Andrew Gordon studies the way that people narrate events in their lives. The computer scientist, who is based at the University of Southern California in Los Angeles, has a seemingly inexhaustible source of raw data for his experiments: blogs. And, although the authors of these blogs often obscure their identities, Gordon says that it is relatively easy to figure out who they are, by using information from photographs that they post or by looking up the registrant of the blog’s domain name.

Can Gordon use information from the blog posts freely? As the Internet has become an ever-more essential research tool, scientists and institutional review boards (IRBs) facing such questions have been frustrated by the muddiness of existing regulations.

Now, an advisory committee to the US Department of Health and Human Services (DHHS), which governs human-subjects research, has endorsed a 20-point set of recommendations that could help. But some scientists worry that the recommendations might place more areas of Internet research under the purview of IRBs, which have been attacked by their critics as capricious, overly cautious groups that add time, complexity and costs to studies (see A. Halavais Nature 480, 174–175; 2011).

Although the DHHS secretary has not officially endorsed the recommendations, administrators say it is already being used. “People are going to use this whether it gets blessed officially beyond this committee or not, because it is so urgently needed,” says Susan Rose, the University of Southern California’s executive director for the protection of research subjects.

In some instances, the new recommendations could help IRBs to be less cautious. For example, the document clarifies when investigators must verify the identities of research participants, an issue that has bedevilled IRBs. The guidelines suggest that, in a low-risk study such as an online survey, a check box, confirming that respondents are accurately representing themselves, could be sufficient. But for studies that could seriously impact person’s well-being — for instance, a clinical trial — researchers might need to obtain proof of age and identity, and require participants to pass a quiz to show that they understand the research.

There are places where individuals may have a reasonable expectation of privacy.

The guidelines also suggest that, in general, information on the Internet should be considered public, and thus not subject to IRB review — even if people falsely assume that the information is anonymous. Yet the guidelines complicate the issue by suggesting that IRB review might be needed if there are doubts about the work’s ‘beneficence’ — the idea that all research should be conducted with the welfare of its subjects in mind. For instance, a clinical-trial manager should not recruit patients from an online disease support group, says Elizabeth Buchanan, chair of the Center for Applied Ethics at the University of Wisconsin–Stout. “There are places where individuals may have a reasonable expectation of privacy based on the context of the site,” says Buchanan, a co-author of the guidelines.

Gordon’s work might, at first glance, seem to be exempt from IRB review, because he analyses public blogs accessible to anyone. But a closer read of the new recommendations suggests that Gordon does need to get IRB review. The bloggers he studies don’t realize that their identities are readily available, and they could be harmed if some of the details they discuss were to be publicly linked to them by researchers. “There’s a gap between the expectation and the reality of what can be done with technology, so it really complicates the issue of what is identifiable private information,” Gordon says.

Some worry that the guidelines may put entirely new areas of research under the purview of IRBs. The document briefly suggests that researchers’ Twitter streams and blogs might be subject to IRB review if they are used for patient recruitment. That bothers Don Dizon, an oncologist at Massachusetts General Hospital in Boston who has served on IRBs for nine years. “All of a sudden IRBs are not only protecting human research subjects, but they’re also policing their own investigators, which is not an efficient way to use time or money,” he says.