Abstract
The growing importance of researching online activities, such as cyber-deviance and cyber-crime, as well as the use of online tools (e.g. questionnaires, games, and other interactive tools) has created new ethical and legal challenges for researchers, which can be even more complicated when researching adolescents. In this article, we highlight the risks emerging from the current European legal and ethical landscape when researching potentially vulnerable groups, with a special focus on online research. It is not always clear how to differentiate research ethics consent from consent for data processing activities: when can an adolescent independently consent to research, or when is parental consent needed? Additional problems emerge when parents do not consent to research activities, but their adolescent children do. A serious ethical challenge can arise when the parents do not communicate with researchers, but the adolescent wishes to participate, especially when weak parental oversight is coupled with research on sensitive topics. We offer some guidance on what to keep in mind when conducting online research with adolescents and highlight possible ways that these issues can be dealt with in pan-European projects.
Introduction
Adolescents in Europe are connected to the internet daily, mostly through their mobile phones, increasing their risk of exposure to cybercrime, both as a victim and as a perpetrator (e.g. cyberbullying, online grooming, human trafficking) (Davidson et al., 2022; Harriman et al., 2020; Smahel et al., 2020). Therefore, preventive actions to raise awareness of the risks of and safe behavior on the internet are needed. Research is also needed on who becomes the victim or perpetrator of cybercrime, how and why, what risk factors play a role, and what kind of prevention works. This necessitates the participation of adolescents, whose behavior, thoughts, habits, and other personal traits are at the very core of understanding the issue.
Although there is a vast amount of literature on ethical considerations when working with adolescents (e.g. British Educational Research Association [BERA], 2018; British Sociological Association, 2017; Graham et al., 2013; Mackenzie et al., 2021), there are challenges to be addressed when the focus is on a sensitive topic (e.g. cybercrime) and action-based research (e.g. using serious games for prevention and researching how the activity works). This article shares the ethical and legal challenges from the pan-European project RAYUELA (“Empowering and educating young people for the internet by playing”), focusing on research with under-aged research subjects in different European countries using a serious game for both preventive activities (teaching safe behavior on the internet) and for collecting research data (evaluating how the game works, by collecting psychological information from participants, as well as how their decision-making changes during the game). Based on first-hand research on cybercrime, the RAYUELA project developed a serious game for preventing risky behavior and cybercrime, and to better understand the underlying factors that lead to cybercrime involving minors, both as victims and as perpetrators. We collected a significant amount of information on how the game was played, most notably which choices the players made, how sure they were about their choices (perhaps they were playing randomly), and how long it took them to make choices in the game’s adventures. We used a strong pseudonymization approach and gathered game data only based on pseudonymous alphanumeric IDs, which effectively prevented any researcher from identifying specific players. However, pseudonymized data is still considered to be personal data under the EU General Data Protection Regulation (GPDR).
Obtaining legally and ethically valid consent from adolescents was challenging. A specific challenge was setting up a homogeneous pan-European research approach that would provide adolescents around Europe an equal opportunity to participate, provide equal safeguards, and lead to a balanced dataset where adolescents from different countries would be sufficiently represented. This challenge also relates to adolescents’ rights in an indirect manner, as adolescents’ opportunities to participate in studies focusing on societal issues can be seen as making their voices heard and taking part in finding solutions, as is their right in accordance with the UN Convention on the Rights of the Child (1989). Limiting opportunities to participate and be represented in such research could be against adolescents’ best interests.
This article discusses both ethical and legal issues related to adolescents’ participation in research, focusing the concept of informed consent, the GDPR and national data protection laws, national civil rules, the age of majority, and the rights of children. Although there were additional ethical challenges that the RAYUELA project faced, such as setting up the ethical framework for the project (including principles when working with potentially vulnerable groups; protecting personal data; and carrying out research with potential for misuse); developing an ethical code for social research dealing with children and young people using a serious game, for research and prevention purposes, strengthening the ethical sensitivity of the consortium, mapping ethical issues in using a serious game (e.g. involving kids in situations where in game criminal behavior might be possible; issues related to testing the game; issues related to informed consent and informed assent; acquiring ethics committees’ approvals), issues related to using AI algorithms and potential ethical issues emerging after the end of the project, this current article highlights risks emerging from the current legal and ethical landscape in Europe and the challenges to conducting research with potentially vulnerable groups.
