Research Ethics Advisor

Ethics & IRB Consultation: Social Media Use, Sleep, and Anxiety in Adolescents

Bottom line: This is a well-conceived study, and your active parental permission plus assent design is a strong starting point. However, three issues could stall IRB approval or create compliance exposure if they are not addressed before submission:

1. The school enrollment metadata supplied by counselors, which is likely a FERPA issue.
2. The passive tracking app, where the details of what it collects and who holds the data are undefined.
3. The lack of a distress, disclosure, and mandatory reporting protocol for a mental-health study with minors.

Each is fixable. Details follow.

⚖️ Note: This is general regulatory and ethics guidance, not legal advice. Items marked [Confirm] need verification against OSU HRPP/IRB policy, OSU General Counsel, or the partner districts' research offices.

Clarifying Questions Before Finalizing

My assessment below is provisional. It assumes minimal-risk procedures, no industry funding, and an off-the-shelf or custom app that logs only screen time. These answers could change the ratings:

1. Funding source? Federal funding (NIH, NSF, or the Department of Education) triggers specific obligations. NIH-funded studies get an automatic Certificate of Confidentiality. Department of Education funding brings in PPRA. Any tech-industry or advocacy funding creates COI and perception issues.
2. Which app, and what exactly does it collect? Total screen time only? Per-app usage? App names, notification content, location, keystrokes, browsing? Is it commercial (with a vendor holding data on its own servers) or built in-house? Does it work on both iOS and Android?
3. What "school enrollment metadata" do counselors provide, and why? For example: grade, GPA, attendance, IEP/504 status, counseling history.
4. Where and when are surveys completed? At home, or at school during class or advisory time? Are school staff present?
5. Will anyone review GAD-7 or PSQI scores in real time, or only at analysis?
6. Who are the research assistants? OSU employees, students, or volunteers? What training do they have in interviewing minors?
7. Compensation: How much, in what form, and paid to whom (adolescent or parent)?
8. Language and access: Will materials be available in Spanish or other languages common in the partner schools?
9. Will any participant turn 18 during the study? 17-year-olds may, over a 12-week semester.
10. What exactly do schools receive? Aggregate report only, or anything at the school or individual level?
11. Minor wording issue: You describe a "baseline online survey... at three time points." Confirm it is the same battery at weeks 0, ~6, and 12, and whether demographics are collected only once.

1. Human Subjects

Review Level

• Not exempt. Under the 2018 Common Rule, Subpart D (children) restricts Exemption 2. Survey and interview procedures with minors cannot use it, except for educational tests or observation of public behavior without researcher participation. Exemption 1 (normal educational practices) does not fit a mental-health study either.
• Likely expedited review, under Categories 6 (voice recordings) and 7 (survey, interview, and behavioral research), if the IRB judges the study minimal risk under 45 CFR 46.404.
• Full board is possible if:
  • the app collects content, location, or broad device data;
  • you plan any deception or withholding;
  • the IRB views the mental-health data plus minors plus passive sensing as more than minimal risk. That would push you to 46.405, which requires a prospect of direct benefit, and your study likely offers none. Design to stay within minimal risk.
• [Confirm] OSU's IRB determination, and whether the partner districts (e.g., Portland Public Schools and neighbors) require their own research approval. Most large Oregon districts have a separate research review process with its own timelines. Budget 1–3 months.

Informed Consent / Parental Permission / Assent

Your design already has the right structure. Strengthen it with the following:

• Tiered consent: Separate permission and assent checkboxes for:

  • (a) surveys;
  • (b) the app subsample;
  • (c) the interview and audio recording;
  • (d) optional future contact or data reuse.

  A family should be able to say yes to surveys and no to tracking.

• Age-appropriate assent: Plan for roughly a 6th–8th grade reading level. Consider a short video or verbal walkthrough for 13–14-year-olds. Assent must be meaningful: the adolescent's refusal overrides parental permission.

• Required disclosures:

  • Limits of confidentiality. State plainly what you must report (see mandatory reporting below) and what you will not share with parents or schools.
  • Parents will not see their child's answers. Say this explicitly in both documents. It protects data validity and adolescent trust.
  • What the app sees and does not see, in concrete terms (e.g., "We see how many minutes you spend on apps, not your messages, photos, or who you talk to").
  • Whether scores are monitored. If they are not reviewed in real time, say so, so no one assumes the survey is a clinical screening.
  • Withdrawal: How to stop, how to uninstall the app, and what happens to data already collected.
  • Certificate of Confidentiality status and its limits.

• Reconsent at 18: Any participant who turns 18 mid-study must give adult consent to continue. [Confirm] OSU's procedure.

