Ethics of netnography on contemporary platforms: a systematic review of consent, privacy, traceability and AI-assisted analysis practices

Search and study selection

Four databases were searched for the primary identification: Scopus, Web of Science, OpenAlex and Semantic Scholar. Eight concept-block queries combined method-tradition terms (netnography, digital ethnography, online ethnography, virtual ethnography, digital anthropology, online fieldwork) with ethics, consent, privacy, traceability, platform visibility, vulnerability and AI-automation blocks.

After deduplication, 677 records were screened at title and abstract, 449 were excluded at that stage, and 11 remained uncertain after a second pass. Two hundred and seventeen reports were sought for retrieval; 170 could not be obtained, most commonly because no open-access or otherwise obtainable full-text copy was available through the retrieval infrastructure, leaving 47 reports assessed for eligibility. Ten were excluded at full text and six remained uncertain after the first full-text assessment. All six uncertain reports were then resolved to exclusion on adjudication, because in each case the ethical content amounted to a boilerplate approval statement or fell outside the scope of reported ethical decision-making; no uncertain report was carried into the synthesis, so the final included set is 31 studies. All 31 were appraised from full text.

Appraisal, extraction and synthesis

Synthesis was organised by research subquestion rather than by theme list. Reported practices were coded first descriptively (consent architecture, visibility judgement, anonymisation techniques, vulnerability safeguards, participation mode, storage and platform handling, automation) and then mapped onto six analytic dimensions derived from the protocol: platform visibility and architecture; contextual integrity and context collapse; consent models; traceability and identifiability; vulnerability and power; and researcher positionality, participation and analytical technology.

Because every included study was qualitative, conceptual or methodological, no effect estimates were pooled and no quantitative meta-analysis was performed; where studies reported proportional findings from their own case material, these are attributed to the study rather than treated as pooled prevalence. The framework reported at the end of Results was constructed by comparing practices across these dimensions and should be read as an interpretive synthesis of reported decisions, not as an evaluation of their effectiveness.

How consent, visibility and privacy are resolved in public, semi-public and private spaces

The dominant answer to the consent question is that consent is treated as a process, a negotiation or a context-dependent judgement rather than a single transactional event, and that visibility is treated as a graded property of a setting rather than a binary classification.

The clearest statement of the graded view comes from a digital ethnography of QAnon communities that argues public and private should be conceptualised as a spectrum defined by barriers to access: the broader the audience able to reach content, the further it falls on the public side, and the more barriers to entry, the further on the private side, with platforms themselves signalling different levels of privacy through group labels, searchability settings and administrator-screened admission questionnaires.(21)

This reasoning recurs across the corpus. Consent feasibility is reported to depend on group nature, function and size, interaction volume and speed, member turnover, participant anonymity, publicness, topic sensitivity, intended audience and intended data use, so that obtaining consent from every member becomes practically impossible in large, fast-moving, high-turnover groups while remaining feasible in smaller, stable ones.(10)

A framework proposal formalises the same logic by making "Area", the qualification of the online environment in terms of privacy, contextual factors and user expectations, one of four interconnected ethical dimensions, and by insisting that in closed groups permission from administrators alone is insufficient and should be supplemented by individual consent and a recognised right of withdrawal.(2)

Reported consent architectures nonetheless diverge sharply in how far individual consent is pursued. At one pole, a netnography of women's environmental cyberactivism on Instagram argues that ethically defensible work with information from public profiles is possible without informed consent provided total anonymity, privacy and security of participants are guaranteed, no commercial use is made, and recognised guidelines (AoIR 3.0, NESH, and a university research-integrity code) are followed.(22)

A netnography of Instagram comment threads on melancholic music similarly limited collection to public profiles and posts, anonymised users through codes, and collected data without researcher intervention.(18) At the other pole, several studies treat public availability as insufficient grounds for use.A digital ethnography of rider communities obtained consent only from the administrators and moderators of two closed Facebook groups of approximately 20,000 members each, reporting explicitly that the consent statement was read by gatekeepers but was invisible to ordinary members, so the researchers' presence went unnoticed by most participants.(23) A study of a Facebook depression support group obtained administrator consent but deliberately declined to use highly personal posts, quoting only repeated, non-identifying content.(19)

A cross-platform digital ethnography of Saudi English-medium-instruction academics replaced one-off consent with iterative consent, reopening the conversation whenever new, sensitive or unexpected data appeared.(12) A netnography of family vlogging argued that parental consent frameworks are structurally inadequate for children and proposed staged consent with content-removal rights exercisable in adulthood.(24) A digital ethnography of women-led religious study groups reported informed consent, confidentiality and anonymisation for adult participants alongside an institutional ethics review waiver,(16) while a comparative digital ethnography of Indonesian protest waves restricted analysis to publicly available materials or materials obtained with explicit consent.(17)

