Ethics, Law and Research Governance

Introduction and context

Marketing research and advertising influence what people know, believe, buy and share. Product managers therefore have responsibilities that extend beyond commercial performance. They must protect participants, respect legal rights, communicate honestly, govern data responsibly and ensure that automated systems do not reproduce unfairness.

Ethics concerns what ought to be done; law establishes enforceable minimum requirements; governance converts principles and legal duties into organisational processes, accountability and evidence. These dimensions overlap but are not identical. An action may be legal yet exploitative, or ethically desirable yet poorly documented. Professional practice requires all three.

This chapter presents a practical framework for planning, conducting and evaluating research and advertising activities. Because legal requirements differ between jurisdictions, organisations must obtain local legal advice. The principles discussed here are widely reflected in data-protection, consumer-protection, advertising, intellectual-property and research-ethics regimes.

Learning objectives

By the end of this chapter, a learner should be able to:

1. Explain informed consent, privacy, confidentiality and data protection.
2. Apply principles of lawful and ethical research governance.
3. Assess advertising claims for transparency, substantiation and fairness.
4. Identify risks in advertising to children and other vulnerable groups.
5. Apply disclosure requirements to influencer and sponsored content.
6. Recognise intellectual-property risks in research and advertising.
7. Identify algorithmic bias and design proportionate controls.
8. Develop a practical governance plan for a product-marketing project.

1. Ethical foundations of marketing research

1.1 Respect, beneficence and justice

Three established principles are useful across research contexts:

• Respect for persons means treating individuals as autonomous decision-makers, providing understandable information and allowing them to refuse or withdraw.
• Beneficence and non-maleficence mean seeking valuable knowledge while minimising physical, psychological, financial, reputational and social harm.
• Justice means distributing research burdens and benefits fairly. A convenient or powerless group should not be selected merely because it is easy to recruit or less likely to complain.

Marketing research also requires integrity, competence, transparency and accountability. Researchers should not fabricate responses, manipulate results, conceal material conflicts of interest or present exploratory findings as conclusive evidence.

1.2 Ethical review as proportional risk management

Not every activity requires the same level of scrutiny. A short anonymous survey about packaging preferences generally presents less risk than research involving health information, children, location tracking or inferred vulnerabilities. Governance should be proportionate to foreseeable harm, sensitivity and scale.

A useful screening sequence is:

1. What information will be collected or inferred?
2. Who may be affected, including non-participants?
3. What harms could result from disclosure, error, exclusion or manipulation?
4. Is the purpose necessary and clearly defined?
5. Can the objective be achieved with less data or lower risk?
6. What approval, documentation, safeguards and monitoring are required?

2. Informed consent and participant protection

2.1 Requirements of valid consent

Informed consent is more than clicking “I agree”. Valid consent is normally:

• Informed: the person understands the purpose, procedures, risks, benefits, data uses, retention, sharing and contact arrangements.
• Voluntary: participation is not obtained through coercion or excessive pressure.
• Specific: consent relates to identified purposes rather than unlimited future uses.
• Unambiguous: affirmative conduct communicates agreement; silence or pre-ticked boxes should not be treated as consent where applicable law requires an active indication.
• Documented: the organisation can demonstrate what was presented, when consent was obtained and what the person agreed to.
• Withdrawable: participants can withdraw without unreasonable penalty, subject to clearly explained limits such as irreversible anonymisation.

Information should use plain language and be accessible to the audience. A participant should not need specialist knowledge to understand that a “product test” also involves recording their face, linking responses to purchase history or sharing data with an advertising platform.

2.2 Consent is not always the only legal basis

In some data-protection systems, processing may rely on a lawful basis such as contract, legal obligation, legitimate interests or public interest rather than consent. The correct basis depends on the activity and jurisdiction. A company must not disguise coercive or unexpected processing as consent merely because a consent screen is convenient. Where consent is used, it should be separable from unrelated services and as easy to withdraw as to give.

2.3 Special populations and power relationships

Children, employees, patients, financially distressed people, prisoners and people with cognitive impairments may face increased pressure or reduced ability to assess consequences. Extra safeguards may include parental or guardian permission where legally required, age-appropriate explanations, independent assent, limits on incentives and exclusion of sensitive questions.

An employee who fears managerial consequences may not be providing genuinely voluntary consent. Researchers should use independent recruitment, confidential collection and clear assurances that participation will not affect employment.