• Wards of the state or foster youth: Clarify who can give permission, whether a caseworker or DHS is involved, and whether you will include or exclude these youth. Excluding them has equity costs. Discuss this with the IRB.

• Translation: Provide parent permission forms in the languages families actually use, not just English.

Recruitment and Undue Influence

• Counselor-distributed flyers are a concern. Counselors hold power and sensitive knowledge about students. Risks:
  • Students may feel pressure to join.
  • Counselors may steer flyers toward students they know are anxious, creating selection bias and implied disclosure.
  • Counselors may learn who participated.
• Mitigations:
  • Distribute flyers broadly (all students in a grade, newsletters, parent emails), not hand-selected.
  • Route all responses directly to the research team.
  • Do not tell schools or counselors who enrolled.
  • Train counselors on neutral scripts.
• Compensation: Keep it modest and prorated per time point. Pay the adolescent directly (e.g., gift cards). Avoid lotteries if your IRB disfavors them for minors, and avoid amounts that could coerce lower-income families. [Confirm] OSU payment policy, including tax/ID rules.

Risk–Benefit Analysis

Benefits: No direct benefit, so do not overstate it in consent. The societal and knowledge benefit is real: school counseling programs and digital wellness guidance. Offering all participants a vetted resource sheet is good practice, not a "benefit" to cite.

Critical Protocols to Write Before Submission

1. Distress and safety protocol
   • The GAD-7 has no suicide item (unlike PHQ-9 item 9). Good, but interviews can still surface risk.
   • Define:
     • interviewer steps if a participant discloses suicidal ideation, self-harm, or abuse;
     • who the on-call licensed clinician/supervisor is;
     • warm-handoff resources: 988 Suicide & Crisis Lifeline, YouthLine (Oregon's teen-to-teen line), and school counselor contacts, with the student's knowledge.
   • Decide on a policy for severe GAD-7 scores (≥15). Either a pre-specified follow-up (automatic resource message) or an explicit no-monitoring statement. Pick one and disclose it.
2. Mandatory reporting
   • Oregon's child abuse reporting law (ORS 419B.005) is unusually broad. It is generally understood to cover employees of higher-education institutions, which would include OSU faculty, staff, and potentially student employees serving as RAs.
   • [Confirm with OSU General Counsel/HRPP] exactly who on your team is a mandatory reporter and whether reporting obligations extend to disclosures made in research.
   • A Certificate of Confidentiality does not override state mandatory reporting if you disclose that exception in consent. Say so plainly in the parent permission and assent forms.
3. Adverse event and unanticipated problem reporting to the IRB, with timelines.

2. Animal Research

Not applicable. Skipped.

3. Data Ethics

🚩 FERPA / School Records (Highest-Priority Fix)

• Enrollment metadata from counselors is likely drawn from education records protected under FERPA. Disclosure to researchers generally requires:
  • written parental consent specific to those records, or
  • a qualifying exception, such as the "studies" exception, which requires a written agreement with the district and has specific conditions.
• Counselors themselves should not independently pull or share records.
• Best fix: Ask participants directly for what you need (grade, school, age) and drop counselor-provided metadata entirely.
• If you truly need records (attendance, GPA):
  • add explicit FERPA release language to the parent permission form;
  • execute a data sharing agreement with each district.
  • [Confirm] with the districts' records officers and OSU counsel.
• PPRA: The Protection of Pupil Rights Amendment covers surveys on mental or psychological problems in Department of Education-funded programs, and many districts apply similar policies regardless of funding. Active parental consent likely satisfies it. [Confirm] district policy.

Passive Screen-Time App

• Data minimization: Collect only what your research questions require, probably daily totals, per-category or per-app time, and time-of-day usage (useful for sleep). Exclude content, messages, location, contacts, notification text, and browsing URLs.
• Vendor due diligence (if commercial):
  • privacy policy and terms (does the vendor keep, sell, or train on data?);
  • server location;
  • encryption;
  • breach notification;
  • deletion on request.
  • Route this through OSU's IT security/procurement review. A data processing or business agreement with the vendor is likely needed.
• Oregon Consumer Privacy Act: It has heightened protections for teen data (13–15). Applicability to a university or research vendor is not straightforward. [Confirm] with OSU counsel.
• COPPA: Technically applies to under-13s, so your 13+ sample is outside it. Still apply its spirit.
• Equity and technical issues:
  • iOS limits third-party screen-time access. Platform-dependent eligibility can bias the subsample by socioeconomic status.
  • Shared or parent-owned devices may capture siblings' or parents' usage.
  • Plan for students without smartphones: exclude them transparently or provide alternatives.
• Uninstall and deletion: Give written, simple uninstall steps. Specify whether withdrawal deletes already-collected logs.

