When Facebook launched its $100-billion initial public offering last month, it also surpassed 980 million users across the planet. In other words, nearly one in seven of the world's population is comfortable sharing personal data over the internet. In contrast, it seems we are more circumspect when it comes to sharing genetic, physiological and medical information online. In January, Google announced its Google Health product for managing personal health and wellness data was shutting for lack of users. One key reason for poor uptake is there is still no simple and transparent way to track how personal data are being used, let alone a means to opt into, or out of, research using the data.

Starting this month, however, a new type of consent process, termed the Portable Legal Consent (PLC), will allow just that. The PLC aims, by simplifying informed consent and perhaps by allowing feedback of results to any participants, not only to give individuals greater control over their personal data but also to accelerate the pace of biomedical research progress.

Informed consent processes are in need of overhaul. In the United States, informed consent is based on a uniform 20-year-old, almost-pre-internet set of regulations, colloquially known as the 'Common Rule'. Under the Common Rule, the patient's signature on the consent form following an 'informing' conversation creates a legal agreement that allows research (or medical procedures) to go ahead. The scope of research depends on the consent form; in some cases, biological specimens and associated data can be used only in the research described in the original consent. Alternatively, consent can be broader, extending to future research, within or without some limits.

This still leads to problems. First, patients usually learn nothing of the research outcomes from their specimens or data, particularly if the results are never published. Furthermore, 'specific informed consent' is what is sought and obtained most often from patients in clinical and research studies. Most donations of tissue and data can be used only once, in the original research project. Any subsequent analysis, reanalysis or pooling with other data is breaking the law.

But genome-wide association studies would benefit from broader consent. In mid-May, work published in Science (published online, doi:10.1126/science.1217876, 17 May 2012) suggested >95% of genome variants predicted to be of medical or biological importance are rare variants. Thus, pooling patient data, and its meta-analysis and reanalysis, have never been more important. What's more, patients now create their own data, with direct-to-consumer genetic tests or personal biometric devices tracking blood glucose, exercise or sleep.

The PLC (http://weconsent.us) provides a solution by permitting research participants to contribute their data to a common consented environment enabling broad and multiple research uses. Importantly, patients can withdraw their data from the database at any time. The withdrawal does not operate retrospectively, so derivatives of the data, or even copies of it held on computer drives, are likely to remain available. Publications based on their data would also be unaffected by data withdrawal.

In this open environment, it is imperative that people understand the benefits and risks of sharing data. Under the PLC, donors must complete a detailed informed consent process online—including a six-and-a-half-minute explanatory video that cannot be fast forwarded—before they can upload any data.

In its first iteration, the common consented research environment will be 'Synapse', an interface developed by the nonprofit Sage Bionetworks. Researchers accessing the de-identified data through Synapse are bound not only to respect the confidentiality of the research subjects and their data but also to ensure the accessibility of published results.

Until some fundamental concerns about genetic privacy are addressed in legislation, however, it seems likely that only a small fraction of the population will use the PLC. In the United States, the federal Genomic Information Nondiscrimination Act of 2008 and several state bills, including those in California, South Dakota, Alabama, Massachusetts and Vermont, attempt to define genetic data as personal property. A European Union draft regulation would also tighten privacy rules and give subjects much more control over use of their data.

Even with those safeguards in place, further incentives will be needed. One suggestion that reaches beyond altruism might be to provide donors with improved medical information. Ideally, donors would benefit by learning about discoveries made using their data—a suggestion put forward in March by a US National Institutes of Health working group (Genet. Med. 14, 361–384, 2012). The question here, however, is at what stage should a patient be informed? Many think this should happen only once a disease risk associated with a variant has been clinically validated—currently a tall order, given the paucity of associations linking data to medical actions.

Another approach would be to reach out to people who have a vested interest in the success of the project. Thus, many rare-disease advocacy groups already believe that genetic and association studies represent a useful means of advancing scientific understanding of their conditions and mitigating bad behavior by researchers who sequester data or fail to share materials widely. People with undiagnosed 'mystery conditions' might be another group that may be motivated to join an open research environment. Finally, lots of individuals already share medical and personal data on the internet; indeed, moves are already afoot to forge links with groups such as PatientsLikeMe, which has 150,000 users.

Thus, the PLC is a key step in enabling the emergence of new types of open research environments. The fact that Facebook has been so successful should perhaps fuel optimism for its success. If researchers can build a system like Facebook that accommodates both personal data and personal choices about that data, then perhaps the patients will come.