Challenges of research with adolescents
The participants in the RAYUELA project were between the ages of 11 and 16. In all of the participating countries, they would be considered minors. This introduced additional legal and ethical challenges for the researchers, who had to find a balance between the rights of the adolescents and of their parents.
Ethical research with human participants is guided by several codes and guidelines (e.g. ALLEA, 2017; Lucas, 2010; Office of the Secretary, 1979) highlighting the main principles to be followed: autonomy, beneficence, non-maleficence, and justice (Beauchamp and Childress, 2009). Additional guidelines have been developed for research with minors (e.g. BERA, 2018; Parder and Sutrop, 2015) and for research done online (Franzke et al., 2020). Codes and guidelines usually provide general principles and offer guidance for deliberation, but rarely offer clear solutions for specific situations. How to balance the interests and rights of minors and their parents is one such issue where clear solutions are lacking.
Another complexity is the concept of vulnerability, as minors are generally considered to be more vulnerable due to their age. Vulnerability is context-dependent and something that involves “susceptibility to harm or risk, or as an indicator of enhanced need” (Aldridge, 2014, p. 113). This means that additional vulnerabilities might emerge if the minor belongs to a marginalized group, has participated in or been a victim of an offense, or the research topic is sensitive. The greater the vulnerability, the more protective measures are needed for research. However, this can also mean that gaining access to minors is more difficult and researchers need to consider issues related to gatekeeping and possible access points to minors (e.g. schools).
The issue of age is difficult to deal with, as there are different concepts, categorizations, and age limits. For instance, adolescence could be said to cover the age range of 11–19 years (Csikszentmihalyi, n.d.), which means that some adolescents are legally minors, but some are adults. There are various terms used for young people: children, youth, adolescents, and minors, all with somewhat different meanings and age delineations. Although the UN Convention on the Rights of the Child (1989) states that a child is a person who has not reached legal majority, in our approach we differentiate between a child, as being from infantry to puberty, and an adolescent, as being from the beginning of puberty until reaching legal majority. In this article we talk about adolescents in the latter sense. The conceptual overlap is not a substantial issue but should still be kept in mind when discussing the rights of under-aged research subjects.
Challenges related to the age of consent
One of the many difficulties is obtaining proper consent for research. Two kinds of consent can be relevant in research: consent to participate in a research study and consent to the processing of personal data. Consent as the legal basis for processing personal data is subject to the GDPR and national data protection laws (GDPR, 2018). Consent in general is regulated by general civil law provisions and the age of legal majority, which is 18 years in all countries of the EU. In addition, consent for participating in research can also be subject to explicit exceptions in law, children’s rights, guidance in practice, and by ethical guidelines for research. The complex nature of consent, the way it is regulated and interpreted, can lead to different ages for consent in practice (see Table 1). We note that on the national level, guidance is often informal and difficult to come by, leading to uncertainty about which rules to follow and difficulties in accessing this information.
Consent ages in RAYUELA partner countries where the game was first developed and tested.
The GDPR provides for two data processing consent regimes: Article 8 for consent in the context of information society services and Article 6 for all other situations. The relevant part of Article 6 reads:
Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes [. . .].
Article 8 reads as follows:
1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.
3. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.
Article 8 provides for a special regime for information society services, where children above a certain age, which, depending on national law, can be between age 13 and 16, can themselves consent to allow data processing in the context of information society services, for example social media and online games. Under that age, parental consent is still needed, and the service provider must make reasonable efforts, considering the state of the art in technology, to verify that the parental consent given is indeed given or authorized by the holder of parental responsibility over the child. The benefit of the regime of Article 8 is that for every country in the EU, there is a clear age limit. Overviews of those age limits are readily available online for researchers to use, as is illustrated in Table 1.
This makes Article 8 a very attractive regime, simply because it is clear-cut. In addition, Article 8 allows for “reasonable efforts” for verifying parental consent, a lower threshold than under general consent rules (where arguably, one would simply have to verify parental consent, whether this requires reasonable efforts or more extensive efforts). However, it has caused some confusion and, based on our personal experience, some researchers tend to refer to Article 8 in research with adolescents despite it not being apparent that this regime is in fact applicable. Article 8 only applies to information society services, for example, to services that are normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services.