2.4 Incentives and deception

Incentives should compensate time and inconvenience without becoming undue influence. Their amount, timing and conditions should be disclosed. Deception is acceptable only in limited circumstances: it must be scientifically or commercially justified, present minimal risk, be approved in advance and be followed by an appropriate debrief where feasible. Concealing the sponsoring brand may prevent demand effects in a blind test, but it must not conceal material risks or uses of personal data.

3. Privacy, confidentiality and data protection

3.1 Key distinctions

• Privacy is an individual’s interest in controlling access to personal life, body, communications and information.
• Personal data is information relating to an identified or identifiable person; definitions vary by law and may include online identifiers and inferred profiles.
• Confidentiality is the duty to restrict information to authorised uses and people.
• Anonymisation removes the reasonable possibility of identifying a person, considering other available data.
• Pseudonymisation replaces direct identifiers with codes but leaves a possibility of re-identification; it is a safeguard, not complete anonymity.

Location trails, device identifiers, voice recordings, photographs, purchase histories and inferred interests can all create privacy risks. “Publicly available” does not automatically mean ethically unrestricted.

3.2 Data-protection principles

A robust programme commonly reflects the following principles:

Data minimisation is not simply collecting fewer fields. It also involves limiting frequency, precision, retention and access. For example, a product team may need a broad region rather than exact GPS coordinates and an age range rather than a full date of birth.

3.3 Security and breach response

Controls may include encryption in transit and at rest, role-based access, multifactor authentication, secure deletion, vendor due diligence, staff training, logging and separation of research identifiers from contact details. Security should be designed before collection, not added after a breach.

A response plan should identify how incidents are detected, contained, assessed, documented and reported to regulators or affected individuals when required. Organisations should avoid assuming that a breach is harmless merely because the data was collected for marketing.

3.4 Cross-border processing and vendors

Cloud platforms, survey providers, data brokers and advertising networks may process information in other countries. Contracts should specify purpose, security, sub-processors, retention, deletion, audit rights and assistance with individual rights. Transfers may require approved safeguards or regulatory assessments. The product manager remains accountable for selecting and supervising vendors; outsourcing a task does not outsource responsibility.

4. Research governance and accountability

Research governance is the system through which an organisation decides whether research may proceed, who is responsible, how risks are controlled and how evidence is retained. A proportionate governance file should contain:

• research question and business justification;
• participant population and recruitment method;
• data inventory and data-flow map;
• consent and participant-information materials;
• risk assessment and mitigation plan;
• legal basis and privacy notice;
• questionnaire, interview guide or test protocol;
• vendor and access-control arrangements;
• retention and deletion schedule;
• approval record and change-control history;
• incident, complaint and withdrawal procedures;
• final report showing limitations and deviations.

A data-flow map should follow information from collection to storage, analysis, activation, sharing, archiving and deletion. It often reveals hidden transfers, duplicate databases and uses that were never explained to participants.

Governance is strongest when responsibility is assigned. A product manager may own the business purpose, a research lead the methodology, a privacy or legal specialist the compliance review, a security team the technical safeguards and an agency the execution. Escalation thresholds should be explicit for sensitive data, vulnerable groups, high-impact decisions and novel technologies.

5. Advertising law and truthful communication

5.1 Truthfulness and substantiation

Advertising should not materially mislead through false statements, omissions, imagery, layout, price presentation or implied claims. The overall impression matters, not only the literal wording. Qualifications must be prominent, understandable and close to the claim they modify.

A claim should be classified before publication. Common categories include:

• objective factual claims, such as price, capacity or delivery time;
• comparative claims, such as “faster than Brand X”;
• performance claims, such as “removes 99% of stains”;
• health, safety, environmental or financial claims;
• opinions and obvious puffery.

Objective claims require reliable evidence obtained before dissemination. Evidence should match the exact claim, product version, target audience and conditions of use. A laboratory result under ideal conditions may not substantiate an unconditional real-world claim. Comparative tests should use equivalent products, current data and fair measures.

A substantiation file should preserve the claim wording, test protocol, sample, dates, statistical or technical analysis, limitations, reviewer and approval decision. Evidence should not be created after a regulator, customer or journalist challenges the claim.