Three recurring tensions are visible in these accounts. The first is that overt, individualised consent can itself change the field: making research visible may undermine participation, representation and the perceived safety of online social spaces, particularly for marginalised youth whose conceptions of privacy and of the researcher role may differ from those of adult researchers.(25)

The second is the gatekeeper problem: gatekeeper consent is expedient but systematically leaves the researched unaware,(23) and frameworks that require individual consent in closed groups implicitly accept that some studies will become infeasible as a result.(2)

The third is that non-participant observation remains common even in studies that describe themselves as ethnographic: extended observational netnography on a health platform disclosed the researcher's presence fully while deliberately not interacting with members,(15) and a comparative digital ethnography combined retrospective archival observation with live observation and interviews, anonymising all material during transcription.(17)

Taken together, the visibility dimension in practice is resolved less by a rule about publicness than by a judgement about access barriers, topic sensitivity and community expectations,(10,21) a judgement that one framework paper argues must be made contextually rather than through strict public–private lines.(2)

Consistent with this, a netnography of WhatsApp educational groups reports that researching the platform problematises entrenched public–private dichotomies and even the category of participation itself.(10)

How traceability, vulnerability, positionality and automated analysis shape obligations

Every included study that reports anonymisation at all presents it as a risk-reduction strategy rather than a guarantee, and the most detailed accounts are precisely those that tested whether their own techniques worked.

The strongest single example is a methodological reflection on image data drawn from an ethnography of U.S. college students, which found that blurring faces and blacking out names and location tags were insufficient against facial recognition, reverse image search and machine-learning matching, that collaboration with a digital historian made identifiability of supposedly anonymised images obvious, and that moderate pixilation still revealed features, skin colour and expressions while heavy pixilation rendered images analytically useless; converting images into pencil sketches by altering every pixel was reported as the most feasible and effective strategy that retained the facial features and expressions needed for analysis.(26)

The same study describes an ongoing, collaborative consent process in which participants were re-contacted for permission to publish images, some preferring case-by-case decisions and a few declining altogether, and concludes that because digital images can be identified and data can be subpoenaed, future applications and harms are impossible to predict; for vulnerable populations it recommends print-only or access-restricted publication of sensitive visual material.(26)

Textual traceability is managed through a recognisable repertoire. Paraphrasing or composite "fabrication" that cannot be traced back to an original participant is the most frequently reported device,(10) and it is used alongside pseudonymisation and the removal of names, photographs and phone numbers.(10) A cross-platform digital ethnography of multilingual professionals extended the repertoire to include communicative translation from Arabic into English, paraphrase instead of direct quotation, descriptive summaries, and the decision not to quote non-participants directly at all, on the reasoning that unique phrases, images or emoji styles can make a participant identifiable even without a name.(12)

A netnography of child-inclusive family vlogs withheld channel names and video titles and paraphrased direct quotes from audience comments.(24) A digital ethnography of a misogynist image board reported that literal fragments were included only exceptionally and were modified through ethical fabrication.(14) A framework proposal recommends pseudonyms, reformulated quotations and the exclusion of images where necessary, explicitly because search engines enable re-identification.(2) A narrative review of online ethnographies of disability communities, a secondary synthesis of published studies rather than a primary netnographic investigation, named the underlying dilemma, that procedural ethics compliance is problematic because the anonymity of quoted material cannot be guaranteed once quotes are searchable, and described "medium concealment" as a strategy it recommends, in which sensitive topics are anonymised and direct quotations are used only if they cannot be located through search engines.(27) A conceptual synthesis of digital research ethics makes the same claim normatively, recommending data minimisation, avoidance of searchable direct quotations, paraphrasing of sensitive content, aggregation of results, exclusion of vulnerable groups where risk is high, and documentation of the reasoning behind each choice.(3)

One study, a qualitative review of literature, case studies and ethics guidelines rather than a scoping review of cases, reports that anonymisation techniques such as masking, pseudonymisation and aggregation do not reliably prevent re-identification, and reports re-identification risk as present in 49% of the cases it examined, within an overall pattern of privacy violations in 72%, absent or inadequate consent in 68%, data misuse in 55% and algorithmic bias in 61%. These percentages are the study's own findings from its review of generic "social data research" cases, not prevalence estimates for netnographic practice specifically, and they should not be read as describing the netnographic studies synthesised here.(28)