In situations of obtaining consent from an adolescent, where Article 8 does not apply, the general consent regime under Article 6 applies. In those situations, national law must be considered to find out at what age a child can legally provide consent. There are some limited examples, such as Spain, where the age is set at 14 for consent to data processing in general, including both Article 8 and Article 6 GDPR situations. Most EU countries, however, do not have a general rule on when adolescents may consent to the processing of their data outside of the Article 8 guidelines. In those cases, national civil law regarding the legal capacity of adolescents must be consulted, meaning exceptions to the rule of legal capacity at 18 must be grounded in specific legal provisions or in established case law. When relying on case law, the situation often becomes even more challenging, as capacity must be judged according to the specific circumstances of the research, and the specific situation of the adolescents that will be involved.
Setting up a pan-European research project is challenging due to the vastly different rules across the EU and the difficulty of overcoming language barriers and knowledge gaps related to specific national legal systems, especially without involving national partners (and national/local ethics committees) who have experience in such cases. Quite often, the only way to overcome these uncertainties is to carry out an ad hoc assessment of different consent regimes in all relevant countries. However, such an assessment can be difficult and time-consuming, especially without dedicated legal counsel, since the researcher may not be aware of case law, guidance, practice, or other relevant regulations in all of the countries.
Obtaining consent from adolescents
Respect for autonomy is one of the pillars of research ethics. This is usually ensured by obtaining informed consent from research participants. With adolescents, the consent is given by the parents, who need to assess the potential risks and decide based on the best interests of the adolescents. However, the researcher must also consider the wishes of the adolescents and respect their right to self-determination as much as possible. This is usually ensured by obtaining assent from the adolescents.
The lack of clear and specific exceptions for age of consent for research purposes forces researchers to treat adolescents as minors and ask for parental consent. The issues with such an approach are covered in Table 2. If both parent and adolescent agree, the researcher can carry on with the research. The course of action is also clear when the adolescent disagrees with the activities, as the consent of the parent becomes irrelevant. The tricky part is when an adolescent wants to participate in the study, but parents or legal guardians disagree. The disagreement can be twofold: (1) clear disagreement and (2) non-communication. The two might have different reasons behind them, which might include having the child’s best interests in mind, but could also include disregard for matters important to the adolescent: an ideal that is also set in the convention on the rights of the child by the United Nations (1989).
Implications of parental consent and adolescent assent on participation in research.
Some studies have shown (Berry et al., 2013; Liu et al., 2017) that asking for active, or opt-in, parental consent can lead to lower participation rates, which in turn can lead to a potentially biased sample. The lower participation rate can be explained by practical complications of obtaining parental consent, for instance when the parents are required to physically mail back filled-in consent forms. This problem can be overcome with new and improved technological solutions for obtaining and verifying parental consent. However, some problems can also be due to motivational reasons.
Martins and Sani (2020) have argued that there are several reasons why parents do not consent to their children participating in research on sensitive topics: to protect the privacy of their family, to protect their children’s best interests, or to protect their own interests. Martin and Sani (2020) argue that sometimes the adult’s self-interest can lead to silencing the voices of their children. In addition, a study (Cavazos-Rehg et al., 2020) on adolescents’ willingness to ask their parents’ consent to participate in a mental health study showed that, even though 83% of the surveyed adolescents were interested in participating, only 35% were willing to ask their parents, 30% were not willing, and 34% were unsure. The main reasons were concerns for their own privacy, a fear that their parents would lack awareness of these issues, and concerns about their parents’ reactions. This indicates that sometimes it may be the adolescents themselves who decide to not inform their parents and therefore cannot participate in the study.
In particular, the scenario of non-communication from the parental side combined with agreement from the adolescent’s side is in our opinion the most critical ethical question, the decision based on which should not be taken easily as adolescents with weak parental oversight tend to be dealing with various sensitive problems, for example under-aged alcohol consumption or substance use (e.g. Prins et al., 2020; Yap et al., 2017) or engaging in violence (e.g. Manzoni and Schwarzenegger, 2019). On the other hand, there might also be different views of parents and adolescents on whether adolescents need to be included in research related to sensitive topics. In addition to cybercrime, parents’ and adolescents’ views, expectations, and experiences might diverge on topics related to alcohol and substance use (e.g. Parder, 2016), deviant behavior online (e.g. Hawdon et al., 2015) or research related to sexual orientation (Toomey and Russell, 2016). The dilemma for the researcher in such situations is how to best support the autonomy of the adolescent, while also following the relevant legal and ethical requirements.
