Data Privacy in Surveys: US Rules, Consent and Templates

Would you give a complete stranger on the street your age, your job and your health status? Probably only if you knew exactly who was asking and what would happen to the answers. That is what privacy in surveys comes down to.

The United States has no single privacy law covering surveys, which is why generic advice gets it wrong so often. Three separate questions decide what reaches you: whether your project counts as human subjects research, whether your organization crosses a state law threshold, and whether any of your respondents sit in Europe. For this article we checked the requirements against the Common Rule in the eCFR and the guidance published by the California Privacy Protection Agency.

📌 The key points at a glance

• No single federal privacy law covers ordinary surveys.
• Student research is governed by the IRB, not by you.
• Most survey research qualifies as exempt under 45 CFR 46.104.
• The CCPA does not generally apply to nonprofits.
• The privacy notice belongs before every other question.

This is what it looks like done properly: a dedicated privacy page with a consent checkbox, placed at the very start of your survey.

Which privacy rules actually apply to your survey?

Three questions settle it, and most people only need to answer one of them. Work through them in order before you write a single question, because the answer changes what your first page has to say.

The order matters because the obligations do not stack the way people expect. A graduate student and a marketing team at a mid-sized company face almost entirely different requirements, even when the questionnaire is identical.

For businesses, the California thresholds are the ones most often quoted, and they are higher than people assume. The CCPA applies to a for-profit business doing business in California that meets any one of three tests: gross annual revenue of $26,625,000 or more for the preceding calendar year, buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving 50 percent or more of annual revenue from selling or sharing that information. The California Privacy Protection Agency also states plainly that the CCPA does not generally apply to nonprofit organizations or government agencies.

California is not the only state, though. According to the International Association of Privacy Professionals, 19 states had enacted comprehensive privacy laws as of January 2026, and the thresholds differ. Rhode Island, for instance, reaches organizations handling data on more than 35,000 residents. Check the law of the state where your respondents live, not where you sit.

The third question is the one people forget. If any of your respondents are in the European Union or the United Kingdom, the GDPR reaches you regardless of where your organization is based, because it follows the people and not the company. A survey run from Chicago with a hundred respondents in Germany falls under it.

Personal information in surveys: what actually counts

Personal information is any data that identifies a particular person or could reasonably be linked to one. What matters is not the individual field but whether someone can be singled out through it. That qualifier is missing from most survey guides, which is why they produce long lists that confuse more than they help.

One example makes the difference clear. Age on its own is not identifying in a survey of 400 people. In a team of seven, the combination of age, gender and department can be more than enough to identify one person. Identifiability is not a property of the field, it emerges from the context.

The last row catches most people out. An open box asking for comments reliably produces sentences like “the problem is Sarah in accounting”. You have now collected personal information about someone who never took part in your survey at all. If you use open questions, ask in the field label for no names, and read the answers before you analyze them.

Sector rules can also reach a survey that looks harmless. Questions about health conditions in a clinical setting, or about students in a school context, can pull in federal rules written for those sectors. If your survey sits inside a hospital, a clinic or a school, ask the compliance office before you send it.

Which questions create real risk for your respondents

The most useful risk test in US survey practice is buried in the Common Rule, and it works even if your project has nothing to do with a university. It asks what would happen to your respondents if their answers got out.

Under 45 CFR 46.104(d)(2)(ii), survey research can be exempt from review where any disclosure of responses outside the research would not reasonably place subjects at risk of criminal or civil liability or be damaging to their financial standing, employability, educational advancement or reputation. Turn that around and you have a checklist of the five things that make a question genuinely risky.

The five categories worth pausing over

Criminal or civil liability covers questions about drug use, undocumented status, unreported income or workplace rule breaking. Financial standing covers debt and bankruptcy. Employability covers performance, discipline and job search. Educational advancement covers academic misconduct and grades. Reputation covers sexual behavior, mental health and relationships. If your survey touches any of these, the answers need to be separated from any identifier, and you should say so on the first page.

Sensitive is not the same as regulated

Plenty of questions feel sensitive without triggering any specific statute. Salary and family circumstances are ordinary personal information in law, even though people hesitate to answer them. That does not make them harmless. The risk to your respondents is real whether or not a law names it, and a good survey design treats it that way.

There is one further wrinkle for surveys involving minors. The exempt categories based on unidentifiable recording and low risk apply to research with children only for educational tests or observation of public behavior where the investigators do not take part, and the limited IRB review route is not available for research with children at all. Surveys of minors go to the review board.

Student research: when your survey needs IRB review

Whether your survey needs review by an Institutional Review Board is decided by your institution, not by you. The Common Rule at 45 CFR 46.101 applies to research involving human subjects that is conducted, supported or otherwise subject to regulation by a federal department or agency, and most universities extend that framework to research carried out under their name.

