 As a result, researchers using the Internet as a tool for and/or a space of research—and their research ethics boards (REBs), also known as institutional review boards (IRBs) in the United States or human research ethics committees (HRECs) in other countries such as Australia—have been confronted with a series of new ethical questions: What ethical obligations do researchers have to protect the privacy of subjects engaging in activities in “public” Internet spaces? What are such public spaces? Is there any reasonable expectation of privacy in an era of pervasive and ubiquitous surveillance and data tracking? How is confidentiality or anonymity assured online? How is and should informed consent be obtained online? How should research on minors be conducted, and how do you prove a subject is not a minor? Is deception (pretending to be someone you are not, withholding identifiable information, etc.) an acceptable online norm or a harm? How is “harm” possible to someone existing in an online space? How identifiable are individuals in large data sets? Do human subjects protections apply to big data? As more industry-sponsored research takes place, what ethical protections exist outside of current regulatory structures? As laws, such as the EU’s General Data Protection Regulation (GDPR 2016) are enacted, what are the global implications for data privacy and individual rights?