03 · What You Need to Know
Understanding the Scope and Limitations of Broad Consent for AI Research
What Is Broad Consent?
Broad consent generally refers to an arrangement in which participants agree to specified categories of future research uses without necessarily knowing every individual study that may subsequently be conducted.
For example, participants may agree that their interview information can be retained and reused for future studies concerning educational technology and teaching practices.
The specific meaning and legal effect of broad consent depend on the governing research ethics framework.
Under the United States Common Rule, broad consent has a particular regulatory meaning concerning storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens under specified conditions.
Researchers should therefore avoid assuming that every consent statement permitting future research qualifies as broad consent under 45 CFR 46.
Outside that framework, institutions may use related but different arrangements for future research use.
Broad Consent Is Not the Same as Blanket Consent
A central distinction concerns whether the participant's agreement has meaningful boundaries.
Broad consent
Agreement to defined categories of future research under specified conditions, even when individual future studies are not fully known.
Blanket or unrestricted consent
An open-ended claim of permission for any future use without meaningful limitations on purposes or processing.
For example, agreement to future studies examining teaching and learning technologies may provide a more meaningful description of anticipated research than a statement allowing any organization to use participant information for any purpose.
However, the adequacy of either statement depends on the applicable ethical and legal requirements.
Researchers should not treat broad consent as unrestricted permission simply because participants accepted future research uses.
Why AI Complicates Future Research Consent
Generative AI may introduce analytical possibilities that were not anticipated when participants originally provided their information.
For example, a researcher may initially collect interviews about instructors' use of digital learning platforms. Several years later, AI tools may be capable of generating detailed classifications, linking information across datasets, or suggesting sensitive characteristics from those interviews.
These capabilities do not automatically make every future analysis ethically acceptable.
The researcher should examine whether the proposed activity remains within the original research purposes and whether the new processing introduces additional risks or recipients.
Technological capability can expand faster than the permissions under which the original information was collected.
Broad consent should therefore be interpreted according to its actual scope rather than the full range of analyses that future AI systems might make possible.
What Future AI Activities Might Broad Consent Cover?
The answer depends on the original consent language and applicable requirements.
| Proposed Future Activity |
Possible Consent Consideration |
What Researchers Should Examine |
| AI-assisted organization of interviews for a related educational technology study |
May fall within defined future research purposes. |
Original scope, provider arrangements, and authorization. |
| AI-assisted comparison of previously collected teaching experiences |
May be compatible with the original research category. |
Whether the analytical purpose and safeguards remain consistent. |
| External AI processing of identifiable transcripts |
May introduce a new information recipient or processing arrangement. |
Confidentiality, consent scope, and data-protection requirements. |
| AI inference of psychological characteristics |
May exceed the original research purpose. |
Necessity, measurement validity, sensitivity, and authorization. |
| AI model training using participant interviews |
May involve a distinct purpose from research analysis. |
Whether training use was authorized and adequately explained. |
| Sharing data with new research collaborators using AI |
May change recipients or access arrangements. |
Original sharing conditions and institutional requirements. |
These examples do not establish that any particular activity is automatically permitted or prohibited.
The relevant question is whether the future use is consistent with the specific agreement and applicable institutional and legal requirements.
What Does the United States Common Rule Say About Broad Consent?
The revised Common Rule includes provisions concerning broad consent for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens.
Section 46.116(d) identifies elements of broad consent, including descriptions of the types of research that may be conducted, identifiable information that may be used, and other relevant conditions.
However, broad consent is not the only possible regulatory pathway for secondary research under the Common Rule.
Depending on the circumstances, secondary research may qualify for an exemption or another authorized arrangement under the applicable provisions.
Researchers should also recognize that Common Rule broad consent operates within specific regulatory conditions and should not be equated automatically with general permission for future AI processing.
The appropriate institutional review process should determine whether a proposed secondary use satisfies the applicable requirements.
What Does the GDPR Say About Future Research?
Under the GDPR, scientific research may receive particular consideration concerning purpose limitation and further processing, subject to applicable safeguards and conditions.
Recital 33 recognizes that it may not always be possible to fully identify the purpose of personal data processing for scientific research at the time of collection and discusses consent to certain areas of scientific research where recognized ethical standards are observed.
