects. An interesting class of studies might be observational studies considered “high stakes,” studies in which the observed behavior might be illegal or compromising. In such cases, researchers should obtain consent despite the fact that court precedent might hold that users do not have a reasonable expectation of privacy. An excellent example is Gabriella Coleman’s “Hacker, Hoaxer, Whistleblower, Spy: The Many Faces of Anonymous,” in which an anthropologist asked hackers for permission to observe some of their “private” chats on 4chan.

Although the  revised Common Rule has not yet been implemented due to regulatory delays, it does not appear that there are any plans to clarify policies on research using social media. The Department of Health and Human Services and the Office for Human Research Protections should produce guidance documents on social media research to facilitate ethical research.

Michael S. Dauber is a managing editor of Voices in Bioethics and an IRB coordinator. He will be a St. Thomas More Scholar in St. John’s University School of Law beginning in August.

45% of The Hastings Center’s work is supported by individual donors like you.
Support our work.