By Melinda Young

When 23andMe of Sunnyvale, CA, envisioned a research program a decade ago, the company had little guidance and support for its plans.

“We were a start-up with a disruptive idea of trying to get into regulated research space,” says Katie Huber, PhD, CIP, research ethics consultant at 23andMe. “We wanted our program to abide by federal regulations, whether or not we had federal funding. If you set high standards for yourself at the beginning, it’s easy to uphold them rather than to impose them later.”

Some new technology companies that are developing novel human subjects research face challenges and design issues that have never been explored, says Leslie Wilson, CIP, director of operations at Ethical & Independent Review Services (E&I) in Independence, MO. Companies engaging in cutting-edge technological services and solutions can raise public concerns for what they do on the business side, but there is less public awareness of privately funded research.

“The Common Rule opens up the possibility for more and different kinds of research,” Wilson says.

One of 23andMe’s goals was to follow the Common Rule for all human subjects research and to rely on an external, independent IRB.1 Another goal was to provide research participants with their results, which carries its own risks and challenges. The company wanted to do it the most ethical way, from the start.

“You only have one chance to earn participants’ trust. Once that’s gone, how are you ever going to get that back?” Huber asks.

Ten years ago, sharing individual genetic results was considered controversial. The American Society of Human Genetics (ASHG), at its annual meeting in 2010, held a public presentation about the implications of using direct-to-consumer and clinical genetic testing in disease risk assessment. Researchers conducted an online survey of customers of 23andMe, deCODEme, and Navigenics to learn more about why people use these services and how they felt about their results. (More information is available at:

“Originally, ASHG was not in favor of research participants — or anyone — getting research results, which was a prevailing sentiment,” Huber explains.

With little guidance from regulatory and industry associations, 23andMe contacted IRBs to find one that would review its protocol, eventually finding a good match with E&I. While it’s beneficial for IRBs to be helpful — and even collaborate with researchers — IRBs still must maintain independence in their review.

The collaboration was helpful to both organizations, Huber notes. “E&I spent time to find out what we wanted to do and what that would entail,” she says. “They asked a lot of questions, and got into the details of what a study would look like.”

From E&I’s perspective, the independent IRB benefited from a direct line with the sponsor, says Erica Heath, CIP, partner, E&I. “We talk with them about their upcoming studies, any design problems they’re having, and discuss possible solutions that they might incorporate,” she explains. “We work with them early on to eliminate or make clear some of the problems.”

Peeling Back the Layers

The IRB brings up fresh issues, including ethical challenges and risks that genetic scientists might not imagine. (See story on IRB and sponsor/investigator collaborations in this issue.)

“The questions that we tend to explore a lot with E&I are new risks and benefits in the informed consent,” says Michelle Agee, MSc, CIP, manager of regulatory science at 23andMe. “We had a lightbulb moment when we were thinking about the risks, what participants would want to know, and what they could comprehend. We worked with E&I to develop draft language and open-ended questions to get at those concerns.”

These questions turned into the proverbial onion, with one question peeling away a layer that led to another question. “We worked iteratively with E&I until we felt good about the results,” Agee says.

For example, the improved informed consent uses bold font to outline an explanation of what information the company would share externally. There are additional definitions to help research participants better understand what is discussed.

Performing a risk-benefit calculation is challenging when the study is about something new and unusual, Huber says. “We make decisions based on our perceptions of the risks and benefits, and those are all matters of opinion,” she explains. “What I’m concerned about might not be what you’re concerned about.”

When working in unknown risk territory, it is important to ask more people to look at the study and providing their input on what would worry them, Huber adds. For example, how should a technology-related study handle paradata? Coined in 1998, paradata refers to auxiliary data collected, including data from a person’s online use or from a survey. (More information is available at: “Paradata is collected whenever you do anything online,” Huber explains.

It includes this information:

  • Where are you located?
  • Are you on your computer or phone?
  • Are you using Safari, Google Chrome, or Internet Explorer?
  • How many times did you click “enter?”

“These data exist for any online interaction,” Huber says. “It’s all going on in the background. It sounds like very innocuous data, but it turns out you can do a lot with this information.”

For instance, if someone accesses a survey online and clicks through the questions quickly, paradata might suggest the person did not take time to read the questions, which makes those answers less useful for the study.

Companies also use paradata to improve their marketing techniques. With paradata, a company can see where someone is located when they are online, and the company can send a pop-up ad for a store in that location.

23andMe does not use paradata information, Agee says. But the company is exploring ethical and informed consent questions related to use of such data, such as:

  • Are paradata sometimes off limits?
  • What do we do with the information?
  • Can we use any of the data?
  • Can we use it for research purposes?
  • What else do we need to think about with paradata?

The collaboration between E&I and 23andMe has helped research program staff focus on how to explain new technology concepts, like paradata, and to make sure the research program addresses these new concepts in its policies.

“A top concern was how paradata could allow a researcher to make inferences,” Huber says.

If someone is filling out an online survey form by clicking boxes with a computer mouse, then someone could view paradata to note that the person was not paying attention to questions, that the person completed the survey late on a Friday night, or that it takes the person three times as long to complete the survey on the phone than on the computer, Huber explains.

“The concern is that this is something that would not be obvious to regular participants. If you want to put this information in a consent form, then make sure they understand this aspect of it,” she says. “It goes back to comprehension, and whether your participants understand what you’re doing.”

When 23andMe started conducting human subjects research, investigators had to explain to participants what genetic results mean. Medical literacy has improved, but some terms still need explanations, Huber says.

“Paradata is not something on most people’s radar; aggregate data-sharing is not something dropped at parties,” she says. “People don’t think about these things or necessarily understand them.” The research staff’s job is to help people understand complicated concepts, she adds.

IRBs can help sponsors and investigators come up with definitions and explanations that laypersons understand, but it requires a trusting and collaborative relationship between human research protection programs and the people conducting research. This means forming the collaboration early on — sometimes, as early as when the study is in design.

“The earlier the communication starts with the IRB, the more likely that the research is going to incorporate a strong participation protection plan,” Wilson says. “It involves both parties: the IRB needs to be accessible, knowledgeable, receptive, and willing. It also requires the research team to have confidence and trust, and reach out to the IRB.”


  1. Bullis E, Agee MAD, Wilson L, et al. We’re in this together: Enabling stronger participant protections through collaboration. Presented at the 2019 PRIM&R Advancing Ethical Research Conference, Nov. 17-20, 2019, Boston. Poster: 15.