However, Recital 33 should not be interpreted as authorizing unrestricted consent for every future AI activity.
Where consent is relied upon as the lawful basis, its validity and specificity must still be evaluated under the applicable provisions.
Researchers should also distinguish the compatibility of further research processing from the existence of a lawful basis and other applicable requirements.
Scientific research does not automatically exempt AI processing from transparency, security, data minimization, or relevant safeguards.
What About Broad Consent Under the Philippine Data Privacy Act?
In the Philippines, Republic Act No. 10173 establishes principles of transparency, legitimate purpose, and proportionality in personal information processing.
Consent, where relied upon, should be evaluated according to the Act's requirements and the circumstances of the proposed processing.
The Act also contains provisions relevant to research-related processing, but these should not be interpreted as providing unrestricted permission for every secondary use of participant information.
For example, a university researcher should not assume that consent to future educational research automatically authorizes transferring identifiable transcripts to any external AI provider.
The institution should evaluate the applicable legal basis, purpose, recipients, safeguards, and data subject rights.
Researchers should consult institutional ethics and data-protection personnel when future AI processing differs from the arrangements originally explained.
Does Broad Consent Cover AI Tools That Did Not Exist When Participants Consented?
Potentially. The absence of a particular tool at the time of consent does not automatically mean that its future use is prohibited.
For example, participants may have agreed to future research analysis under specified confidentiality and institutional conditions without naming every analytical technology that might later become available.
A newer AI tool may be compatible with those conditions.
However, a new system may also introduce processing arrangements or risks that differ substantially from what participants were told.
Researchers should therefore examine the function and consequences of the technology rather than rely solely on whether it existed at the time of consent.
Broad consent should not be interpreted as automatically expanding whenever technology becomes more capable.
Why the Future Research Purpose Matters
The scope of future research purposes is central to evaluating broad consent.
For example, participants may agree to future studies concerning educational technology adoption.
Using their interviews to investigate teaching practices may fall within that general research area, depending on the wording and authorization.
However, using the same interviews to infer unrelated personal characteristics may involve a different purpose.
The fact that the information can technically support an AI-generated prediction does not establish that the prediction is authorized.
Researchers should identify whether the future study addresses the agreed research category or introduces a new purpose requiring further consideration.
Does Broad Consent Automatically Authorize External AI Providers?
No. Agreement to future research use does not necessarily establish permission for every external processing arrangement.
For example, participants may have agreed that their interviews would be retained for future studies conducted by authorized university researchers.
Submitting those interviews to an external AI provider may introduce another organization into the information flow.
Whether that processing is covered depends on the original agreement, provider conditions, applicable legal requirements, and institutional authorization.
Researchers should distinguish future research permission from authorization to disclose information to additional recipients.
The question is closely related to whether consent to data sharing includes AI processing.
Can Broad Consent Cover AI Model Training?
Not automatically. Using participant information to train or improve an AI model may differ from using AI to analyze information for a research question.
For example, a researcher may use a model to summarize interview excerpts without permitting the provider to use those excerpts for general model training.
Another arrangement may involve using the interviews as training data for a new research model.
These activities have different purposes and potentially different consequences.
Researchers should establish whether the original consent and applicable authorization cover the proposed training activity.
A broad statement permitting future research analysis should not automatically be interpreted as permission for unrestricted model development or provider reuse.
Does De-Identification Resolve Broad Consent Concerns?
De-identification may reduce privacy risks and affect which legal requirements apply, but it does not automatically establish permission for every future use.
For example, removing names from interview transcripts may leave contextual details that identify participants through distinctive professional experiences.
Even where information is genuinely anonymous, institutional agreements or ethical commitments may restrict future use.
Researchers should examine both the identifiability of the information and the conditions under which it was collected.
They should not assume that removing direct identifiers converts a restricted dataset into information available for any AI application.
Can Broad Consent Include Future Sensitive Inferences?
Potentially sensitive AI-generated inferences require particular caution.
For example, a future researcher may propose using previously collected teaching interviews to infer participants' psychological characteristics or personal beliefs.
Such inferences may not have been anticipated when the original broad consent was obtained.