What surprises people is how often the answer is “review, but the light version”. Survey research has its own exempt category, and it is broad. Under 45 CFR 46.104(d)(2), research consisting only of survey procedures, interviews, educational tests or observation of public behavior is exempt if at least one of three conditions is met.

1. The responses are not identifiable. You record them so that the identity of subjects cannot readily be ascertained, directly or through linked identifiers.
2. Disclosure would not harm anyone. Any release of the responses outside the research would not reasonably place subjects at risk in the five categories above.
3. Limited IRB review. The data is identifiable and sensitive, but an IRB conducts a limited review of the privacy and confidentiality safeguards.

Only one of the three has to be true, which is why an anonymous survey of adults about ordinary topics usually lands in the exempt bucket. Exempt does not mean unregulated: the regulation states that exempt activities must still comply with the requirements of that section. And exempt is a determination your IRB makes, not one you make about your own project.

The practical consequence is a scheduling one. Submit for a determination before you build the questionnaire, not after, because a change of one question can move you between categories. If your questions touch the risk categories from the chapter above, expect to need the limited review route.

Informed consent: the checklist

Informed consent has to be obtained before you involve someone in research, and the Common Rule sets out what it contains. Even outside a research context the same list makes a good privacy notice, because it answers the questions respondents actually have.

Two structural requirements are easy to miss. Consent must begin with a concise and focused presentation of the key information most likely to help someone decide whether to take part. And it may not contain exculpatory language through which a subject waives or appears to waive any legal rights. A line saying participants give up any claim against you does not simply fail, it invalidates the consent.

What the consent has to say

The Common Rule lists nine basic elements. Condensed for a survey, they come to this.

• That this is research, the purpose and the expected duration.
• What taking part involves, question by question if needed.
• Any reasonably foreseeable risks or discomforts.
• Any benefits to the participant or to others.
• How confidentiality of records will be maintained.
• Who to contact about the study and about participant rights.
• That participation is voluntary and can stop at any time without penalty.

The language requirement is not a formality either: the information given to the subject shall be in language understandable to the subject. If your consent page reads like a contract, it is not doing its job. Read it out loud to someone outside your field before you use it.

Two of the elements deserve a second thought in survey work. “Without penalty or loss of benefits” has to be true, which is a problem if you offer course credit or a prize draw with strings attached. And the confidentiality statement should describe what you will actually do, not what you hope. If you cannot promise anonymity, say so plainly.

A consent and privacy notice: template to adapt

The template below works for a straightforward survey of adults on ordinary topics, run by a student, a club or a small team. Replace the square brackets and keep the rest. If your project is going to an IRB, use your institution’s template instead, because boards have their own required wording.

Keep it on the first page, before the first substantive question, and keep it short enough that people read it.

This survey is part of [research project or purpose], run by [name, email address]. It takes about [minutes] minutes and asks about [topics]. Taking part is voluntary, you can skip any question and stop at any time without penalty. We collect [fields]. We do not collect your name, email address or IP address. Answers are stored until [date] and then deleted, and results are reported only in aggregate. There are no known risks beyond those of everyday life. Questions about the study go to [contact]; questions about your rights as a participant go to [IRB or institution contact].

Two details are worth getting right. The retention date has to be a real date, because “as long as necessary” tells nobody anything and gives you no prompt to delete. And the sentence about what you do not collect must match the settings in your tool, or it becomes the most damaging line on the page.

💡 Tip

Tie the retention date to the end of your project, not the end of the semester. “Until the thesis defense concludes, and no later than March 31, 2027” is a date you can still honor if your submission slips by a few weeks.

Anonymous, de-identified or still identifiable?

Anonymous means the identity of respondents cannot readily be ascertained, directly or through identifiers linked to them. That is the standard the Common Rule uses for its first exempt condition, and it is a higher bar than most surveys clear by accident.

The trouble is what happens in the background. A survey with no name field that quietly logs IP addresses and asks for department is not anonymous, because the pieces together point at a person. Anything your tool records counts, whether you look at it or not.

De-identified sits in between and is regularly confused with anonymous. In a de-identified dataset the link back to a person still exists somewhere, usually as a code list held separately. That is a real safeguard and it is often the right design, but it is not anonymity, and any promise on your first page should say so.

For most small surveys genuine anonymity is achievable if you do three things together: collect no email address and require no login, turn off IP logging in the tool, and keep demographic questions coarse enough that no cell contains fewer than five people. How that works in practice is set out under anonymous surveys, and which demographic questions you can drop is a judgment of its own.

A survey is only anonymous when you could not restore the link yourself either.

How to spot a privacy-respecting survey tool

You cannot tell a privacy-respecting survey tool from the promise on its homepage. Five checks will tell you. The moment you use a tool, the provider holds your respondents’ answers on your behalf, and if something goes wrong the people who trusted you will come to you and not to the vendor.