From the data protection perspective, the age of assent does not have a strong legal implication. When parental consent is obtained under the general consent regime of Article 6 of GDPR, the adolescent’s assent is not legally needed. However, asking for assent is still necessary to respect the requirements of the convention on the rights of the child and responsible research practices, and serves to provide information to the child, which is obligatory under the GDPR, even when parental consent is obtained (Article 29 Working Party Guidelines on transparency under Regulation 2016/679 (WP260) [2018], para. 15).
Further challenges with consent for online activities
The consent regime under Article 8 of GDPR is usually not relevant in a traditional research setting, but it can become relevant when dealing with research in online settings for engaging research subjects, such as having them play a serious game. In such cases, it is not always clear which a consent regime applies to research.
Some elements should be considered when deciding whether a research activity can be considered to be an information society service (Directive (EU) 2015/1535, laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services [2015] OJ L 241, Art. 1 (1), b), (i)–(iii); Kosta, 2020; Tosoni, 2020). To be considered an information society service, the activity must:
- be normally provided for remuneration, that is, payment;
- be provided at a distance, meaning that the parties are not simultaneously present, and the activity is conducted by electronic means; and
- be provided at the individual request of the recipient of the services.
Concerning the first criterion, it is important to consider that “service” has an independent meaning under EU law (Craig and De Búrca, 2008: 819; Craig and De Búrca, 2011: 793; Kosta, 2020: 360 with the references; Lenaerts et al., 2021: 212, para. 7.082, with the case law cited there; Tosoni, 2020: 296–297 with the references). Service requires a transaction of an economic character, meaning it is not provided for free. Hence, a service offers something intangible, which people are usually willing to pay for, or otherwise provide a return. Providing a service must hence constitute an economic activity, even if not paid for directly. It is not necessary that the service provider is trying to make a profit, so in principle services can also be provided for educational or charitable purposes and by non-profits. However, for there to be service, there must be an activity for which there is some kind of direct consideration, and some type of return on the part of the recipient. This implies that somewhere in the chain money is being generated. Because it is not necessary that this is paid directly by the recipient, social media applications that offer completely free accounts still qualify as (information society) services, because they still provide those services for a return, and even for profit, with the money being generated by (targeted) advertising. The return on the part of the users, as recipients of the service, is to subject themselves to (targeted) advertising.
Concerning the second criterion, it should be noted that parties can in principle be present in the same space if they actually use the service at a distance. For example, filling out an electronic form online with the person who created it present can still be seen as “at a distance.” In the same vein, testing a serious game could be done in a pilot setting where the player and the researcher are in the same room, but if the data collection happens electronically through the game, this criterion is still met.
The third criterion usually means that the service is provided in such a way that the user can decide when and whether to use the service. If the serious game is hosted and freely accessible on a webpage, this criterion would be met.
Online research activities as information society services
Given that definition, the question arises as to which research activities qualify as information society services? This is certainly not the case for traditional research, such as paper questionnaires, focus groups, interviews, etc. In these cases, at least the distance and electronic elements are missing, and these types of research typically are not done at the request of the recipient. The matter becomes slightly more contentious when looking at online research activities, which are carried out by electronic means and at a distance, such as online questionnaires and serious games. In such cases the question effectively becomes: is social research a service, provided normally for remuneration, or at least carried out in the context of an economic activity? There are two examples: (1) a research questionnaire online and (2) a serious game collecting data for research purposes.
With the research questionnaire online, there seems to be a potential problem. While opinion or marketing research questionnaires in the style of “Which character of [insert your favorite game/TV-show/movie/fantasy universe] are you?” may be considered a service and, because of ads, generate an income, scientific research questionnaires do not have that same purpose. While the provision of data by the respondents to that questionnaire may help the researcher to do their job and the institution to meet its contractual requirements with research funders, the questionnaire is not an economic activity as such, does not generate revenue, and the answers provided are not a direct consideration for a service rendered. In addition, a service implies that there is some benefit being obtained by the recipient of the service (e.g. having fun) and it is questionable whether respondents to a research questionnaire obtain such direct benefit (although not impossible, e.g. in the form of education).
The example of a serious game is even more challenging. There is a clear benefit (i.e. a fun game, which is also educational), but there still is no economic consideration provided by the player because their time and personal data do not generate revenue, and therefore there is no economic activity, at least for as long as the game is piloted within a research project. This may of course change if, after the end of the research project, the game is marketed for educational purposes and offered to schools for a fee. This could be considered a service.