"Pseudonymized and Aggregated"

• You need individual-level linked data across three time points and across survey, app, and interview data. So data will be pseudonymized, not anonymized.
• Pseudonymized data are still identifiable in regulatory terms. Describe it accurately to the IRB.
• Keep the linking key separate:
  • encrypted;
  • accessible only to the PI and one designee;
  • destroyed at a defined point.

Storage, Security, Retention, Disposal

• Surveys: Use an OSU-licensed platform (e.g., institutional Qualtrics) with an institutional security review. Not free consumer tools.
• Audio:
  • Record on encrypted, institution-managed devices.
  • Upload promptly and delete from the device.
  • Transcribe with an OSU-approved service. Do not use consumer AI transcription tools unless IT and the IRB approve them.
  • Scrub names, schools, teachers, and peers from transcripts.
  • Delete audio after transcript verification.
• Access control: Role-based access, MFA, an access log, and no data on personal laptops or phones.
• Retention: Follow OSU's research records schedule, typically at least 3 years post-study for IRB records, and longer if federally funded or journal-required. [Confirm]
• Disposal: Plan secure deletion of the linking key, raw app logs, and audio, and document it.

Sharing and Reuse

• Schools:
  • Aggregate results only.
  • Apply small-cell suppression (e.g., no cells < 10).
  • Consider not reporting by school, since 3 schools × 25 interviewees makes re-identification plausible.
  • Put this in writing in your site agreements.
• Journals and repositories: If you anticipate open data, obtain consent for de-identified data sharing now. For minors' mental-health data, use controlled-access repositories (e.g., ICPSR restricted, NIMH Data Archive if NIH-funded) rather than open posting.
• Qualitative quotes:
  • Use pseudonyms.
  • Remove identifying details (school events, rare activities, specific platforms plus niche content).
  • Consider member checking or a quote-use consent line.

Certificate of Confidentiality

• Automatic for NIH-funded research. Otherwise, apply through NIH's CoC process, which is available for non-NIH-funded health research.
• A CoC protects against compelled disclosure (e.g., subpoenas) of sensitive minors' data. Strongly recommended.

4. Publication Integrity

• Authorship: Agree on authorship in writing at the start, using ICMJE criteria and CRediT contributor roles. Discuss upfront whether school partners, counselors, or graduate RAs who code interviews will be authors or acknowledged contributors.
• COI disclosure:
  • any relationship with app vendors, tech companies, or digital-wellness organizations;
  • funding sources;
  • consulting roles.
  • Given public controversy over teen social media, even the perception of industry ties matters.
• Accurate reporting:
  • The design is observational. Avoid causal language ("social media causes anxiety").
  • Longitudinal data allow temporal claims, not causal proof.
• Preregistration: Preregister hypotheses and the analysis plan on OSF before data collection. This area has many researcher degrees of freedom, and preregistration strengthens credibility.
• Reporting guidelines:
  • STROBE for the quantitative component;
  • SRQR or COREQ for interviews;
  • GRAMMS for mixed-methods integration.
• Duplicate publication: If you publish quantitative and qualitative papers separately, cross-reference them and disclose overlap. Avoid salami-slicing the same outcomes.
• Media and school communications: Coordinate press releases with OSU communications to prevent overstated headlines.

5. Responsible Conduct

• Researcher bias: Teams studying social media and youth mental health often hold prior beliefs about harm.
  • Use reflexive memos during thematic coding.
  • Double-code a subset and report inter-coder agreement or consensus procedures.
  • Write interview questions that allow positive, neutral, and negative experiences.
• Youth voice: Consider a small youth advisory group to review assent language, survey wording, and final recommendations. This improves validity and makes recommendations more acceptable to students. It needs its own IRB consideration.
• RA training and mentorship:
  • CITI human subjects training (including the minors module);
  • mandated reporter training;
  • trauma-informed interviewing;
  • distress protocol role-play;
  • data security training.
  • The PI should provide regular supervision and debriefing. Interviewers can experience vicarious distress.
• Fair collaboration: School partners should get timely results, clear expectations, and a say in how their schools are described.
• Broader social impact: Your recommendations may inform school policy, such as phone bans or monitoring. Consider unintended consequences:
  • social media can be a support lifeline for LGBTQ+, rural, or isolated youth;
  • restrictive policies can disproportionately affect some groups.
  • Frame recommendations with nuance and evidence limits.
• Representativeness: Active parental permission tends to under-enroll higher-risk and lower-income youth. Name this as a limitation, and use outreach (translated materials, multiple reminders) to reduce the gap.