5.2 Disclosures and material information

A disclosure is ineffective if it is hidden in small text, placed after a link, contradicted by the headline or expressed in technical language. Material conditions include recurring fees, eligibility restrictions, limited stock, typical results, sponsorship, affiliate relationships and significant risks. Environmental claims require especially careful definition because broad terms such as “green” or “carbon neutral” may imply more than the evidence supports.

5.3 Intellectual property

Research and advertising may involve trademarks, copyright, patents, designs, database rights, trade secrets and rights in a person’s name, image or voice. Permission to access content is not necessarily permission to reproduce it commercially. A stock image licence may exclude paid social advertising; a participant may not have authorised use of their interview quote in a campaign.

Good practice includes rights clearance before publication, written licences specifying media, territory, duration and edits, attribution where required, secure handling of confidential materials and a record of ownership for commissioned work. Staff should not copy competitor creative, scrape protected databases or use generative-AI output without checking provenance and rights.

6. Advertising to vulnerable groups

Vulnerability may arise from age, disability, illness, financial distress, limited literacy, language barriers, crisis circumstances or dependence on a service. It can also be situational: a person seeking emergency accommodation may be more susceptible to pressure than the same person in ordinary circumstances.

Children require particular care because they may not distinguish persuasion from information and may pressure caregivers. Avoid exploiting credulity, encouraging unsafe behaviour, collecting unnecessary information or using manipulative design. Age assurance should be proportionate and privacy-preserving; collecting identity documents for a low-risk campaign may create greater harm than it prevents.

Marketing credit, gambling, health products, weight-loss services and high-cost subscriptions requires heightened scrutiny. Do not target inferred distress, addiction, debt or medical vulnerability to intensify urgency. Use exclusion lists, frequency limits, age controls, clear prices and accessible complaints channels.

7. Influencer and sponsored advertising

Influencer marketing is advertising when a commercial relationship affects the content, including payment, free products, discounts, commission, employment or another material benefit. The relationship should be disclosed clearly and early, using language the audience understands, such as “ad”, “sponsored” or an equivalent local term. A disclosure hidden among hashtags or after “more” may not be adequate.

Brands should contractually require truthful experience, disclosure, compliance with sector rules and records of approvals. They should monitor rather than assume compliance. Influencers must not make unsupported health, performance or environmental claims simply because a brand supplied wording. Automated or AI-generated endorsements should not imply personal use or experience that did not occur.

8. Algorithmic bias and responsible data use

Algorithms can rank audiences, estimate propensity, personalise prices, moderate content or select research samples. Bias may enter through historical data, missing groups, proxy variables, labels, objective functions, deployment context or feedback loops.

For example, excluding people with low historical conversion may reduce exposure to groups previously underserved. A model can therefore be accurate in predicting past behaviour while perpetuating unequal access. Sensitive attributes should not automatically be deleted: where lawful and appropriately protected, they may be needed to audit disparate outcomes.

A responsible algorithm lifecycle includes:

1. Define a legitimate purpose and prohibited uses.
2. Assess necessity, proportionality and affected groups.
3. Examine data provenance, representativeness and quality.
4. Test performance across relevant groups, not only overall accuracy.
5. Review false positives, false negatives and unequal burdens.
6. Provide human oversight, explanation and appeal where decisions matter.
7. Monitor drift, complaints and outcomes after deployment.
8. Retire the system when harms exceed benefits or the purpose ends.

No single fairness metric is universally correct. Measures can conflict, especially where base rates differ. Consequently, fairness analysis requires a normative decision about which errors and burdens are unacceptable, documented with stakeholder input. Human review is not a cure if reviewers merely rubber-stamp automated recommendations.

9. Applied case: the “PulseFit” product launch

Background

PulseFit, an illustrative wearable-device company, planned a campaign claiming that its new device “improves sleep by 30%”. It intended to recruit users through a mobile app, collect sleep and location data, invite health influencers to post reviews and use an algorithm to target people interested in insomnia solutions.

Problem

The research consent screen bundled product testing, promotional contact, personalised advertising and sharing with analytics vendors. It used technical language and did not explain retention. The proposed study had no control group, and the 30% claim was based on a small internal pilot. Influencers would receive free devices but were not instructed to disclose this. The targeting model used searches suggesting sleep problems, potentially reaching vulnerable people with health-related advertising.