Another source of confusion is the fact that researchers often use information society services, for example, commercial questionnaire platforms, to carry out their research. Even in those cases, the respondents of the questionnaire cannot be considered to be using an information society service, as responding to the questionnaire does not happen at the respondent’s request.
In general, we would conclude that research activities are not information society services. Potential misinterpretation and incorrect application of Article 8 GDPR is understandable, as this whole reasoning requires a level of legal expertise that is unreasonable to expect from researchers and research institutions as there is little guidance available for this topic and this is an emerging issue in the field.
Adolescents’ consent in the wider EU regulative framework
As we’ve argued, research activities fall under the general consent regime of Article 6 GDPR as research doesn’t fit with the criteria set for information society services. Whether this is appropriate is debatable, but it raises important questions about the protection of adolescents’ rights within the GDPR. It could be argued from a policy perspective that children should be able to consent to a research questionnaire if they can consent to using social media. Even though certain research activities may in fact be quite intrusive, for example, medical research or social experiments on sensitive topics, the question here is about the informational self-determination of adolescents: can they independently control the use of their personal data, or do they need the permission of their parents? Whatever the appropriate regime might be, the current legal situation is that whether adolescents can consent to data processing as part of research for themselves depends on the specific rules on the legal capacity of adolescents in the countries involved. In most countries, this involves a (much) higher age than consenting to information society services, such as social media. This in turn means that researchers must contact parents or guardians for their consent, which makes otherwise cost-effective online data gathering more costly and time consuming. Moreover, while Article 8 of the GDPR states that reasonable efforts are sufficient in verifying parental consent, Article 6 of the GDPR does not contain this provision. Consequently, easy methods, for example, having an adult solve a puzzle to showcase maturity or other methods of verifying one is dealing with an adult without collecting additional data or identifiers, do not suffice. Instead, approaches need to be considered that establish parental consent at a level of certainty in line with the GDPR’s accountability obligations. That is possible when research is performed using schools as intermediaries (who can keep the identifying information and reliably collect parental consent) but become a problem online as proper verification of parental consent requires additional data collection (contrary to the idea of data minimization) to prove that the person providing consent is the holder of parental responsibility. This also might lead to the destruction of pseudonymization strategies and might simply become cumbersome to manage or dissuade participants regarding the research. This can become a serious issue when trying to include a large number of adolescents in a study and could have the undesirable consequence of not involving adolescents in future online social studies.
Additionally, several important issues in the EU are regulated on the Member State level—research exceptions under the GDPR, age of consent under consent regimes of Article 6 and Article 8 of the GDPR, and age of majority under civil laws—which further complicates pan-European research activities. Researchers could look up rules from another legal system that refer to personal data processing of adolescents, ignore the finer legal distinctions, and go ahead with social research based on an inapplicable consent regime. Misinterpretation could also happen in a purely national context if clear guidelines are missing. Even when ethical approval must be obtained prior to the research, not all ethics committees may have the ability to intercept those errors, especially when dealing with cross-border situations.
The overall conclusion of this section is that because Article 6 of the GDPR must be applied, which in most countries relies on general rules regarding the legal capacity of adolescents (usually 18 with limited exceptions), parental consent tends to be needed much more often even for research on adolescents. Moreover, a lack of clarity may lead to misapplying rules (e.g. by asking an ethics committee to approve pan-European research based on one country’s national rules) or overusing parental consent (e.g. by applying the most stringent age rule of all of the countries involved). The continued regulatory and organizational complexity of research on adolescents may influence researchers to avoid such studies and find new topics or subjects that are more easily approachable. This will most definitively have a negative effect on adolescents’ right to agency, to be heard, and to be included in research, which may affect them and their future.
Approach implemented in the RAYUELA project
For the RAYUELA project, a conservative approach was chosen, including strong pseudonymization being provided to the participants (i.e. the project partners were not able to identify any child playing the game). This was accomplished by using schools and other youth activities as mediators and by agents ensuring parental consent for adolescents participating in the research. This also allowed the research team to verify the actual ages of the adolescents participating and to make sure that only adolescents in the age range targeted by the research (between 11 and 16) were participating.
In our approach, we found Article 8 not to be applicable, and therefore it was not possible to use this regime. This meant Article 6, with more stringent requirements, was applied for accountability to be able to prove consent.
