Online research can collect information from a participant’s webcam, responses and device. Privacy therefore begins before the first task, with a clear account of what will happen. Storing results in Europe can be part of a responsible setup, but location alone does not establish GDPR compliance.
What should a participant know first?
Before data is collected, the study needs to identify the controller, explain the purpose and legal basis, describe the data and recipients, state how long personal data will be kept and explain relevant rights and international transfers. These are among the transparency requirements in GDPR Article 13 (EU General Data Protection Regulation). The notice should be easy to understand in the context of the task, not hidden in a dense footer.
If a study relies on consent, the choice must be informed and made before that processing starts. The legal basis and any additional requirements for sensitive data depend on the actual study design. A privacy notice cannot be copied unchanged from one research project to another.
Why minimise data?
Ask what information is necessary for the question. If a study can use derived gaze or expression measures without keeping raw footage, that can reduce the amount of personal data retained. SurveyNeuro.com has stated that it analyses webcam input in real time, does not store raw webcam video or audio and keeps anonymous numerical research measures on Google servers in Frankfurt. The exact participant notice for a project should still explain the processing that occurs before anonymisation.
The GDPR requires data minimisation and storage limitation. Truly anonymous information is treated differently from data that could still be linked to a person; a code or pseudonym does not automatically make data anonymous (GDPR principles and definitions).
What else should a team check?
Review who can access identifiable data, how providers process it, whether data leaves the relevant jurisdiction and what happens when the retention period ends. Test the consent and withdrawal flow as part of the participant experience. Guidance from the European Data Protection Board on video devices illustrates why video-related processing needs particular attention to lawful basis and transparency (EDPB video-device guidelines).
Privacy is also a research-quality issue. People should understand the task well enough to decide whether to participate, and teams should be able to explain what a result represents without exposing more information than needed.
Key takeaways
- Explain the specific study before collecting data.
- Minimise retained data and distinguish anonymous from pseudonymous output.
- Hosting location is one factor; lawful basis, access, retention and transfers also matter.