Data Privacy in Surveys: US Rules, Consent and Templates

Would you give a complete stranger on the street your age, your job and your health status? Probably only if you knew exactly who was asking and what would happen to the answers. That is what privacy in surveys comes down to.

Your survey is on solid ground when you know which of three regimes reaches you, the Common Rule through your review board, a state privacy law through your organization, or the GDPR through respondents in Europe, and when your first page says who you are, what you collect and when you delete it.

empirio.ai, an online survey tool from Germany, includes the data processing agreement in the free plan, which matters as soon as any of your respondents sit in Europe. The legal statements in this article were checked against the regulations and agency guidance they cite on November 3, 2026.

📌 The key points at a glance

• No single federal privacy law covers ordinary surveys.
• Student research is governed by your IRB, not by you.
• An IP address alone does not prove consent.
• The privacy notice belongs before every other question.
• With empirio.ai the data processing agreement is in the free plan.

This is what it looks like done properly: a dedicated privacy page with a consent checkbox, placed at the very start of your survey.

Which privacy rules actually apply to your survey?

Three questions settle it, and most people only need to answer one of them. Work through them in order before you write a single question, because the answer changes what your first page has to say.

The order matters because the obligations do not stack the way people expect. A graduate student and a marketing team at a mid-sized company face almost entirely different requirements, even when the questionnaire is identical.

For businesses, the California thresholds are the ones most often quoted, and they are higher than people assume. The CCPA applies to a for-profit business doing business in California that meets any one of three tests: gross annual revenue of $26,625,000 or more for the preceding calendar year, buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving 50 percent or more of annual revenue from selling or sharing that information. The California Privacy Protection Agency also states plainly that the CCPA does not generally apply to nonprofit organizations or government agencies.

California is not the only state, though. According to the International Association of Privacy Professionals, 19 states had enacted comprehensive privacy laws as of January 2026, and the thresholds differ. Rhode Island, for instance, reaches organizations handling data on more than 35,000 residents. Check the law of the state where your respondents live, not where you sit.

The third question is the one people forget. If any of your respondents are in the European Union or the United Kingdom, the GDPR reaches you regardless of where your organization is based, because it follows the people and not the company. A survey run from Chicago with a hundred respondents in Germany falls under it.

Personal information in surveys: what actually counts

Personal information is any data that identifies a particular person or could reasonably be linked to one. What matters is not the individual field but whether someone can be singled out through it. That qualifier is missing from most survey guides, which is why they produce long lists that confuse more than they help.

One example makes the difference clear. Age on its own is not identifying in a survey of 400 people. In a team of seven, the combination of age, gender and department can be more than enough to identify one person. Identifiability is not a property of the field, it emerges from the context.

The last row catches most people out. An open box asking for comments reliably produces sentences like “the problem is Sarah in accounting”. You have now collected personal information about someone who never took part in your survey at all. If you use open questions, ask in the field label for no names, and read the answers before you analyze them.

Sector rules can also reach a survey that looks harmless. Questions about health conditions in a clinical setting, or about students in a school context, can pull in federal rules written for those sectors. If your survey sits inside a hospital, a clinic or a school, ask the compliance office before you send it.

Which questions create real risk for your respondents

The most useful risk test in US survey practice is buried in the Common Rule, and it works even if your project has nothing to do with a university. It asks what would happen to your respondents if their answers got out.

Under 45 CFR 46.104(d)(2)(ii), survey research can be exempt from review where any disclosure of responses outside the research would not reasonably place subjects at risk of criminal or civil liability or be damaging to their financial standing, employability, educational advancement or reputation. Turn that around and you have a checklist of the five things that make a question genuinely risky.

The five categories worth pausing over

Criminal or civil liability covers questions about drug use, undocumented status, unreported income or workplace rule breaking. Financial standing covers debt and bankruptcy. Employability covers performance, discipline and job search. Educational advancement covers academic misconduct and grades. Reputation covers sexual behavior, mental health and relationships. If your survey touches any of these, the answers need to be separated from any identifier, and you should say so on the first page.

Sensitive is not the same as regulated

Plenty of questions feel sensitive without triggering any specific statute. Salary and family circumstances are ordinary personal information in law, even though people hesitate to answer them. That does not make them harmless. The risk to your respondents is real whether or not a law names it, and a good survey design treats it that way.