With this approach, it was too difficult to organize data gathering online, as this would have required much more data collection (contrary to the data minimization principle) as we would have needed to verify actual parental consent and the relationship to the actual adolescents participating. Since we had chosen a strong pseudonymization approach for the game and collected a lot of information about the adolescents’ behavior in the game, this would have most likely conflicted with our approach of strong pseudonymization (not being able to identify any player). Therefore, we stayed with Article 6 and national approaches, with physical connections through the schools.
Discussion
What we can conclude from this analysis is that the situation is quite complex and guidance and clear instructions are often missing. Although it is the researcher’s responsibility to protect the autonomy of research participants in a pan-European cross-border project, this can be quite a challenge in developing a research methodology suitable for all participants. As we have shown, the ages for being able to give consent in research activities and for data processing activities vary. Technology can help make the participation in research activities much easier; in addition, it makes it possible to research activities happening in online settings. On the other hand, gathering parental consent for adolescents in online settings can be challenging.
Every European project that plans to involve adolescents from multiple Member States must decide whether to develop a consent procedure tailored for each specific country or to have a unified approach for the whole research project. Both possibilities have their benefits and drawbacks. Consent procedures tailored to each specific country requires that the research team either has a partner organization in the country responsible for these activities or that they can identify the rules for the country themselves. As we have shown, it might be difficult for researchers to identify and interpret the legal requirements in other countries due to a lack of clear information and guidelines, limited legal expertise and language barriers. A country-specific approach is extremely challenging for projects carrying out their research activities online, as it is hard to limit the online activities to specific countries. Moreover, even when researchers manage to apply all of the different legal regimes in a pan-European research context, different rules can still lead to unbalanced datasets, with groups from certain countries not being represented due to legal constraints.
To overcome these challenges, a unified approach, with similar procedures followed in all countries, seems more suitable. However, this approach means that the most restrictive rules have to be applied to make sure all national requirements are followed. As noted, the most restrictive approaches set both the consent for research purposes and consent for data processing activities at age 18, resulting in an interpretation where online research activities with under-aged people always require parental consent.
There are several problems with the unified approach. Firstly, this does not fit well with the respect for the autonomy of adolescents and their emancipation process, where their vulnerability is related to their age (and diminishes over time), level of development, and ability to understand the implications of their choices. The UN Convention on the Rights of the Child (1989) includes the principle of the evolving capacities of the child. In the broadest sense, this means the need to balance the rights and obligations of parents with the rights of the child, in proportion to the child’s maturity. In addition, evolving abilities can be seen as a policy principle (Varadan, 2019) which has two functions: to strengthen the child’s role as a decision-maker and to guide minimum age laws. Treating all adolescents as minors weakens their role as decision-makers. This is most evident in situations where adolescents want to participate but their parents do not give their consent (see Table 2).
Secondly, this creates the risk that pan-European research is carried out with easily accessible adolescents from countries with flexible regulations, creating an imbalance in the national representation of adolescents and pooling research with similar contextual backgrounds. It’s unclear whether the results obtained from this sample would be generalizable for all adolescents in Europe. In addition, adolescents from the countries with the most stringent rules are at risk of being excluded from research overall, making it questionable whether policy suggestions on the pan-European level are applicable to them or not. In addition, practical solutions generated from this kind of research might lead to the risk of ineffective policy solutions that do not work for extremely hard-to-reach target groups, which is something that all of the numerous specific research ethical and legal safeguards are meant to prevent. In an age of social acceleration (Rosa, 2013), there is an emerging risk that research including potentially vulnerable groups is becoming too complex and resource-demanding and may eventually leave these groups out of research. Being excluded from social research greatly reduces the chance of being heard and of participating in social life for those adolescent groups who are already marginalized or stigmatized in their national social context and are therefore harder to reach.
Thirdly, the legal and ethical complexity could create additional barriers to pan-European social research, as it is much easier and less time-consuming to carry out empirical fieldwork in a single country. A lack of cross-country research may hinder preventive and interventional policy initiatives on the EU level, especially in areas that require cooperation from Member States, for example, tackling cyber-crime.
We are not recommending loosening the ethical requirements for robust research. There are, however, several ways to move forward. An intermediary solution would be to clarify within the EU all of the national rules that apply to research. Initially, this would require an analysis of legislation and in-depth data collection on guidance and practices, much of which is not available online. Such an overview, combined with activities to raise awareness, could help researchers understand what choices they have and how to best consider the interests of adolescents when designing their pan-European research activities. The European Union should make funds available for this effort and to facilitate discussions to find more lasting solutions.
