| Both sides previous revisionPrevious revision | |
| practices:ethics [2026/10/08 10:21] – Extend ethics with registration and resource-claiming defaults; Authored by Claude karel.kubicek.claude | practices:ethics [2026/10/08 10:44] (current) – Extend online-group recording ethics; audit counts and refresh two stale claims; Authored by Claude karel.kubicek.claude |
|---|
| | TheWebConf '26* | Encouraged | Via ACM's human-participants policy | Not named | Not required | | | TheWebConf '26* | Encouraged | Via ACM's human-participants policy | Not named | Not required | |
| |
| <WRAP todo>* Six of the seven rows are the currently open cycle. TheWebConf is not: ''www2027.thewebconf.org'' does not resolve and ''thewebconf.org'' lists WWW 2027 (Dublin) with no call for papers yet, so that row is the **last published** cycle, WWW 2026, which was held in April 2026.</WRAP> | <WRAP todo>* This table records the cycles checked on **2026-08-18**. At that date the WWW 2027 website did not resolve and no call for papers was available, so its row uses the last published cycle, WWW 2026. **Update checked 2026-10-08:** the [[https://www2027.thewebconf.org/research-track-papers/|WWW 2027 research-track call]] is now available; it encourages an ethical-data-collection section when appropriate and refers to ACM's human-participants policy. The historical table above has not been relabelled as a fresh seven-venue policy audit.</WRAP> |
| |
| Four things to take from it. | Four things to take from it. |
| |
| The per-paper codes, every count query, verified source spans and real report output are in [[provenance:practices:ethics#Registration and claiming section 2026 10 08|the registration provenance log]]. | The per-paper codes, every count query, verified source spans and real report output are in [[provenance:practices:ethics#Registration and claiming section 2026 10 08|the registration provenance log]]. |
| | |
| | ===== Entering and recording online groups ===== |
| | |
| | Joining a Telegram or WhatsApp group, a Discord server or a members-only forum puts you among people who joined a community, not a study. The same issue arises when you record a subreddit without joining anything. **Access, consent, interaction and subsequent disclosure are separate decisions.** A working invite link establishes an access route; it does not establish what members expected you to do with their conversations. For the discovery and collection mechanics, see [[design:platforms:messaging_channels]]. |
| | |
| | ==== What the corpus can tell you ==== |
| | |
| | A whole-corpus vocabulary scan, followed by candidate adjudication, identifies **168 papers analysing online-community member content or data**. Of these, 110 collected data directly, 11 combined collection with reuse or leaks, 43 reused existing data, three analysed leaked community databases, and one leaves the collection route unresolved. The platform families overlap: 75 involve Reddit, 56 forums, 24 Telegram and 10 Discord. This is a **detected population**, not an exhaustive census; minor uses, professional discussion lists and community Q&A are included. The full inclusion/exclusion ledger is on the provenance page. |
| | |
| | The review denominator is the **121 papers with direct collection or a mixed route**. Their extraction records 71 with a non-sentinel review label and 50 silent (43 with ''none-mentioned'', seven with no ethics record). This is a count of **extraction labels**, not independently verified review decisions. Some supporting quotes describe precautions rather than review, as in He et al.; others are damaged by column extraction. Even a real paper-wide approval may cover interviews instead of group collection. We therefore do not turn these records into a group-specific approval rate. {[he2025_unmasking]} |
| | |
| | ^ Year ^ Community-data papers identified ^ Direct collection or mixed route ^ |
| | | 2024 | 22 | 15 | |
| | | 2025 — provisional | 29 | 19 | |
| | | 2026 — provisional | 12 | 9 | |
| | |
| | These rows locate the recent evidence; they are not a growth or decline trend. Earlier years and all candidate verdicts are logged in the report. The provisional years are under-represented by construction (see [[literature:corpus]]). |
| | |
| | For the narrower **26 messaging group/channel collection papers**, re-running the existing hand codes gives 10 reporting approval, one exemption, two a determination that review was not required, two invoking institutional standards without naming a board, one naming approval for a different study component, and 10 saying nothing about review. Seven explicitly state passive collection. These are reporting categories, not evidence that the other papers interacted or failed to obtain approval. The approval for {[yu2024_listen]}'s recruited user study does not establish approval for its Discord scraping. Counts describe these seven venues and this detected population, not all online-community research. |
| | |
| | ==== Defaults to take into your study design ==== |
| | |
| | These are recommendations derived from the cases below, **not a claim that a majority of papers follows them**. Methods are dated so that an old collection precedent does not become permission to repeat it under today's terms. |
| | |
| | ^ Decision ^ Default and its boundary ^ Papers showing the choice or a different one ^ |