There is one further wrinkle for surveys involving minors. The exempt categories based on unidentifiable recording and low risk apply to research with children only for educational tests or observation of public behavior where the investigators do not take part, and the limited IRB review route is not available for research with children at all. Surveys of minors go to the review board.

Student research: when your survey needs IRB review

Whether your survey needs review by an Institutional Review Board is decided by your institution, not by you. The Common Rule at 45 CFR 46.101 applies to research involving human subjects that is conducted, supported or otherwise subject to regulation by a federal department or agency, and most universities extend that framework to research carried out under their name.

What surprises people is how often the answer is “review, but the light version”. Survey research has its own exempt category, and it is broad. Under 45 CFR 46.104(d)(2), research consisting only of survey procedures, interviews, educational tests or observation of public behavior is exempt if at least one of three conditions is met.

1. The responses are not identifiable. You record them so that the identity of subjects cannot readily be ascertained, directly or through linked identifiers.
2. Disclosure would not harm anyone. Any release of the responses outside the research would not reasonably place subjects at risk in the five categories above.
3. Limited IRB review. The data is identifiable and sensitive, but an IRB conducts a limited review of the privacy and confidentiality safeguards.

Only one of the three has to be true, which is why an anonymous survey of adults about ordinary topics usually lands in the exempt bucket. Exempt does not mean unregulated: the regulation states that exempt activities must still comply with the requirements of that section. And exempt is a determination your IRB makes, not one you make about your own project.

The practical consequence is a scheduling one. Submit for a determination before you build the questionnaire, not after, because a change of one question can move you between categories. If your questions touch the risk categories from the chapter above, expect to need the limited review route.

Informed consent: the checklist

Informed consent has to be obtained before you involve someone in research, and the Common Rule sets out what it contains. Even outside a research context the same list makes a good privacy notice, because it answers the questions respondents actually have. In the questionnaire itself, that notice belongs in the introduction, the first of the four components of a survey.

Two structural requirements are easy to miss. Consent must begin with a concise and focused presentation of the key information most likely to help someone decide whether to take part. And it may not contain exculpatory language through which a subject waives or appears to waive any legal rights. A line saying participants give up any claim against you does not simply fail, it invalidates the consent.

What the consent has to say

The Common Rule lists nine basic elements. Condensed for a survey, they come to this.

• That this is research, the purpose and the expected duration.
• What taking part involves, question by question if needed.
• Any reasonably foreseeable risks or discomforts.
• Any benefits to the participant or to others.
• How confidentiality of records will be maintained.
• Who to contact about the study and about participant rights.
• That participation is voluntary and can stop at any time without penalty.

The language requirement is not a formality either: the information given to the subject shall be in language understandable to the subject. If your consent page reads like a contract, it is not doing its job. Read it out loud to someone outside your field before you use it.

Two of the elements deserve a second thought in survey work. “Without penalty or loss of benefits” has to be true, which is a problem if you offer course credit or a prize drawing with strings attached. And the confidentiality statement should describe what you will actually do, not what you hope. If you cannot promise anonymity, say so plainly.

How to prove consent

Obtaining consent and documenting it are two separate requirements, and the second is the one that fails in practice. The Common Rule treats documentation as its own rule, and a review board can waive the signed form for minimal-risk survey research, so ask your board which route your project takes before you build the questionnaire.

What has to be provable either way is the specific consent statement each respondent saw, documented in full. Storing an IP address and asserting that the consent came from that address is not a record of consent, because it shows neither the wording nor the act. The German supervisory authorities reject that practice expressly in their guidance on consent (as of September 23, 2026), and that is the standard you work to the moment you survey respondents in the European Union.

For an online survey the fix is simple: the consent wording someone saw and the checkbox they set belong in the same record as their answer. Rebuild the notice as an ordinary text question and ask for the checkmark somewhere else, and you can no longer show which wording anybody agreed to. Where the GDPR reaches you, an invalid consent cannot be swapped for another legal footing after the event either; the German authorities treat switching between bases as a breach of fairness and transparency.

