Thoughts on Privacy and the Use of Facebook to Recruit Research Subjects

Recently, I was approached by a team of researchers concerned with the research ethics issues related to using Facebook to recruit human subjects. Specifically, the team was planning to use Facebook advertisements in order to target certain users for a research study evaluating the effectiveness of a particular educational strategy aimed at decreasing the occurrence of a particular high risk behavior. The researchers were also considering creating a Facebook page in order to manage communication with potential (and perhaps even actual) subjects in the study.

Here’s my initial assessment of the privacy concerns, with some information changed to keep the researchers and the project confidential.

 Areas of Concern

The primary concern related to researchers’ use of Facebook for recruiting and communicating with subjects (potential or real) relates to privacy and the possible collection of personally identifiable or other sensitive information.

The use of Facebook Ads results in limited privacy concerns in relation to what the researchers might learn about the subjects. While the research team can target a specific set of users – for example, 18-to-35-year-old women who live in Portland, OR – and would know that anyone visiting their website from that ad fit this general demographic profile, no information about individual Facebook users is shared with the research team. Thus, users would be able to view and click the advertisement, and then visit the research website, without fear of their identity being made known.[1] Further, the act of clicking on ads does not appear on user’s timelines, so friends of that user would not be aware of the user’s action related to the advertisement.

A greater privacy concern related to advertisements relates to what Facebook itself collects. If an advertisement includes text related to drug use, for example, and a users clicks on that ad, Facebook retains a record of that action, and could, potentially, use this action to further develop a profile of the user (beyond what the user voluntarily shares on the platform).[2] Facebook’s potential ability to infer information about the user based on the ads clicked is limited to the information provided in the ad itself, and potentially the URL linked to by the ad.

The use of Facebook Pages introduces greater privacy and confidentiality concerns. If a research team wishes to communicate to interested users or participants through the Page, users will need to “like” the page. This positive action of “liking” a page would appear in the user’s News Feed and be publicly viewable by the users friends. For example, if a user “likes” a page related to a drug use study, her friends would be informed of this action, and the page would be listed among that user’s likes on their profile page. Users can also see a list of friends who have “liked” a page by visiting that page at any time. Users do have the ability of controlling the visibility of their “likes” overall, but not of individual pages.

As with advertisements, user activities on Pages are tracked and potentially used by Facebook to compliment other behavioral and demographic data maintained by the company.

In terms of the [project], these concerns can be summarized as follows:

  • Facebook possesses the ability to log user actions related to advertisements, thus any sensitive or controversial content within an ad’s text (such as mention of drug use) could potentially be linked to a user’s account within Facebook’s systems, and Facebook could attempt to infer something about the user based on that action to augment its internal profile of that user. This also applies to user actions on a Facebook Page.
  • Facebook possesses the ability to log the URL of external websites users click to from a link embedded in ads or pages. Thus, if a URL contains sensitive or controversial information (for example,, it could potentially be linked to a user’s account within Facebook’s systems, and Facebook could attempt to infer something about the user based on the URL to augment its internal profile of that user.
  • User actions (likes, comments, etc) on Facebook pages created for research projects are typically visible on that user’s timeline and profile page, and also viewable by friends who happen to visit the project page. Thus, any sensitive or controversial information on the Page, including its name, could become associated with that user.

Preliminary Recommendations

The primary recommendation is to minimize the ability for Facebook or a user’s friends from associating interactions with project-related advertisements or pages with any sensitive or controversial information. Thus, the following actions can be taken:

  • Advertisements should avoid any sensitive or controversial text that could be associated with a user who decides to take action. For example, instead of mentioning a study on “illegal drug use”, the ad can indicate “recreational activities” or similar. By using more generic text, any association made to the user’s account will have minimal harm.
  • URLs used in advertisements or pages should also avoid sensitive or controversial text. For example, should be used rather than To best protect users, the linked pages should also minimize mention of sensitive or controversial text, ideally providing more general information, and then pointing users to other pages that provide more detail.
  • Facebook Pages should also avoid sensitive or controversial text in both their name and the content provided within.
  • While Facebook Pages are a practical tool for communicating with subjects, users might avoid “liking” a Page due to privacy concerns. Thus, other means of communication must be implemented.

[1] The research website likely maintains its own server logs, so a user’s IP address would potentially be collected. This is not related to the use of Facebook, and applies to any visitor to the website under typical circumstance.

[2] Presently, this is mentioned only as a potential concern; additional verification is needed to confirm if Facebook indeed uses “clicked ads” as a means to refine customer profiles.

What do readers think of this preliminary analysis and set of recommendations?


  1. Thank you Michael for raising this issue that is often ignored altogether by the research community. As grant funding for research lessens and the use of social media increases, it’s becoming very difficult for researchers to recruit participants in a cost-effective way without using social media. While I agree that FB would be privy to the participant’s choice to like a study page, the amount of data that FB has access to about the participant is almost entirely based on the participant’s choice to click on content and post, both of which they do after agreeing to the FB privacy disclosure. As a former IRB reviewer, I know that we have to weigh the cost to a sample of participants against the potential benefit of the population. Since that cost seems fairly minimal, assuming the study is of a worthy cause, then I could see IRB’s allowing researchers to create a page for the study. As you already mentioned, there is then the issue of their friends seeing that they’ve liked the page. A work around to this could be to create a community or group page instead that’s private. Then their friends would not see their membership status. What are your thoughts on that idea?

Leave a Reply

Please log in using one of these methods to post your comment: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s