Citizen Science & Human-Subjects Rules

TL;DR: Under the U.S. Common Rule (45 CFR 46), whether a citizen-science or crowdsourced-research volunteer triggers human-subjects regulation depends on what role that volunteer is playing, not on the fact that they’re a volunteer. A person collecting data about birds, water quality, galaxies, or street trees is not a “human subject” under the Common Rule — the research isn’t about them. A person whose own identifiable information, biospecimens, or behavior is the data being studied is a human subject, exactly as in any other study. Most contributory citizen science falls in the first category and is outside Common Rule scope entirely; a growing subset — participatory health apps, DIY-biology/genetic citizen science, and any project studying volunteers’ motivations, learning, or demographics — falls in the second and needs the same IRB review any other human-subjects study would.

The core distinction: who is the research about?

CASRAI’s companion guide on the two-part Common Rule test covers this in full, but the piece that resolves almost every citizen-science question is the second prong: the “human subject” definition at 45 CFR 46.102(e)(1). A human subject is “a living individual about whom an investigator…obtains information or biospecimens through intervention or interaction…or obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens.”

Read carefully, that definition is about the target of the research, not about who is doing the observing or reporting. In the large majority of citizen-science and crowdsourced-research designs, volunteers are acting as instruments — extensions of the research team’s data-collection capacity — not as the people the study is about. The research is about the phenomenon they’re observing (a bird population, a water sample, a galaxy image, a pothole), not about the volunteer doing the observing. No living individual is the subject of the study, so the Common Rule’s “human subject” prong is never met, and the regulation doesn’t apply to those volunteers as participants.

This tracks the framework the Crowdsourcing and Citizen Science Act of 2016 (codified at 15 U.S.C. § 3724, part of the American Innovation and Competitiveness Act) uses when it directs federal agencies to expand citizen science and crowdsourcing as legitimate methods: the statute and the CitizenScience.gov federal toolkit it produced treat volunteers as project participants and co-investigators in a data-collection sense, a framing that maps cleanly onto the “not a subject” side of the Common Rule analysis for most projects in the federal catalog.

When citizen science does not trigger IRB review

The Common Rule generally does not apply to the volunteer’s own participation when the project fits this pattern:

Contributory/observational designs where volunteers record data about the natural or built environment — species sightings (iNaturalist, the Great Backyard Bird Count), water quality readings, night-sky observations, image classification of galaxies or cells (Zooniverse-style platforms), infrastructure condition reporting. The subject of the research is the environment or object observed, not the volunteer.
No identifiable private information about the volunteer is collected, used, or retained beyond what’s needed to run the platform (an account username, an email for correspondence) — incidental account administration doesn’t convert a project into research “about” the volunteer.
The volunteer isn’t, themselves, the object of any generalizable finding the project intends to publish — the published science is about the species distribution, the water chemistry, the galaxy morphology, not about who contributed the observation.

Because the “human subject” prong fails outright, it’s irrelevant here whether the activity would otherwise qualify as “research” under 46.102(l), or whether it would be exempt under one of the Subpart A categories — both of those questions only arise once a human subject is already in the picture.

When it does trigger IRB review

Human-subjects regulation applies in the ordinary way — same as any other study — whenever a citizen-science or crowdsourced-research design puts the volunteer, or someone else, in the “human subject” role:

The project studies the volunteers themselves. Research into contributor motivation, learning outcomes, engagement patterns, demographics, or behavior change — a common and legitimate line of citizen-science-education research — makes the volunteer the subject of that inquiry, and needs IRB review like any social-science study of participants.
Participatory health and biomedical citizen science. Smartphone-based health-research apps, self-tracking studies, and DIY-biology or citizen genetic-science projects that collect a volunteer’s own health data, biospecimens, or genetic material are collecting identifiable private information or biospecimens about a living individual — squarely inside 46.102(e)(1), regardless of how the project brands itself as “citizen science” rather than “a study.”
Any identifiable data about the volunteer is generated or retained for research purposes beyond platform administration — e.g., linking observation records to a real name, precise home-location data, or a persistent identifier the research team analyzes as a variable.

None of this is unique to citizen science — it’s the same two-part test from CASRAI’s Common Rule definition guide applied to a design that happens to use volunteer, distributed data collection rather than a lab or clinic.

The grey zone: volunteers collecting data about other people

The harder case is when volunteer contributors aren’t the subject of the research, and aren’t just observing the physical world either — they’re collecting data about other people: a community-mapping project photographing identifiable residents, an oral-history crowdsourcing effort, a public-health citizen-science survey where volunteers interview neighbors, or a social-media/crowdsourced-labeling project where the labeled content is identifiable and about third parties.

