Rules
Consumer Research Ethics: A US Guide to Consent, Data, and IRBs
Consumer research ethics guidelines US: consent, IRB review, and the records that keep a study defensible when a participant asks questions later.
What to take away
- The Common Rule at 45 CFR 46 governs federally funded human subjects research, and the Office for Human Research Protections enforces it.
- A compliant consent disclosure names the sponsor, the purpose, the data collected, the retention period, and how to withdraw.
- Keep consent records, protocol versions, review correspondence, and data handling logs for at least three years after a study closes.
- Running a study without required review can halt recruitment, force deletion of collected data, and put federal funding at risk.
- State privacy law adds duties that consent alone does not cover, and California sets the strictest baseline.
Who has jurisdiction over US consumer research
No single agency polices every US consumer study. The Department of Health and Human Services publishes the Common Rule at 45 CFR 46, and its Office for Human Research Protections oversees compliance for covered work. Research funded by a federal department, or run at an institution with a federal assurance, falls inside it. Private brand surveys usually do not.
The FDA applies 21 CFR 50 and 56 to studies of drugs, devices, and some foods. The FTC reaches research through its ban on deceptive acts. State attorneys general enforce their own consumer protection statutes.
IRB review and exemption categories
An institutional review board applies the Common Rule to one protocol at a time. Most consumer panels are reviewed as exempt or expedited, which is faster but not automatic. Exempt categories cover anonymous surveys and benign behavioral research.
Questions about health, income, immigration status, or illegal behavior push a study into full review. So does any study that enrolls children under 18, including a short taste test. Teams with no federal money often skip review entirely, and that call should be documented.
What a compliant consent disclosure contains
A consent form is the record that a participant agreed. It states the study purpose, the sponsor, and who will see the data. It says participation is voluntary and that stopping carries no penalty. It lists what is collected: answers, timestamps, device identifiers, audio, or video. It gives the retention period and a contact for withdrawal.
| Element | Why it is required | Common failure |
|---|---|---|
| Sponsor and purpose | Participants know who asks | Name in screener only |
| Voluntary status | Exit carries no penalty | Incentive clawed back |
| Data inventory | Collection is bounded | Device IDs unlisted |
| Retention period | Deletion requests can be met | "As long as needed" stays vague |
| Secondary use | Model training is disclosed | Reuse assumed covered |
The form also fixes study scope, which helps when primary market research goes to leadership.
Records to keep after a study closes
- Signed consent forms or click-through records with a timestamp
- The protocol and every amendment, with dates
- Review correspondence, including exemption determinations
- A data handling log: storage, access list, deletion dates
Covered institutions keep research records for at least three years after the work ends. The test is whether you could reconstruct what a participant agreed to, on which date, under which questionnaire version. Those same questions belong on the list before buying online research panels from a vendor.
What happens when a study runs without review
An IRB can suspend a protocol mid-study, order deletion of data already collected, and report the lapse to the federal office that oversees the institution.
A university that runs human subjects research without review can lose its federal assurance, which stops every study on campus. Commercial researchers face contractual and statutory penalties instead. A state attorney general can act on a misleading consent practice. Free-text answers often carry names or employers, which complicates de-identification when you analyze open-ended survey responses.
Where the rules differ by place
California's CCPA and CPRA give residents rights to know, delete, correct, and opt out of the sale of personal information, and research data are not wholly exempt. Virginia, Colorado, Connecticut, and Utah have narrower statutes. Illinois restricts biometric identifiers under BIPA, which reaches voiceprints and some facial analysis.
Canada's PIPEDA takes a consent-first approach with a stated purpose for collection, so a panel that recruits there answers to two regimes. The stricter rule governs the participant.
Example: a taste test that needed two consent passes
Example: a US beverage brand ran a 20-minute online survey plus a taste test in Chicago. The first consent covered the survey. The taste test collected video, which required a second form naming the recording, the retention period, and the choice to join without video. Enrollment fell by about a fifth, and both forms stayed in the study file. The pattern repeats across customer research that mixes surveys with in-person sessions.
Common questions
Do I need IRB approval for a consumer survey? Usually not. With no federal funding and a benign topic, no review may apply. Record the reasoning.
How long must consent records be kept? Three years after the research ends is the federal floor for covered work. Contracts can extend that.
Does CCPA cover market research data? Often yes, when the business meets the thresholds and collects personal information from California residents.
Can I reuse panel data for a new project? Only if the first consent covered it. A second use needs its own disclosure.
