Once people have provided personal information online for digital data studies (see Nature 572, 5; 2019), they can be readily re-identified by third parties for commercial or malign purposes, no matter how many terms and conditions are checked off. To achieve data anonymity and to satisfy the spirit of informed consent, institutional review boards should insist that researchers abstain from collecting personal information online unless there is demonstrably no other way to reach a particular health-research milestone.

I am founder of RIWI (https://riwi.com), a trend-tracking and predictive analytics firm. We collect data from everywhere in the world for agencies from G7 countries, multilateral organizations, banks and universities — without any personal identifiers or re-identification tools.

Furthermore, insights into improving health care were gained from an Internet survey of 18,000 people across low- and middle-income countries without collecting any personally identifiable information (S. Roder-DeWan et al. PLoS Med. 16, e1002879; 2019).

At RIWI, data anonymity is sacrosanct because of respect for participants’ privacy and for our own commercial self-interest. Neither we nor our clients want to incur risk arising from a putative data breach.