The costs of these safeguards are reported as well as their benefits, and they fall unevenly on the studies with the most vulnerable participants. Anonymisation is argued to be an absolute minimum yet is described as doing insufficient work in environments where a search engine can identify people and places, and the distinction between external confidentiality (protecting participants from outsiders) and internal confidentiality (preventing participants from identifying one another) is presented as a gap that ethical codes largely ignore.(29)

Protective anonymity may also conflict with participant preferences, since some participants do not wish to be anonymised and imposing it can constitute a form of ethical paternalism.(29) In disability communities, more intensive anonymisation is reported to risk losing information and reducing the dissemination of participants' own stories.(27)

Ethical constraints on identifiability are reported to have restricted one Instagram netnography's sample to verified accounts, representing under half of the study participants, and to have excluded comment threads that form an integral part of the digital narratives analysed.(22)

The tension between protection and the FAIR research principles that funders increasingly require is stated directly in a reflective account of research on online gender-transition narratives, alongside the observation that anonymised data falls outside GDPR while direct quotations can still identify speakers.(20) A digital ethnography of an Indigenous community addressed media reuse through non-contact: no images of community members were reproduced, specific URLs and group names were omitted or anonymised, and the researcher deliberately minimised algorithmic signals by limiting watch-time and avoiding likes, comments and subscriptions, relying instead on cached transcripts and screenshots.(9)

Studies that describe advanced automation report the least about anonymisation: a feminist computational infrastructure paper explicitly notes that it does not discuss informed consent, anonymisation, re-identification risk, platform terms or vulnerable-group protections.(30)

Vulnerability is the dimension on which the included studies are most explicit, and the most consistent finding is that vulnerability is treated as contextual, dynamic and partly produced by the research itself rather than as a fixed property of a population. A reflective essay on online gender-transition narratives defines a vulnerable community as one marginalised or at risk of discrimination online and offline, observes that a community may consider social media a safe space precisely because it is marginalised, and argues that increased visibility produced by research may threaten that space; it also notes that vulnerability can change over time, as when a participant comes out as trans during the study period, and situates the argument in a national context where the LGBTQ+ community scored 13% in a European ranking and 57% of trans respondents in a cited report avoided public restrooms despite needing them.(20)

Conceptual work on harvesting youth online discussions frames the tension as one between representing marginalised voices and respecting the autonomy and wellbeing of young people whose anonymity and re-identification risks can affect psychological and social development, future life options and personal safety, and warns against helicopter research in favour of reflexive engagement that lets research direction emerge from participant concerns.(25) A netnography of child-inclusive family vlogging argues that children cannot meaningfully consent to sustained digital exposure, that parental authority is a weak proxy in the presence of commercial and algorithmic incentives, and that platforms are structurally complicit through algorithmic amplification and monetisation while creators routinely reclassify child-inclusive content to circumvent child-directed protections.(24)

The narrative review of disability-community research likewise notes that risks to informants increase significantly with socially vulnerable groups, although as a secondary synthesis of others' studies it reports this as a pattern across the reviewed literature rather than as an observation from a single primary fieldwork project.(27)

Harm-mitigation practices in these settings are more procedural than the anonymisation repertoire. A digital ethnography of men who have sex with men in post-disaster Indonesia reports institutional review board approval, adherence to professional ethical codes, verbal and written informed consent, pseudonyms, interviews conducted in secure neutral spaces or encrypted digital platforms, and, distinctively, the involvement of local NGO partners as ethical liaisons providing oversight and psychosocial support, alongside participatory co-design of interview questions and validation of data-collection strategies.(13)

An autoethnographic account of fifteen months of fieldwork with marginalised communities in Cuba and its diaspora argues that digital mediation simultaneously affords presence and absence, and that this distance can level the researcher–participant relationship and constitute a more ethical mode of fieldwork: participants vetted the researcher online before deciding to collaborate, several preferred encrypted platforms and declined in-person meetings even at very short physical distances, and a two-hour interview conducted by WhatsApp audio messages became, in the researcher's assessment, one of the most successful and ethical encounters of the project, with participants rather than the researcher setting the terms and locations of engagement.(11) A digital ethnography of a misogynist image board describes analysing a space whose affordances facilitate harm while refraining from amplifying it, including the use of ethical fabrication to protect anonymity.(14) A study of an Indigenous community facing algorithmic "human safari" tourism formalises non-contact as an ethical position, declining any engagement with the community and extending do-no-harm reasoning to researcher-induced algorithmic signals.(9) An arts-based participatory study with queer young adults uses zine-making workshops framed as Research Brave Spaces to replace extractive or rigid data collection with care, adaptability and multimodal expression, reporting increased participant agency through self-curated representation and allowing ambivalence and contradiction to be expressed in ways conventional interviews struggle to capture; the paper engages ethics of care but does not report procedural detail on consent, privacy, re-identification or platform terms.(31) A netnography of a health platform, by contrast, reports that because observed conduct was commonly performed publicly and participants were anonymised, archival and observational data could be analysed without interaction, with the researcher's presence fully disclosed.(15)