| | | Entry | Start with spaces accessible to an ordinary member without misrepresenting yourself, paying for admission or obtaining a personal vouch. Observe without posting or contacting operators unless interaction is necessary and separately assessed. Record how the invite circulated, whether approval was required and what members could see about your account. For a small or selectively admitted community, seek permission and an appropriate consent process, or omit it. Administrator permission helps with entry but cannot stand in for every member's consent to recording and reuse. | Marjanov et al. (2026) entered Telegram channels through advertised invites, including channels Telegram calls private, but ruled out deception, payments and vouching. Their “private” channels should not be equated with a small trusted group. He et al. (2025) communicated with wallet-drainer operators and acquired tools; this is interaction requiring its own assessment, rather than evidence for a passive protocol. {[marjanov2026_stayin]} {[he2025_unmasking]} | |
| | | Consent | Prefer transparent collection with consent where practicable. For large openly accessible communities where notifying everyone would itself intrude or disrupt, submit a **specific argument for collecting without individual consent**: necessity of the data, why consent is impracticable, expected audience, possible harms and mitigations. Record who accepted that argument and whether it is an ethics decision, an institutional human-subjects determination or a formal waiver. Reassess when entry becomes selective or you identify individuals. | Marjanov et al. (2026) argue from publicly accessible communities and collective patterns. Vu et al. (2025) argue that contacting everyone on forums/channels would amount to spam, then aggregate and paraphrase. These arguments do not automatically extend to invite-only support groups. Li et al. (2025) deliberately excluded Telegram groups and self-constructed forums while collecting publicly accessible Reddit discussions. {[marjanov2026_stayin]} {[vu2025_assessing]} {[li2025_investigating]} | |
| | | Fields, files and retention | Decide the minimum fields **before** collection: avoid member lists if message-level analysis suffices; replace identifiers at ingestion if linkage is needed; restrict access to any linking secret; set retention and deletion rules. Do not download stolen-data payloads merely because posts advertise them. If media is essential, specify allowed types, a size cap and isolated handling. | Hoseini et al. (2020) store hashes of phone numbers. Roy et al. (2025) avoid reading/downloading credential payload files while analysing posts and filenames. Marjanov et al. (2026) instead download selected file types subject to a size cap. That cap is a resource limit, not proof that the contents are safe. Plain phone-number hashes remain enumerable; do not describe them as anonymisation. {[hoseini2020_demystifying]} {[roy2025_darkgram]} {[marjanov2026_stayin]} | |
| | | Models and other recipients | Keep raw messages and identifiers on controlled infrastructure; use local models where classification needs sensitive text. Map every recipient, including scraper vendors, hosted classifiers and human annotators. Moving messages to a service creates a new disclosure even if the service does not train on them. Local processing reduces that disclosure but does not confer a platform licence. | Marjanov et al. (2026) explicitly choose local LLMs to avoid sending stolen and sensitive data to third parties. Roy et al. (2025) instead use Azure-hosted GPT-4 for classification of collected software and social-media-manipulation posts. Both routes appear in the recent corpus: the local-model default is a harm-minimisation judgement, not a demonstrated field consensus or a claim that hosted classification has been superseded. {[marjanov2026_stayin]} {[roy2025_darkgram]} | |
| | | Quotations and release | Prefer aggregate results, paraphrased examples and controlled data access. Removing a username does not remove searchability: a verbatim message, timestamp or named small group can identify its author. Check combinations of fields, and withhold sensitive raw messages from public artifacts. | Vu et al. (2025) paraphrase quotations to prevent attribution; Li et al. (2025) also paraphrase excerpts. Marjanov et al. (2026) provide access through institutional licence agreements rather than a public raw database. The broader privacy framework explains why aggregation, linkage and searchable quotations can undo de-identification. {[vu2025_assessing]} {[li2025_investigating]} {[marjanov2026_stayin]} {[beadle2025_privacy]} | |
| | |
| | **Where the public-community argument stops.** Albrecht et al. (2021) interviewed Hong Kong protesters who expected police monitoring of large public Telegram groups and distinguished these from small trusted groups. Arunasalam et al. (2024) report refugees' distress after an outsider entered an invitation-only WhatsApp group and sent offensive content. These are accounts of members' expectations, not experiments establishing that silent research observation causes the same harm. Together they make group purpose, vulnerability, audience and admission rules design variables; neither supplies a universal group-size cutoff. If consent, safe admission or adequate protection cannot be achieved, exclusion is a methodological choice worth reporting, as in Li et al. {[albrecht2021_collective]} {[arunasalam2024_security]} {[li2025_investigating]} |
| | |