Analysis

The project presented risks involving sensitive data, misleading substantiation, inadequate consent, influencer transparency and exploitation of health-related vulnerability. The business purpose did not require exact location, and broad targeting could achieve awareness without using individual health inferences.

Approach and solution

The team separated consent for research, service operation and promotional contact; rewrote the notice in plain language; offered an age-appropriate withdrawal process; minimised location precision; restricted access; and set a deletion schedule. An independent study with a defined outcome and suitable comparison group was commissioned before making an improvement claim. Until evidence was sufficient, advertising used a qualified statement such as “designed to help you understand sleep patterns,” subject to legal review.

Influencer contracts required clear sponsorship disclosure, honest personal experience and approval of objective claims. The targeting model was redesigned to use contextual placements rather than inferred insomnia, with exclusion rules, human review and monitoring for unequal delivery. A governance committee approved the revised plan and retained the evidence file.

Outcome

The campaign launched later but with lower legal and reputational risk. Research participation increased after the consent process became clearer, while the company avoided an unsupported performance claim. Monitoring showed that contextual advertising reached the intended market without directly targeting sensitive health inferences.

Learning points

Ethical design can improve rather than obstruct product work. Data minimisation clarified what the team actually needed; better evidence improved the claim; transparent sponsorship protected audience trust; and governance decisions were recorded as reusable organisational knowledge.

10. Practical governance checklist

Before launch, ask:

• Is the purpose specific, necessary and communicated?
• Are participants able to make a free and informed choice?
• Are vulnerable groups protected?
• Is each data field necessary, secure and assigned a retention period?
• Are vendors, transfers and access rights documented?
• Can every objective advertising claim be substantiated before release?
• Are material conditions and sponsorship disclosures prominent?
• Are intellectual-property and image rights cleared?
• Could targeting or automation create unfair exclusion or manipulation?
• Is there an accountable owner, approval record, monitoring plan and withdrawal or incident process?

Challenges and limitations

Ethical and legal assessment is difficult because rules vary by jurisdiction and technology changes faster than guidance. De-identification can fail when datasets are combined. Consent can become meaningless when notices are excessively long. Algorithmic fairness cannot be reduced to one statistical test, and organisational incentives may reward rapid launch over careful review. Governance therefore requires continuous judgement, stakeholder involvement, documentation and willingness to revise or stop a campaign.

Chapter Summary

Ethical marketing research and advertising require more than formal compliance. Respect for persons, beneficence, justice, transparency and accountability guide decisions about participants and audiences. Informed consent must be understandable, voluntary, specific, documented and withdrawable. Privacy and data protection require purpose limitation, minimisation, accuracy, retention control, security and demonstrable accountability.

Research governance assigns responsibility, records decisions and applies safeguards proportionately to risk. Advertising claims must be truthful, material conditions visible and objective claims substantiated before publication. Intellectual-property rights, influencer relationships and vulnerable audiences demand special controls. Algorithmic systems require attention to data provenance, unequal error, human oversight, appeals and post-deployment monitoring. Responsible product managers integrate these considerations at project design rather than treating them as final-stage approval obstacles.

Key Terms

Ethics: Principles concerning what ought to be done.

Research governance: Structures and processes for approving, controlling and reviewing research.

Informed consent: Voluntary agreement based on adequate, understandable information.

Privacy: An individual’s interest in controlling access to personal information and life.

Confidentiality: Restricting information to authorised uses and recipients.

Personal data: Information relating to an identified or identifiable person.

Anonymisation: Processing intended to remove reasonable identifiability.

Pseudonymisation: Replacing identifiers with codes while retaining possible re-identification.

Data minimisation: Collecting and using only data necessary for a defined purpose.

Purpose limitation: Restricting processing to specified, legitimate purposes.

Substantiation: Evidence supporting an objective advertising claim.

Material information: Information likely to affect a reasonable person’s decision.

Puffery: Exaggerated opinion that is generally not understood as an objective fact.

Intellectual property: Legally protected creations, identifiers, designs and confidential knowledge.

Influencer disclosure: Clear communication of a commercial relationship affecting content.

Vulnerability: Increased susceptibility to harm or influence because of personal or situational conditions.

Algorithmic bias: Systematic unfairness arising from data, design or deployment of an algorithm.

Data breach: Unauthorised access, disclosure, alteration or loss of information.

