Social Media and Internet Research: What IRBs Are Really Looking For in 2026

Overview

Social media and internet-based research have become embedded in modern scholarship. Investigators analyze public posts, recruit participants through social platforms, observe online communities, and use digital traces to study behavior at scale. At the same time, Institutional Review Boards (IRBs) are increasingly asked to assess studies where the boundary between public information and human subjects research is not immediately clear.

For investigators, this uncertainty can be frustrating: If the data are public, why does the IRB need to be involved at all? For IRBs, the challenge is different: determining when online activity creates an interaction with individuals, involves identifiable private information, or raises ethical concerns—even when formal consent may not be required.

Let’s explore how IRBs typically approach social media and internet research, what questions guide their determinations, and how investigators can design protocols that move more efficiently through review while still protecting participants.

Why internet research challenges traditional IRB categories

Under the Common Rule (45 CFR 46, Subpart A), IRB oversight hinges on two threshold questions:

1. Is the activity research?
2. If so, does it involve human subjects?

Internet-based studies can complicate both.

When investigators passively analyze existing online content, such as posts on a public forum, there may be no direct interaction with individuals. In other cases, however, researchers recruit participants through social media, engage in direct messaging, or collect data that are technically public but easily traceable back to individuals. These nuances matter.

IRBs do not evaluate “internet research” as a single category. Instead, they examine:

• How the data are obtained
• Whether there is interaction or intervention
• Whether information is identifiable or potentially sensitive
• What risks could arise from disclosure, re-identification, or misuse

Public does not always mean risk-free

A common misconception is that if information is publicly available online, its use in research is automatically outside IRB oversight. In practice, IRBs take a more contextual approach.

Key considerations include:

• Reasonable expectations of privacy: Even when content is technically public, individuals may not expect their posts to be analyzed, quoted, or aggregated for research purposes.
• Identifiability: Quoting verbatim social media posts, usernames, images, or unique phrases can make individuals readily identifiable through simple search tools.
• Sensitivity of the topic: Studies involving health status, mental health, political beliefs, immigration status, or stigmatized behaviors raise ethical considerations regardless of whether the content is public.

As a result, many IRBs encourage investigators to paraphrase content, remove identifiers, and justify why direct quotation or attribution is necessary for scientific validity.

Recruitment through social media: interaction triggers review

Using social media for recruitment introduces a different set of IRB considerations.
Doing any of the following typically falls under the regulatory definition of interaction:

• Sending direct messages
• Responding to user comments
• Managing study-specific social media accounts
• Tailoring recruitment messages to specific communities

This makes IRB review appropriate, even if the study itself is minimal risk.

IRBs reviewing social media recruitment materials often focus on:

• Whether messaging could be coercive or overly influential
• How privacy is protected when users engage publicly with recruitment posts
• Whether recruitment language accurately reflects the study purpose, risks, and expectations

Providing draft recruitment language and moderation plans upfront can significantly reduce review cycles.

Internet research and exemption determinations

Some internet-based studies may qualify under one or more of the exempt categories, particularly Category 2 (surveys, interviews, observation of public behavior) or Category 4 (secondary research using existing data). However, an exemption is not automatic.
IRBs may require:

• Confirmation that participants are adults
• Clarification on whether identifiers are collected or retained
• A limited IRB review when identifiable, sensitive information is involved to ensure adequate privacy and confidentiality protections

What IRBs are really trying to protect

Across institutions, IRBs consistently center their review on a few core concerns:

• Unanticipated harm: Could the use of online data expose individuals to reputational, legal, or social risk?
• Loss of control: Are participants aware that their content could be used in research?
• Context collapse: Does moving content from an online environment into an academic context change its meaning or impact?
• Data persistence: Once published, research findings can become permanent online content in ways the original posters did not anticipate.

Understanding that IRBs are managing these ethical tensions, not trying to obstruct innovation, can help investigators frame protocols more effectively.

Practical steps investigators can take

Although requirements vary by institution, investigators often move more smoothly through IRB review when they:

1. Describe online environments clearly – Explain whether platforms are public, semi-public, or access-restricted, and how participants typically interact within them.
2. Limit identifiability when possible – Use paraphrasing, aggregation, or coding strategies unless direct quotation is methodologically essential.
3. Explain recruitment workflows – Include message templates, response plans, and procedures for handling sensitive disclosures.
4. Address data security explicitly – Internet data may feel “informal,” but IRBs expect the same care applied to storage, access, and retention as other human subjects data.
5. Align with institutional guidance and policies – Many IRBs reference OHRP decision charts and established interpretations when assessing internet research; designing protocols with those in mind can reduce back-and-forth.

Training and education support

Because social media and internet research cut across disciplines, a consistent understanding among investigators, IRB members, and research staff is essential.
Targeted education on the following areas helps institutions review these studies more consistently and efficiently while maintaining participant protections:

• Human subjects regulations
• Privacy and confidentiality in online contexts
• Ethical considerations for digital research methods

References

• Office for Human Research Protections (OHRP). 2020. “Human Subject Regulations Decision Charts: 2018 Requirements.” Accessed May 12, 2026.
• Office for Human Research Protections (OHRP), Secretary’s Advisory Committee on Human Research Protections (SACHRP). 2013. “Attachment B: Considerations and Recommendations concerning Internet Research and Human Subjects Research Regulations, with Revisions.” Accessed May 12, 2026.
• Office for Human Research Protections (OHRP), Secretary’s Advisory Committee on Human Research Protections (SACHRP). 2022. “Use of Social Media by Research Subjects: Ethical and Regulatory Considerations for the Protection of Human Research Subjects.” Accessed May 12, 2026.
• Protection of Human Subjects, 45 CFR § 46 (2018).