Researcher participation and positionality are reported through two competing logics. The first logic recommends disclosure and co-presence: the QAnon ethnography chose to use a real name, photographs, real perspectives and an explicit researcher position despite the risk, on the grounds that participants should be able to decline and should be aware that their material is being shared, and that data should be used in original form under direct informed consent rather than reconstructed; the same study argues that institutional review boards should require internet-research training and tailor their questions to digital contexts, and that consent decisions are contextual and relational rather than a one-time checkbox.(21)

Conceptual work on what makes digital ethnography ethnographic argues that generating meaningful data requires reflexive decisions about participation and self-presentation, that sustained relational co-presence rather than platform use defines the ethnographic, that anonymity evaporates as soon as data are published, that fake personas should be avoided because they risk misrepresenting real people, and that ethnographers should be aware that publicly identifying as researchers can invite trolling or doxxing at a speed and volume unprecedented in analog research; it also notes that the most vulnerable people, including those who are incarcerated, elderly, unhoused or living in deep poverty, have difficulty maintaining a digital presence, which limits what digital ethnography can study.(1) The second logic treats lurking or limited visibility as a legitimate and sometimes preferable position: anonymous or low-visibility observation over time can function as a diagnostic tool to triangulate other data or as the main source of data about a community,(1) and several studies report non-participant observation as the primary mode.(15,23)

Reflexive reporting itself is presented as a site of ethical work rather than a formality: a confessional collection of digital ethnographers' accounts treats fieldwork about, on and through digital media as messy, personal and fraught with anxiety, and describes private backchannels as the place where moral and ethical quandaries are worked through,(32) while an essay on the "three lies" of digital ethnography identifies the networked field-weaver, the eager participant-lurker and the expert fabricator as archetypes that reveal how disconnection, non-participatory reading and data construction are concealed in methodological storytelling.(33) An autoethnographic study of a depression support group reports the mirror-image risk that becoming a full member of a group may render certain mechanisms invisible to the researcher, and that even with participants aware of the research role, intimate conversations were excluded from analysis.(19) A cross-platform ethnography institutionalised reflexivity through a reflective journal, platform-by-platform coding before cross-platform comparison, and member reflection in which emerging interpretations were shared with participants to check that analysis reflected their views.(12)

Platform terms, storage and retention are the thinnest part of the reported record. Where they appear, they appear as constraints on method rather than as documented governance: one ethnography reports that Facebook, WhatsApp and Instagram data had to be collected manually because those platforms do not permit automated harvesting, while Twitter data were collected through Gephi and MAXQDA, and its observation window ran from the first reported COVID-19 case in Colombia to a defined saturation point.(23) A framework proposal requires consideration of platform terms of use and legal regulations including GDPR and national data-protection law as part of the "Area" dimension.(2) A reflective account of research on gender-transition narratives notes that legal stipulations are complicated by uncertainty about which country's law applies, whether the project base, the platform base or the user base, and that platform fair-use terms and national fair-dealing exceptions must both be consulted, while legal compliance does not automatically satisfy ethical obligations.(20)

One study reports pseudonymisation and secure data storage alongside signed informed consent and handwritten note-taking chosen to protect anonymity,(34) and one conceptual synthesis recommends that ethics committees examine data sources, consent strategies, anonymisation limits, storage and sharing practices and withdrawal procedures, and that funders and editors require clear ethics statements, data-availability statements and disclosure of AI tool use.(3)

The qualitative review of literature, case studies and ethics guidelines argues that consent is frequently implied through acceptance of long and complex terms of service that users neither read nor understand, and proposes a composite ethical-compliance score combining privacy, consent and fairness scores.(28) Only one study discusses the future-application problem directly, observing that because images can be identified and data subpoenaed it is impossible to predict later uses and harms.(26)

Automated and AI-assisted analysis of human digital data is the least developed dimension in the corpus, and the two most relevant core studies approach it from opposite directions, one as a methodological warning, the other as an infrastructure proposal with explicit ethical limits.