| | ==== Platform permission is a separate question ==== |
| | |
| | Primary policies checked **2026-10-08**: |
| | |
| | * **Telegram:** its [[https://telegram.org/tos/content-licensing|content-licensing terms]] restrict access beyond ordinary intended use, with a limited client/bot/mini-app exception. They also expressly prohibit data use for AI development, benchmarking and deployment, and say exceptions may be granted where every relevant user gives explicit, continuing consent for that context. That consent is a prerequisite, not automatic permission. An official API and a locally hosted model do not by themselves satisfy those terms. |
| | * **WhatsApp:** the [[https://www.whatsapp.com/legal/terms-of-service|Terms of Service]] prohibit impermissible or unauthorised user-information collection, including through automated means. Identify the regional terms and authorisation covering your actual route; a published WhatsApp scraper is not that authorisation. |
| | * **Discord:** [[https://support.discord.com/hc/en-us/articles/115002192352-Automated-User-Accounts-Self-Bots|automating normal user accounts outside the OAuth2/bot API is forbidden]]. A legitimate bot installation resolves that account-automation issue; it does not settle whether members consent to recording, analysis or release. |
| | |
| | Do not merge these into “research is permitted” or “public collection is always illegal”. State the actual route, relevant clause, any permission obtained, your institution's legal assessment and your ethics decision separately. The existence of a publication establishes a precedent for a study design, not platform authorisation or a legal exemption. |
| | |
| | ==== Read before collecting; report before submitting ==== |
| | |
| | Start with Beadle et al.'s **2025 privacy framework** for research using social-media data, then Marjanov et al. (2026) and Roy et al. (2025) for contrasting pipelines. {[beadle2025_privacy]} {[marjanov2026_stayin]} {[roy2025_darkgram]} Outside the seven venues, **AoIR 3.0** (approved 2019, cited as 2020) remains listed on AoIR's ethics page when checked today. It covers privacy expectations in public and quasi-public fora, but has no dedicated messaging-group procedure. **Barbosa and Milan (2019)** address WhatsApp ethnography directly: iterative ethical reasoning, transparency, avoiding dishonest bypasses, controlled infrastructure and paraphrasing. Neither is a general waiver for undisclosed group scraping. {[franzke2020_aoir]} {[barbosa2019_privatechat]} |
| | |
| | Report the discovery frame and number of spaces found, joinable, admitted, excluded and actually recorded; access rules and account identity; interactions or their absence; whether you retrieved old history; fields and media retained; consent or the precise argument for its absence and the review body's remit; every third-party recipient; retention, quotation and release rules. Excluding small, paid or vouched groups changes your population: describe the result as a measurement of the accessible spaces you sampled, not the whole platform. See [[provenance:practices:ethics#Online groups section 2026 10 08|the section's queries, source checks and review log]] and [[literature:corpus|corpus-level limitations]]. |
| |
| ===== Where your traffic comes from is an ethics question ===== | ===== Where your traffic comes from is an ethics question ===== |
| * [[Privacy:Consent]] — interacting with a banner is an interaction. | * [[Privacy:Consent]] — interacting with a banner is an interaction. |
| * [[Privacy:Age assurance]] — **four questions this page does not currently answer**: crawling adult content, submitting a synthetic or a real identity document to a live vendor, publishing a working bypass, and measuring an age model without measuring children. That page states them as a gap here. | * [[Privacy:Age assurance]] — **four questions this page does not currently answer**: crawling adult content, submitting a synthetic or a real identity document to a live vendor, publishing a working bypass, and measuring an age model without measuring children. That page states them as a gap here. |
| * [[Design:Platforms:Messaging channels]] — **a question this page does not currently answer**: joining Telegram, WhatsApp or Discord groups and recording members who joined a group, not a study. That page lists what the 26 papers in these venues that did it report (10 an ethics approval, 7 that they never posted or interacted, 9 nothing about review) and the five practices the careful ones converge on. | * [[Design:Platforms:Messaging channels]] — discovery, admission and collection mechanics; see [[#Entering and recording online groups]] here for consent, minimisation and disclosure decisions. |
| * [[Design:Website selection]] — a robots.txt exclusion is a change to your sampling frame. | * [[Design:Website selection]] — a robots.txt exclusion is a change to your sampling frame. |
| * [[:Artifacts]] — what you can release once the data has people in it. | * [[:Artifacts]] — what you can release once the data has people in it. |
| * [[Statistics:Interrater agreement]] — hired annotators and crowdworkers are participants; 5.1% of the corpus's hand-coding papers use them. | * [[Statistics:Interrater agreement]] — annotation methods and reporting; distinguish paid annotation work from recruited study participants. |
| |
| ===== Methodology and limitations of these figures ===== | ===== Methodology and limitations of these figures ===== |