Here the human subject is the third party being observed or interviewed, not the volunteer doing the observing or interviewing — but that doesn’t put the project outside Common Rule scope. If the sponsoring institution is engaged in the research (see below) and the design meets both prongs of 46.102, the third parties’ identifiable private information is exactly the kind of data the Common Rule exists to protect, and the IRB’s review needs to reach the volunteer-administered data-collection instrument itself — the survey script, the interview protocol, the photo-release process — the same way it would review a paid research assistant’s field protocol. Informed consent obligations run to the third party being studied, not to the volunteer collecting the data.

Are volunteer contributors themselves “engaged in research”?

A separate question from whether volunteers are subjects is whether they’re engaged in research as an extension of the institution running the study — relevant to whether the institution’s IRB and Federalwide Assurance obligations reach their activity at all. HHS’s Office for Human Research Protections addresses this in its 2008 guidance, Engagement of Institutions in Human Subjects Research, and SACHRP has since recommended OHRP refine the standard to turn on which entity controls study design, conducts the analysis, and communicates generalizable results — a test that, in most citizen-science platforms, points to the sponsoring lab or agency, not to the individual volunteer.

In practice this means: the institution running a citizen-science or crowdsourcing platform is the one that needs an assurance and IRB oversight where the Common Rule applies at all; individual volunteers are not typically treated as separately “engaged” institutions in their own right, even in the grey-zone third-party-data scenario above. What changes in that scenario isn’t who holds the compliance obligation — it’s that the obligation now has to cover a data-collection instrument administered by a distributed, non-employee volunteer workforce rather than lab staff, which raises real practical questions about training, standardized scripts, and consent documentation that a research-administration office should plan for explicitly rather than assume away.

A practical screening checklist

For a research-administration office or PI scoping a new citizen-science or crowdsourced-research design, five questions in sequence do most of the work:

What is the data about? The physical/natural/built environment, or a living individual?
If it’s about an individual, is it the volunteer or a third party? Different consent pathways follow from each.
Is any of that individual-level data identifiable — name, precise location, biospecimen, image, or a persistent identifier — and retained beyond incidental platform administration?
Does the project intend to publish generalizable findings about the volunteers or third parties themselves (motivation, demographics, health status, behavior), as opposed to findings about the phenomenon they helped observe?
Who controls study design, analysis, and dissemination — the sponsoring institution, or the volunteers themselves? That answer identifies which entity’s IRB and assurance obligations are actually in play.

A “no” to individual-level identifiable data in questions 2–4 generally keeps a project outside Common Rule scope for the volunteers’ own participation. A “yes” to any of them means the project needs the same IRB review, informed consent, and Belmont Report-grounded risk-benefit analysis any other human-subjects study would.

Why this matters beyond the regulatory technicality

Citizen science and crowdsourced research are now large enough as a federal-agency methodology — the CitizenScience.gov catalog spans dozens of agencies and hundreds of active projects — that getting this distinction wrong has real cost in both directions. Over-applying IRB review to contributory, environment-focused projects (bird counts, water testing) imposes review burden with no protective purpose, since there’s no human subject to protect, and can discourage exactly the kind of public-participation science the 2016 Act was written to expand. Under-applying it — treating a health-data or third-party-survey citizen-science project as automatically exempt because it’s “just citizen science” — leaves real human subjects, whether volunteers themselves or the people they’re collecting data about, without the protections the Common Rule exists to provide. The European Citizen Science Association’s Ten Principles of Citizen Science make a parallel ethical point outside the US regulatory frame: citizen-science projects should address data-sharing, licensing, and participant recognition deliberately, whether or not a formal human-subjects test applies.

Frequently asked questions

Does a volunteer have to give informed consent just to join a citizen-science project?

Not under the Common Rule, if the project doesn’t make the volunteer a human subject (the typical contributory case above) — though most platforms still use a terms-of-participation agreement covering data licensing, liability, and platform conduct, which is a separate, non-regulatory disclosure practice, not Common-Rule informed consent.

Does IRB review apply to a citizen-science project funded by NSF or another federal agency?

Only if the project meets both prongs of 46.102 — federal funding alone doesn’t create human-subjects obligations; the design does. NSF’s own human-subjects FAQ applies the identical 45 CFR 46 test to any NSF-funded design, citizen-science or otherwise.

What about citizen-science projects that use participants’ smartphone or wearable data?

If the data collected is about the volunteer’s own location, health, or physiological state and is identifiable, that’s squarely inside the human-subject definition, regardless of the “citizen science” label — treat it as a standard human-subjects study, including for consent and data-security planning.

Is crowdsourced data labeling or classification (e.g., transcribing historical documents, tagging images) human-subjects research?

Usually not for the volunteer labeler, since the research is about the underlying dataset, not the labeler. It can become human-subjects research if the material being labeled contains identifiable private information about third parties and the project analyzes or reports on that information as data about those individuals.

Citizen Science and Human-Subjects Regulation: Do Volunteer Contributors Need IRB Review?