An ideal solution would be to harmonize the regulations of European countries on this topic. Harmonization is not easily achieved, as the issue involves the legal capacity of adolescents, which can be a politically divisive topic. In addition, harmonization attempts may meet resistance, as these topics touch upon the Member States’ sovereignty quite significantly and would require them to change their laws. This solution is therefore unlikely to be implemented in the near future.
Another option is to create a self-regulation mechanism for online research on the European level, where participants are contacted directly and not, for example, through such intermediaries as schools (which must follow specific national rules and guidance). Such a mechanism should, at the minimum, respect different opinions among the Member States, foster mutual trust, harmonize approaches, and lead to agreed upon common minimum principles, safeguards, and procedures that should be followed within the European Union. Ideally such a self-regulatory framework would allow online research activities of a certain type, approved by an ethics committee in one Member State, to be carried out with participants throughout the Union. In theory, such a solution would solve many of the problems with pan-European online research involving adolescents. This approach is already used in practice, but without a justifying framework and with a very piecemeal approach, rather than having clear guidance on the EU level. However, while this would afford adolescents throughout the EU the same opportunity to have their voices heard, this option also requires a high level of consensus, and therefore, while less difficult to reach than the harmonization of laws, is still an ambitious approach.
A more achievable short-term path might be to complement the clarification of the status quo through a comprehensive study, with a set of best practices (based on that status quo) to be defined by setting these practices at the highest level of compliance, rather than the common minimum rules of the previous solution. It may be easier to agree on the absolute highest level of safeguards than to agree on the minimum level that is legally and ethically required, considering the differences in national law, practice, guidance, and ethical views. If best practices are defined at an EU level on how to carry out ethically and legally challenging research, and these are followed by researchers, it could facilitate acceptance in different countries and lead to online research being carried out throughout the Union based on a research design approved in a single country. Finally, if none of the above solutions are feasible, a clarification of the status quo through a comprehensive study should at least be complemented by some effort to define case studies and methodological approaches as good practice examples for researchers on how to think about this issue in order to find acceptable ways to research hard to reach target groups, which may also serve to inspire national ethics committees to approve such research.
Conclusion
This article addressed the legal and ethical issues of obtaining adolescents’ independent consent to participate in social research. Firstly, we addressed the ethical and legal complexity surrounding consent itself. At least two types of consent are relevant in research: consent to participate in research and consent as a legal basis for processing personal data. In addition, at least two different consent regimes can be identified within the GDPR: the general consent regime under Article 6 and consent for information society services under Article 8, which has a reduced age for consent. We further clarified the issues around the age of consent for research purposes and the need to ask for parental consent whenever the research subjects were considered minors. We concluded that under the current regulations and lack of relevant guidance, one of the options is to be overly protective and consider all adolescents under the age of 18 to be legal minors. However, such an approach has some disadvantages. Firstly, it could be regarded as reducing the adolescents’ opportunities to make informed decisions about themselves and to control the use of their personal data in research. Secondly, if pan-European social research involving adolescents in countries with different rules becomes too complicated, it could lead to less such research. Such an outcome could adversely affect the adolescents’ rights and interests. We suggest that more clarity is needed to help researchers. To begin with, there is a clear need for a comprehensive overview of Member States’ laws and regulations concerning research with adolescents. There is also a need for an EU-level initiative to negotiate a common approach suitable for all Member States that sets down rules and safeguards for cross-border research.
Footnotes
Declaration of conflicting interests
The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Funding
All articles in Research Ethics are published as open access. There are no submission charges and no Article Processing Charges as these are fully funded by institutions through Knowledge Unlatched, resulting in no direct charge to authors. For more information about Knowledge Unlatched please see here: 
This project has received funding from the European Union’s Horizon 2020 research and innovation program under the grant agreement No. 882828.
Ethical approval
Research carried out in RAYUELA project was approved by the ethics committee of Comillas Pontifical University (Spain), research ethics committee of University of Tartu (Estonia), ethics committee of the Bratislava Policy Institute (Slovakia), ethics committee of Ellinogermaniki Agogi (Greece), ethical committee of Ghent University (Belgium) and social and societal ethics committee of KU Leuven (Belgium).