Accountability: The duty to comply and demonstrate compliance.

Review Questions

Short Answer Questions

1. What are the essential characteristics of informed consent?
2. Distinguish anonymisation from pseudonymisation.
3. Why must objective advertising claims be substantiated before publication?
4. Give two safeguards for research involving vulnerable participants.
5. Why is deleting sensitive attributes not always sufficient to prevent algorithmic bias?

Long Answer Questions

1. Explain how privacy, confidentiality and data protection differ and how they work together in a research project.
2. Describe a proportionate research-governance process for a study collecting behavioural data through a mobile application.
3. Discuss the legal and ethical risks of influencer advertising and propose controls for a brand manager.
4. Analyse the relationship between advertising substantiation, transparency and consumer trust.
5. Explain why algorithmic fairness requires both technical testing and human governance.

Analytical / Application Questions

1. A survey company wants to collect participants’ exact locations, full birth dates and social-media handles for a packaging study. Evaluate the proposal and recommend a proportionate design.
2. A retailer targets people inferred to be in debt with an urgent high-cost credit offer. Identify the ethical and governance risks and design a safer alternative.
3. An algorithm delivers a recruitment advertisement mostly to one demographic group even though the campaign was intended for the entire adult population. Set out an investigation, remediation and monitoring plan.

Multiple Choice Questions with Answers

Question 1

Which feature is essential to informed consent?

A. Participation is mandatory once a person opens the survey

B. The participant receives understandable information and can choose freely

C. The researcher withholds all information to avoid bias

D. Consent is permanent and cannot be withdrawn

Correct Answer: B. The participant receives understandable information and can choose freely

Question 2

Which action best reflects data minimisation?

A. Collecting exact GPS coordinates when only region is needed

B. Retaining every field indefinitely for possible future use

C. Collecting only the information necessary for the stated purpose

D. Sharing all collected fields with every vendor

Correct Answer: C. Collecting only the information necessary for the stated purpose

Question 3

What should normally exist before an objective advertising claim is published?

A. Reliable evidence that matches the claim and its conditions

B. A competitor’s unverified statement

C. A prediction that the claim will probably be true

D. A disclaimer hidden in a footer

Correct Answer: A. Reliable evidence that matches the claim and its conditions

Question 4

Which statement about pseudonymisation is correct?

A. It makes re-identification impossible in every circumstance

B. It replaces identifiers with codes but may permit re-identification

C. It eliminates the need for security controls

D. It means that data is no longer personal data under every law

Correct Answer: B. It replaces identifiers with codes but may permit re-identification

Question 5

An influencer receives a free product for a review. What is the appropriate practice?

A. Hide the relationship to preserve authenticity

B. Disclose the material commercial relationship clearly

C. Disclose it only if the review is negative

D. Ask the audience to infer the relationship

Correct Answer: B. Disclose the material commercial relationship clearly

Question 6

Which group generally requires heightened safeguards in marketing research?

A. Adults who freely volunteer for a low-risk anonymous survey

B. Professional researchers conducting internal analysis

C. Children participating in a data-intensive study

D. A company’s legal advisers

Correct Answer: C. Children participating in a data-intensive study

Question 7

Why can an apparently accurate targeting algorithm still be unfair?

A. Accuracy always proves fairness

B. It may reproduce historical exclusion or impose unequal errors

C. Algorithms cannot use data

D. Fairness is determined only by overall conversion rate

Correct Answer: B. It may reproduce historical exclusion or impose unequal errors

Question 8

Which item belongs in a research governance file?

A. An undocumented verbal approval

B. A data-flow map and retention schedule

C. Only the final campaign slogan

D. A list of competitors’ private passwords

Correct Answer: B. A data-flow map and retention schedule

Question 9

Which is an intellectual-property risk?

A. Using a properly licensed image within its permitted media

B. Creating an original slogan

C. Reproducing a competitor’s protected campaign without permission

D. Recording the date of a research interview

Correct Answer: C. Reproducing a competitor’s protected campaign without permission

Question 10

What is the strongest reason to use contextual rather than health-inference targeting in the PulseFit case?

A. It can reduce reliance on sensitive inferred information

B. It guarantees every advertisement will be profitable

C. It removes the need for truthful claims

D. It makes consent legally irrelevant

Correct Answer: A. It can reduce reliance on sensitive inferred information