When minors take part in your survey

COPPA, the Children’s Online Privacy Protection Rule, reaches you if your online service is directed to children under 13, or if you have actual knowledge that you collect personal information from children under 13. In that case you need verifiable parental consent before you collect, use or disclose anything from the child (FTC: six-step COPPA compliance plan).

Two things sit alongside COPPA. Individual states have their own rules for data about minors and the thresholds differ, so check the law of the state your respondents live in rather than assuming one national line. And a survey of children run as research goes to the review board in any case. Whatever route applies, obtain the consent of the parents or guardians, clear a survey in a school with the school first, and write the questions in language the age group actually understands.

A consent and privacy notice: template to adapt

The template below works for a straightforward survey of adults on ordinary topics, run by a student, a club or a small team. Replace the square brackets and keep the rest. If your project is going to an IRB, use your institution’s template instead, because boards have their own required wording.

Keep it on the first page, before the first substantive question, and keep it short enough that people read it. The friendly part of that page, the greeting and why the survey matters to you, follows rules of its own, covered in our guide to the survey welcome message.

This survey is part of [research project or purpose], run by [name, email address]. It takes about [minutes] minutes and asks about [topics]. Taking part is voluntary, you can skip any question and stop at any time without penalty. We collect [fields]. We do not collect your name, email address or IP address. Answers are stored until [date] and then deleted, and results are reported only in aggregate. There are no known risks beyond those of everyday life. Questions about the study go to [contact]; questions about your rights as a participant go to [IRB or institution contact].

Two details are worth getting right. The retention date has to be a real date, because “as long as necessary” tells nobody anything and gives you no prompt to delete. And the sentence about what you do not collect must match the settings in your tool, or it becomes the most damaging line on the page.

Anonymous, de-identified or still identifiable?

Anonymous means the identity of respondents cannot readily be ascertained, directly or through identifiers linked to them. That is the standard the Common Rule uses for its first exempt condition, and it is a higher bar than most surveys clear by accident.

The trouble is what happens in the background. A survey with no name field that quietly logs IP addresses and asks for department is not anonymous, because the pieces together point at a person. Anything your tool records counts, whether you look at it or not. If you still need an email address for a prize drawing, ask for it after the last question and keep it apart from the answers, as our guide to the end-of-survey message shows.

De-identified sits in between and is regularly confused with anonymous. In a de-identified dataset the link back to a person still exists somewhere, usually as a code list held separately. That is a real safeguard and it is often the right design, but it is not anonymity, and any promise on your first page should say so.

For most small surveys genuine anonymity is achievable if you do three things together: collect no email address and require no login, turn off IP logging in the tool, and keep demographic questions coarse enough that no cell contains fewer than five people. How that works in practice is set out under anonymous surveys, and which demographic questions you can drop is a judgment of its own.

What the EU court said about pseudonymization

The Court of Justice of the European Union settled how far pseudonymization takes you on September 4, 2025 in Case C-413/23 P. The judgment reaches a US survey only through the GDPR, which means only when some of your respondents are in Europe. The case was not about a survey: it concerned comments an EU body had passed to a consultancy in pseudonymized form.

The core finding is worth knowing either way, because it lines up with the Common Rule test. Whether data is personal depends on what additional information the person holding it has. As long as you hold the code list, the answers stay identifiable in your hands. For a third party for whom re-identification is effectively ruled out, the same data can fall outside the definition. The Court also held that an opinion someone expressed is always personal data, without anyone having to examine its content first, which is the half of the judgment that matters for free-text answers.

One further point decides a practical question. The duty to inform is assessed from the position of the controller at the time of collection. You cannot leave the privacy notice off the first page on the grounds that you will de-identify later. At the moment the first answer arrives the data is identifiable, and that is exactly when the notice has to be on screen.

Whether you may log IP addresses

No single US rule declares an IP address personal information, but it behaves like one in every direction that matters. Under the Common Rule it is an identifier that can make a response readily ascertainable. The CCPA names an internet protocol address in its definition of personal information. Under the GDPR it is personal data, usually even when it is assigned dynamically.