The methodological chapter on ethnography and machine learning reports that cloud-based transcription services raise confidentiality and privacy concerns, that some companies claim rights over user-uploaded data and reuse it in undisclosed ways, that uploading confidential data to conversational AI systems may breach privacy and current human-subject protection regulations, and that off-the-shelf automated speech recognition exhibits racial bias, with average word error rates of 0.35 for English speech by African American speakers against 0.19 for White speakers; the same chapter notes that machine learning can reduce transcription time from five to eight hours per interview to between one and three and a half hours, and can assist cleaning, de-identification and curation of large datasets for sharing and replication.(35)

The feminist computational infrastructure paper documents a pipeline over more than 90,000 podcast episodes and over 100,000 hours of audio using Whisper transcription and hate-speech and misogyny classifiers, and is unusually candid about error: transcripts degrade with poor audio, heavy accents, overlapping speakers and technical jargon, summarisation can miss points or hallucinate, classifiers produce both false positives and false negatives, and classification scores are therefore treated as indicators for further investigation rather than standalone evidence of harm.

The authors state that the tool's architecture cannot enforce feminist commitments and could be used extractively without contextual reflection, that ethical grounding comes from the researcher rather than the software, and that the paper does not discuss specific ethical procedures such as informed consent, anonymisation, re-identification risk, platform terms or vulnerable-group protections; they also position the pipeline as a means of tracing how extremist transcripts may enter large language model training data.(30) Adjacent evidence suggests that AI is already present in the fields researchers study, not only in their toolchains: a digital ethnography of a misogynist image board reports that community members fabricate sexual images using artificial intelligence, raising data-provenance questions for researchers who collect such material.(14)

No included study reported a protocol-level consent, anonymisation or disclosure procedure specifically for large language model analysis of human digital data; the studies that discuss automation do so at the level of ethics principles and infrastructure design rather than research protocols.(3,28,30,35)

Synthesis: a dimension-based decision framework derived from reported practice

Read across the six analytic dimensions, the extracted practices form a layered decision framework in which obligations increase with the cumulative risk profile of a study rather than with a single property such as "publicness". Four tiers emerged from the reported decisions, and Table 2 maps each subquestion to the core studies that support it together with the dominant reported practice and the points of contradiction.

Table 2. Question-evidence matrix: core studies, dominant reported practice and points of contradiction

The first tier covers studies of public, searchable content that is not sensitive and concerns non-vulnerable adults, with no researcher interaction and no automated analysis. Reported practice in this tier is contextual assessment rather than consent-by-default: even where studies concluded that public-profile data could be analysed without individual consent, they conditioned that conclusion on total anonymity, no commercial use, adherence to recognised guidelines, and awareness that content producers may not understand searchability.(18,21,22)

The second tier covers semi-public, group-based and moderated spaces, where reported practice converges on two moves: determining the group's position on the access-barrier spectrum rather than on a public–private label,(10,21) and treating gatekeeper permission as necessary but insufficient, supplemented by disclosure, by individual consent where feasible, and by a recognised right of withdrawal.(2,23)

The third tier covers private, encrypted, sensitive or vulnerable settings, where reported practice adds individualised or staged consent, encrypted channels and neutral venues, community liaison and oversight, refusal to use intimate content even when consent to observe has been given, non-contact where engagement itself would cause harm, and acceptance that exclusion of data, or of the study, may be the appropriate outcome when risk cannot be mitigated.(9,11,13,19,20,24)

The fourth tier covers studies that analyse human digital data with automated or AI-assisted tools, where reported practice is limited to principles: transparency about tool use, minimisation of identifiable data, refusal to upload confidential material to services that claim reuse rights, verification of computational outputs through close reading, attention to differential error rates across speakers and groups, and disclosure of AI use in publications and to review bodies.(3,28,30,35)

Two features of this framework should be stated plainly. First, it is descriptive before it is prescriptive: the tiers summarise what included studies reported doing and justifying, and the framework has not been validated against outcomes, because no included study measured whether any safeguard reduced harm. Second, the framework's weakest tier is the most consequential: the automation tier rests on a small number of conceptual and infrastructural sources that explicitly decline to specify procedural ethics, and on methodological findings about transcription bias and classifier error rather than on reported netnographic practice.(30,35) Consequently, the framework functions as a reporting scaffold for authors and reviewers, covering visibility and access barriers; community expectations and gatekeeper relationships; sensitivity and vulnerability; identifiability and traceability; interaction and disclosure; and analytical technology, rather than as a validated instrument.