Informed consent is the requirement that, before data is collected from people for research, the participants must know what they’re agreeing to and must agree freely. It’s a foundational principle of research ethics, traceable to the Nuremberg Code (1947, written in response to Nazi medical experiments), the Declaration of Helsinki (1964, World Medical Association) and the Belmont Report (1979, U.S. National Commission). Today it’s enforced by university research ethics boards (in Canada, under the Tri-Council Policy Statement, TCPS 2), industry compliance departments, and law (GDPR, HIPAA, PIPEDA).
The participants should know:
- Who is asking — the name of the researcher and the institution behind the project.
- What the data will be used for — the purpose of the research, in plain language, not buried in legalese.
- That they can withdraw at any time, and that withdrawal won’t penalize them in any way.
- What risks the study carries, and that the researchers are protecting against foreseeable harm.
The four standard elements of valid consent are disclosure (full and intelligible information), comprehension (the participant actually understands it), voluntariness (no coercion from power imbalance, financial pressure, or social pressure), and capacity (the participant is competent to consent — minors and incapacitated adults require a substitute decision-maker). A signed form whose contents the participant didn’t read or didn’t understand isn’t real consent.
Informed consent isn’t absolute. Research ethics frameworks recognize circumstances where consent can be waived or altered: minimal-risk research where consent is impracticable (e.g. retrospective analysis of large databases), secondary use of de-identified data, research on deceased individuals, and some emergency-medicine contexts. Waivers require ethics-board approval and additional safeguards — they aren’t a loophole.
Beyond consent itself, the collection should be unbiased — researchers shouldn’t cherry-pick participants in a way that distorts the conclusions. Confidentiality of participants’ identities should be maintained throughout. And if participants are spending real time on the study, their time should be compensated.
These principles aren’t optional. The cautionary case is Cambridge Analytica, the political-consulting firm that obtained Facebook data from millions of users without meaningful consent and used it for targeted political advertising. The fallout — regulatory, financial, reputational — was severe, and it accelerated stricter data-protection laws around the world.
Even where the law doesn’t require ethical collection, treating privacy seriously matters: the expectation of privacy is what makes large-scale data collection possible at all. If people expected their measurements to leak, they wouldn’t agree to be measured.