Logging it is not forbidden, but it needs a purpose you can name, such as guarding against repeat submissions or automated answers. Two limits apply regardless. If you promise anonymity you must not log the IP address, or the promise is untrue. And an IP address is not a record of consent, however convenient that would be. If you cannot name a purpose for the address, switch the logging off before the first link goes out.

A survey is only anonymous when you could not restore the link yourself either.

How to spot a privacy-respecting survey tool

You cannot tell a privacy-respecting survey tool from the promise on its homepage. Five checks will tell you. The moment you use a tool, the provider holds your respondents’ answers on your behalf, and if something goes wrong the people who trusted you will come to you and not to the vendor.

The first check is the contract. Ask whether the provider signs a data processing agreement and whether it is included in your plan or gated behind an upgrade. With several providers it depends on the tier, and the overview of what Google Forms can and cannot do walks through one example. If any of your respondents are in Europe, that agreement is a legal requirement rather than a nice-to-have.

As of November 2026; provider terms change.

What a data processing agreement has to contain

The agreement is not a formality but a list of duties, and where the GDPR reaches your survey, Article 28(3) is fairly precise about which. It fixes the subject matter, the duration, the nature and purpose of the processing, the type of personal data and the categories of data subject. It then binds the provider to your instructions, commits it to confidentiality and to the security measures in Article 32, settles how it helps you with access and deletion requests, and says what happens to the data at the end, return or deletion.

Three points get overlooked. The agreement has to be in writing, which may be an electronic format, so a confirmation inside your account is enough. Under Article 28(2) the provider may only engage sub-processors with your prior authorization, and it has to tell you about a change in advance so that you can object. Every one of those sub-processors has to carry the same duties the provider took on toward you.

That list is useful for a purely domestic survey too, because it is what you would want to know about a vendor anyway. And if a provider processes the data for its own purposes against your instructions, Article 28(10) makes it a controller for that processing and it carries the consequences itself.

Why the label “GDPR compliant” on its own says nothing

Almost every provider writes somewhere on its site that it is GDPR compliant, and US providers do it as readily as European ones. That is a self-declaration and not evidence. No regulator issues a compliance certificate for a piece of software. Article 42 of the GDPR does provide for certification, but it is voluntary, it covers a defined processing operation, and it is not the same thing as a general badge on a homepage.

What you can check is what sits in the table above, and in this order. Is the data processing agreement available on exactly the plan you intend to use, and can you get at it yourself? Does the provider name the place of processing or only the place of storage? Is the list of sub-processors public? Can IP logging be switched off? Can you delete responses yourself?

Five questions, and a provider either answers all five with a link to a document or does not answer at all. That is the difference between a commitment and a marketing line. Which providers meet which of these points is compared in the overview of survey tools.

Where data is processed: storage is not processing

Processing location deserves a closer look, because the claims often promise less than they appear to. Some providers guarantee a data region only for data at rest, not for the processing itself and not for support access, and often only from a certain tier upwards. Access from another country is a transfer in data protection terms, even when the hard drive sits in Virginia.

That distinction decides two things for you. If your consent page promises respondents that their answers stay in a named region, the promise has to cover the processing and the support access, not only the storage. And where respondents in Europe are involved, moving the data out of the EU needs its own legal footing, which for a US provider usually means certification under the EU-U.S. Data Privacy Framework.

As a rule of thumb: if your questions touch the five risk categories from the Common Rule, or you survey employees, choose a tool that lets you turn off IP logging and tells you where processing happens. If any of your respondents are in Europe, a European survey tool that processes in the EU is the simpler choice. For a date poll among friends, any tool will do.

How to build a privacy-first survey with empirio.ai

In empirio.ai the privacy page is its own page type rather than a text block you assemble yourself. Anyone who wants to create a free online survey adds it in the editor and decides where in the survey it sits. The consent checkbox comes with that page, and the page in the image above is exactly what it produces.

The difference from a home-made version is that the text and the checkbox belong together. If you rebuild the notice as an ordinary text question, you have to ask for the consent separately and make it required separately, and that is where the gaps appear.

Four steps and the consent part of your survey is done.

1. Add the privacy page. Pick it as its own page type in the editor and move it to the front. You need a free account for that.
2. Adapt the text. Paste the template from the chapter above and replace the square brackets.
3. Label the checkbox. The wording next to the box is yours, for example “I have read the information and agree to take part”.
4. Make it required. Without the checkmark nobody proceeds, and the consent is stored alongside the response.