The first check is the contract. Ask whether the provider signs a data processing agreement and whether it is included in your plan or gated behind an upgrade. With several providers it depends on the tier: Google offers one for Google Forms only through a paid Workspace account, not through a personal account. If you are handling responses from Europe, that contract is a legal requirement rather than a nice-to-have.

As of August 2026; provider terms change.

Processing location deserves a closer look, because the claims often promise less than they appear to. Some providers guarantee a data region only for data at rest, not for processing or support access. As a rule of thumb: if your questions touch the risk categories above, or you survey employees, choose a tool that lets you turn off IP logging and tells you where processing happens. For a date poll among friends, any tool will do.

Which providers meet which of these points is compared in the overview of survey tools.

How to build a privacy-first survey with empirio.ai

In empirio.ai, an online survey tool from Germany, the privacy page is its own page type rather than a text block you assemble yourself. You add it in the editor and decide where in the survey it sits. The consent checkbox comes with it, and the page in the image above is exactly what it produces.

The difference from a home-made version is that the text and the checkbox belong together. If you rebuild the notice as an ordinary text question, you have to ask for the consent separately and make it required separately, and that is where the gaps appear.

Four steps and the consent part of your survey is done.

1. Add the privacy page. Pick it as its own page type in the editor and move it to the front.
2. Adapt the text. Paste the template from the chapter above and replace the square brackets.
3. Label the checkbox. The wording next to the box is yours, for example “I have read the information and agree to take part”.
4. Make it required. Without the checkmark nobody proceeds, and the consent is stored alongside the response.

⚠️ Watch out

You choose where the privacy page sits, and that is exactly where people trip up. Put it before every other question. The Common Rule requires consent before involving a subject in research, and a page at the end of the questionnaire arrives after you already collected the answers.

For multilingual surveys the checkbox wording can be stored per language as well. Consent someone confirms in English while answering the questionnaire in Spanish is not informed consent in any meaningful sense, and the Common Rule requires language understandable to the subject.

Taken together this covers the five checks from the chapter before: a processing agreement, a named processing region, optional extra data you can switch off, an export you can delete from, and a consent page that travels with the questionnaire. What it does not do is make the determination that comes first: whether your project needs IRB review and which category it falls into. No tool can decide that for you.

Common privacy mistakes in surveys

The four mistakes below turn up again and again in surveys run by students, clubs and small teams. All four can be fixed before you send the link.

What they have in common is that they do not come from carelessness but from an assumption that sounds perfectly reasonable. That is exactly why they survive a proofread.

Anonymity is promised but never delivered

“This survey is completely anonymous” sits in the invitation while the tool logs IP addresses and the form asks for department, age and gender. The promise is untrue, and in a small group it is demonstrably untrue. Check the settings in the tool before you use the word anonymous.

The IRB is asked after the fact

Data collected before an exempt determination is data you may not be able to use, and no amount of good intentions fixes that afterward. Submit first, collect second. If your questionnaire changes materially, tell the board.

More is collected than will ever be analyzed

Asking for a full date of birth when you will report in age bands adds risk and adds nothing. Every extra identifying field shrinks the group a single person disappears into. Cut every field for which you cannot name the analysis you plan to run.

The retention date is missing

“Data is kept as long as necessary” gives your respondents nothing and gives you no prompt. A concrete date is the simplest answer, and it forces you to actually delete afterward. Put it in your calendar the day you launch.

Sources and further reading

The statements in this article rest on the regulations themselves and on guidance published by the responsible agencies. All of them are freely available.

• Electronic Code of Federal Regulations: 45 CFR 46.104, Exempt research.
• Electronic Code of Federal Regulations: 45 CFR 46.116, General requirements for informed consent.
• California Privacy Protection Agency: Frequently Asked Questions on who the CCPA covers.
• California Privacy Protection Agency: Updated Monetary Thresholds in CCPA, effective January 1, 2025.

One caveat worth knowing. The California revenue threshold is adjusted for inflation in every odd-numbered year, so the figure quoted here is due for revision on January 1, 2027. State privacy laws are also still being passed; the count of 19 states comes from the International Association of Privacy Professionals as of January 2026. Check both before you rely on them.

Conclusion

Privacy in US surveys looks confusing because there is no single rulebook, but the practical answer is short. Work out which of the three questions reaches you, ask only for what you will analyze, put a readable consent page at the front and use a tool whose settings match what that page promises. For most student and small-team surveys, the safest route is the one where no identifying data is collected at all.

Where to go next

• Want to improve the survey itself? 8 tips for a successful online survey
• Need real anonymity? Creating an anonymous survey
• Writing a thesis? Surveys for a bachelor’s or master’s thesis

Ready to launch without patching the privacy part afterward?

empirio.ai, an online survey tool from Germany, brings the privacy page as its own page type and lets you turn off IP logging.

See the privacy-first survey tool