Informed consent

You launch a survey. The form asks for email, age, gender, a couple of open-ended questions about work. Seems harmless. But without informed consent you may be violating personal-data law, and your data may be legally unusable.

Informed consent is not a formality. It is a procedure that simultaneously protects the respondent and makes your data legitimate. A properly drafted consent takes a minute and closes most of the legal risk.

Definition

Informed Consent is a procedure in which, before taking part in a study, the respondent receives full information about its goals, methods, data use, risks, and their rights, and then explicitly agrees to participate. It is a mandatory requirement of research ethics and of personal data legislation in most jurisdictions (such as GDPR in the EU). Without informed consent, a respondent's data formally cannot be used for purposes that were not explicitly stated.

Elements of proper informed consent

The consent should include specific information presented in a clear form:

Purpose of the study. Why the data is being collected, what problem you are solving, how it will help (the company, customers, society). General wording such as "to improve the service" is acceptable, but specifics work better: "we want to understand which app features need improvement".

What data is collected. A list of categories: email, name, demographics, answers to questions, technical metadata. If sensitive data is collected (health, political views, finances), this must be stated separately with an explanation of why.

How the data will be used. For internal analysis, for sharing with partners, for publications. Stating the purposes explicitly protects both you (you may only use the data for the stated purposes) and the respondent.

Retention period. How long the data will be stored and when it is deleted. The standard is to state a specific period or a deletion condition ("until the processing purposes are met").

Respondent's rights. The right to withdraw consent, request their data, demand deletion, obtain a copy. A contact through which these rights can be exercised.

Voluntary participation. An explicit statement that participation is voluntary and that refusal carries no consequences. This is especially important in corporate surveys, where employees may be afraid to decline.

Anonymity or identifiability. Whether the survey is anonymous or the data is tied to an identity. This is part of the respondent's basic trust.

How to set up consent in an online survey

Option 1: a separate screen at the start of the survey. Before the first question, a screen with the consent text and an "I agree" checkbox. You cannot continue without confirmation. Suitable for serious studies with sensitive data.

Option 2: a short block with a link to the full text. On the first screen, 2-3 sentences about the essentials with a link "More about how your data is used". A checkbox with basic consent. A compromise between thoroughness and respondent convenience.

Option 3: a banner on every page. For embedded widgets, a small block with short text and consent before the first answer. Not ideal for research, but it meets basic requirements.

The key principle: consent must be an explicit action (a checkbox, an "I agree" button), not the default. Pre-checked boxes and "continuing means consent" are unacceptable under GDPR and problematic under many data-protection laws.

Example: an informed consent block for a customer survey

An example consent text for a customer satisfaction survey of an online store:

Before taking part in the survey

We are conducting a study to improve the quality of our service. The survey takes about 5 minutes and includes questions about your last order and your overall experience with the store.

What data we collect: your answers to the survey questions, the date and time of completion, technical information (device type). Your email and order number are taken automatically from our system.

How we use the data: to analyze customer satisfaction and improve the service. The data is not shared with third parties without your explicit consent.

Retention period: 2 years from the date the survey is completed, after which the data is deleted.

Your rights: you can withdraw consent at any time, request a copy of your data or its deletion by writing to [email protected]

Participation is voluntary. Declining to take the survey will not affect your relationship with the store in any way.

☐ I have read the terms and agree to take part in the survey

Common mistakes

Legal text that is too long. A wall of text spanning 3 screens that nobody reads formally satisfies the legal requirements but fails the ethical function. The respondent does not consent consciously but mechanically ticks the box. Better: a short, clear block with a link to the full text for those who want details.

Pre-checked boxes. Consent by default violates GDPR and is problematic under many data-protection laws. The checkbox must be empty, with the respondent actively ticking it.

A single consent for different purposes. "I agree to take part in the survey, receive marketing newsletters, and have my data shared with partners" bundles heterogeneous permissions into one checkbox. Each data-processing purpose should have separate consent.

Ignoring the "right to be forgotten". If a respondent wants their data deleted, you must have a procedure for it. You can only say "we can't, the data is already anonymized" if it really is irreversibly anonymized from the very start.

Failing to account for children. For respondents under 14-18 years old (the exact age depends on the jurisdiction) parental consent is required. For surveys without a targeting restriction to adults, you need age verification or a special consent procedure.

Informed consent and anonymous surveys

Even in anonymous surveys, informed consent is useful: it increases trust and transparency. But the legal requirements are softer: if the data is truly anonymous (it does not contain and does not allow identifying a person), personal data legislation formally does not apply. Even so, even in anonymous surveys it is worth stating the purpose of the study, how the data will be used, and the right to stop participating.

The line between "anonymous" and "de facto identifiable" is blurry. If a survey has 3 demographic questions within a small group, the data is technically anonymous but in practice lets you pinpoint a specific person. In such cases you need full informed consent that states this risk.

Informed consent in SurveyNinja

In SurveyNinja you can set up an informed consent block in several ways: through a welcome screen with a mandatory consent checkbox before the survey starts, through a separate question with required confirmation, or through a standard personal-data processing consent block. For embedded surveys and long studies it is convenient to use a separate screen with the full text at the start, and a brief reminder of the option to stop participating on the following screens.

Informed consent is not bureaucratic red tape but a tool for data protection and trust. A properly drafted consent takes the respondent 30-60 seconds, closes most of the legal risk, and improves data quality (people who understand the purpose answer more honestly). Key elements: purpose, data, use, timelines, rights, voluntariness. An explicit checkbox without pre-checking is a mandatory requirement of modern legislation.

Frequently asked questions

Is informed consent needed for short surveys without personal data?

Even for anonymous surveys it is useful to briefly inform respondents about the purpose of the study, since this increases trust and the honesty of answers. Full informed consent with a checkbox is needed if personal data is collected (email, name, contacts) or data that, taken together, can identify a person. An anonymous 3-question survey without email can get by with a short explanation and no checkbox.

Can you collect answers if the respondent declined consent?

No. Without consent, data processing is formally unlawful. In a survey this is implemented technically: without ticking the consent box the user cannot proceed to the questions. The exceptions are cases where processing is permitted on another legal basis (a contract, a legal requirement), but for ordinary surveys this is a rare situation.

What to do if a respondent withdrew consent after completing the survey?

Delete their data from all systems where it is stored within a reasonable period (30 days under GDPR). If the data has already been used in an aggregated, anonymized form (for example, in a report of averages), the individual records are deleted but the aggregate remains. The withdrawal procedure must be written down and implemented before surveys are launched.

Is separate consent needed for international data transfers?

Yes, if the data is transferred to countries with less strict legislation. Under GDPR, an explicit notice of transfer to third countries and a legal basis (for example, Standard Contractual Clauses) are required. When using cloud survey platforms, check where the data is physically stored.

Is informed consent needed for corporate employee surveys?

Yes, even for internal surveys. Employees are a separate category of personal data subjects, for whom voluntary participation matters. The wording "participation is voluntary, refusal will not affect your work" is mandatory. For anonymous HR surveys consent is handled more simply, but the very fact of informing respondents about the purpose and use of the data must be present.