For multilingual surveys the checkbox wording can be stored per language as well. Consent someone confirms in English while answering the questionnaire in Spanish is not informed consent in any meaningful sense, and the Common Rule requires language understandable to the subject.

That covers three of the five checks from the chapter before: the data processing agreement is there in the free plan, the processing happens in the EU, and the privacy page with its consent checkbox is its own page type instead of a construction of your own. How empirio.ai handles privacy in detail is set out in our post on GDPR-compliant surveys with empirio.ai. What no tool takes off your hands is the determination that comes first: whether your project needs IRB review and which category it falls into. No software can decide that for you.

Data privacy in surveys: the four common mistakes

The four mistakes below turn up again and again in surveys run by students, clubs and small teams. All four can be fixed before you send the link.

What they have in common is that they do not come from carelessness but from an assumption that sounds perfectly reasonable. That is exactly why they survive a proofread.

Anonymity is promised but never delivered

“This survey is completely anonymous” sits in the invitation while the tool logs IP addresses and the form asks for department, age and gender. The promise is untrue, and in a small group it is demonstrably untrue. Check the settings in the tool before you use the word anonymous.

The IRB is asked after the fact

Data collected before an exempt determination is data you may not be able to use, and no amount of good intentions fixes that afterward. Submit first, collect second. If your questionnaire changes materially, tell the board.

More is collected than will ever be analyzed

Asking for a full date of birth when you will report in age bands adds risk and adds nothing. Every extra identifying field shrinks the group a single person disappears into. Cut every field for which you cannot name the analysis you plan to run.

The retention date is missing

“Data is kept as long as necessary” gives your respondents nothing and gives you no prompt. A concrete date is the simplest answer, and it forces you to actually delete afterward. Put it in your calendar the day you launch.

Sources and further reading

The statements in this article rest on the regulations themselves and on guidance published by the responsible agencies. Where a survey reaches respondents in Europe, a judgment of the Court of Justice of the European Union and the German supervisory authorities’ guidance come into it as well. All of them are freely available.

• Electronic Code of Federal Regulations: 45 CFR 46.104, Exempt research.
• Electronic Code of Federal Regulations: 45 CFR 46.116, General requirements for informed consent.
• Federal Trade Commission: Children’s Online Privacy Protection Rule, a six-step compliance plan, on children under 13, checked November 3, 2026.
• California Privacy Protection Agency: Frequently Asked Questions on who the CCPA covers.
• California Privacy Protection Agency: Updated Monetary Thresholds in CCPA, effective January 1, 2025.
• Court of Justice of the European Union, judgment of September 4, 2025, Case C-413/23 P (European Data Protection Supervisor v Single Resolution Board), on when pseudonymized data is personal data.
• Datenschutzkonferenz (2026): Kurzpapier Nr. 20 on consent under the GDPR, as of September 23, 2026. This is the German supervisory authorities’ guidance and it applies to respondents in the European Union, not in the United States.
• Datenschutzkonferenz (2018): Kurzpapier Nr. 13 on processing under Article 28 GDPR, as of December 17, 2018, also the German supervisory authorities’ guidance.

One caveat worth knowing. The California revenue threshold is adjusted for inflation in every odd-numbered year, so the figure quoted here is due for revision on January 1, 2027. State privacy laws are also still being passed; the count of 19 states comes from the International Association of Privacy Professionals as of January 2026. Check both before you rely on them.

Conclusion

Privacy in US surveys looks confusing because there is no single rulebook, but the practical answer is short. Work out which of the three regimes reaches you, ask only for what you will analyze, put a readable consent page at the front and use a tool whose settings match what that page promises. For most student and small-team surveys, the safest route is the one where no identifying data is collected at all.

Where to go next

• Want to improve the survey itself? 8 tips for a successful online survey
• Need real anonymity? Creating an anonymous survey
• Writing a thesis? Surveys for a bachelor’s or master’s thesis

Ready to launch without patching the privacy part afterward?

empirio.ai brings the privacy page as its own page type and includes the data processing agreement in the free plan.

Create a free account