Risk Summary

Prioritized Action List

🔴 Before Submission (Critical)

1. Resolve the counselor metadata: Eliminate it (preferred), or add FERPA-specific parental release plus a district data sharing agreement.
2. Specify the app: name, data fields, platforms, storage location, and vendor terms. Start OSU IT security review now, since it often has the longest lead time.
3. Write the distress, disclosure, and mandatory reporting protocol, with a named on-call licensed clinician. Confirm reporter status with OSU counsel.
4. Contact each district's research office and obtain site approval or letters of support. Ask about their timelines and PPRA-style policies.
5. Redesign recruitment to use broad, neutral distribution with direct-to-researcher responses.
6. Draft tiered parent permission and adolescent assent forms, with plain-language confidentiality limits, app transparency, and CoC language. Arrange translation.
7. Apply for a Certificate of Confidentiality if not NIH-funded.
8. Write the data management plan: pseudonymization, separate key, encryption, access roles, transcription service, retention, and disposal.
9. Set up the authorship agreement and COI disclosures, and preregister on OSF.

🟡 During the Study

10. Train and document RAs: CITI, mandated reporter, trauma-informed interviewing, data security.
11. Run a pilot of the survey, app install, and assent with 2–3 non-enrolled youth to test readability and burden.
12. Monitor weekly: protocol deviations, withdrawals, distress events, and app technical issues. Report unanticipated problems to the IRB on time.
13. Handle audio securely: transcribe, de-identify, verify, then delete the audio.
14. Track participants turning 18, and reconsent them.
15. Submit amendments before any change (new measures, new app, new sites). Do not implement changes first.

🟢 After the Study

16. Destroy the linking key at the pre-specified point.
17. Deliver aggregate-only reports to schools, with small-cell suppression and no identifiable quotes.
18. Share data only as consented, via controlled access.
19. Publish using reporting guidelines, with careful non-causal framing. Coordinate media messaging.
20. Close out or continue with the IRB, and retain records per OSU policy.
21. Share a youth-friendly summary with participants and families.

Key Questions for Your IRB / Ethics Committee

1. Will this be reviewed as expedited (46.404 minimal risk)? What app features would push it to full board?
2. What does OSU require for mandatory reporting disclosures in research with minors, and which team members are reporters under Oregon law?
3. Does the IRB require a licensed clinician on the safety protocol? Does it expect real-time GAD-7 monitoring, or is disclosed non-monitoring acceptable?
4. Does the IRB require district research approval letters before approval, or can it approve contingently?
5. What is OSU's position on FERPA for school-provided data, and does it need a signed district data sharing agreement?
6. What IT security review is required for the app and vendor? Is there a pre-approved list of transcription and survey tools?
7. Are there approved assent templates by age band (13–14 vs. 15–17)?
8. What compensation amounts and methods are acceptable for minors, and must parents be informed of payment?
9. How should we handle foster youth/wards of the state and participants turning 18?
10. Does the IRB recommend or require a Certificate of Confidentiality?
11. What language is needed to permit future de-identified data sharing or reuse?
12. What are the continuing review and reporting timelines for adverse events and deviations?

Compliance Checklist

Review obtained

• OSU IRB determination received (expected: expedited)
• Research approval from each of the 3 school districts
• School principal site permission letters on file
• OSU IT security review of app, survey platform, and transcription service

Consent established

• Tiered parent/guardian permission forms (surveys / app / interview and audio / data sharing)
• Age-appropriate adolescent assent forms, with refusal honored
• Confidentiality limits and mandatory reporting disclosed
• FERPA release included (or school metadata eliminated)
• Translated versions available
• Reconsent process for participants turning 18

Risks analyzed

• Risk–benefit analysis documented in the protocol
• Distress, disclosure, and suicide-risk protocol with named clinician
• Mandatory reporting procedure confirmed with OSU counsel
• Non-coercive recruitment and compensation plan
• RAs trained (CITI, mandated reporter, trauma-informed interviewing)

Data protected

• Data management plan approved
• App data minimized and vendor agreement signed
• Linking key stored separately and encrypted
• Audio deletion schedule defined
• Small-cell suppression rules for school reports
• Certificate of Confidentiality obtained
• Retention and disposal schedule set per OSU policy

COIs disclosed

• Funding sources disclosed to IRB and in publications
• Industry and app-vendor relationships disclosed (or confirmed none)
• OSU COI disclosure forms current for all investigators
• Authorship agreement signed; CRediT roles defined
• Preregistration posted

Next step: If you answer the clarifying questions, especially funding, the app, and the school metadata, I can finalize the risk ratings and help draft the assent language, the distress protocol, or the data management plan section of your IRB application.