They may also lack methodological validity or fall outside the agreed research purpose.
Researchers should evaluate whether generating the inferred characteristics is necessary, justified, and appropriately authorized.
Even where the original consent permits future research, it does not establish that every new personal inference should be generated.
The related concern is examined in AI inference of unreported participant characteristics.
Should Broad Consent Mention AI Explicitly?
Where future AI processing is reasonably anticipated and material to participant understanding, explaining its possible role may improve transparency.
For example, a participant information sheet might state that future authorized research may involve automated or AI-assisted analysis of retained information.
However, simply adding the words "including artificial intelligence" does not necessarily establish meaningful consent for every possible future use.
The statement should describe the permitted research purposes, relevant processing arrangements, and safeguards at a level appropriate to the governing framework.
Researchers should also avoid promising that all future AI systems will operate under identical conditions.
Future processing arrangements may require additional institutional review even when AI is mentioned in the original consent materials.
How Should Researchers Write Broad Consent Language?
Broad consent language should describe the intended categories of future research without suggesting unlimited permission.
Illustrative Broad Consent Language
Future AI-Assisted Analysis of Research Information
"With your agreement, information collected during this study may be retained and used for future research concerning educational technology and teaching practices, subject to applicable institutional approval and data-protection requirements. Future authorized studies may use computational or AI-assisted methods to organize and analyze the information. Such processing will be limited to purposes and arrangements permitted under the applicable research and data governance conditions. Any future activity requiring additional participant information or consent will follow the relevant institutional procedures."
This example is not a universal broad consent template and does not establish that all future AI processing is authorized.
Where the United States Common Rule's broad consent provisions apply, the required elements under 45 CFR 46.116(d) must be addressed.
Researchers should adapt the wording to the actual research categories, retention arrangements, data recipients, and applicable institutional requirements.
What if Participants Decline Broad Consent?
Researchers should distinguish participation in the current study from agreement to future uses where the applicable research arrangements permit separate choices.
For example, a participant may agree to an interview but decline optional future reuse of their information.
The research team should follow the approved consent conditions and avoid treating refusal of optional future research as permission for later AI analysis.
Under the United States Common Rule, particular consequences may arise when an individual is asked for broad consent under the regulatory provisions and refuses it, including restrictions concerning certain waiver pathways.
Researchers should not assume that a declined broad consent request can simply be bypassed through another procedure without examining the applicable rules.
Institutional review is particularly important when future secondary research is contemplated.
Can Participants Withdraw Broad Consent Later?
The available withdrawal rights and their effects depend on the governing framework and the consent arrangements.
For example, participants may be able to withdraw permission for certain future uses, subject to applicable limitations.
However, withdrawal does not necessarily reverse analyses already completed or require immediate deletion of every record retained under other lawful or institutional obligations.
Researchers should explain the actual withdrawal conditions rather than promise unrestricted retroactive deletion.
Where future AI processing is involved, the research team should also consider whether information has already been submitted to an external provider and what deletion arrangements apply.
The distinction between stopping future processing and removing previously processed information should remain clear.
How Can Researchers Evaluate a Future AI Study Against Broad Consent?
A useful approach is to compare the proposed future research with the original consent materials.
The researcher should examine the permitted research purposes, information categories, retention conditions, authorized recipients, and any relevant limitations.
Next, the researcher should identify what the proposed AI system will do and whether its processing arrangements introduce material differences.
Finally, the appropriate institutional authority should determine whether the proposed activity is covered by existing authorization or requires additional review or participant agreement.
This evaluation should occur before protected information is transferred to a new AI service.
How Should You Prompt AI to Review Broad Consent Coverage?
Generative AI may assist with comparing consent language against a proposed future analysis, but it should not determine legal or ethical authorization independently.
Illustrative AI Prompt
Evaluating Future AI Analysis Against Existing Broad Consent
"I am considering a future AI-assisted analysis of research information collected under a broad consent arrangement. I will provide the original consent language, participant information sheet, approved research purposes, data categories, proposed future study, AI processing workflow, verified provider conditions, and applicable institutional requirements. Compare the proposed analysis with the original consent scope. Identify possible differences involving research purposes, data recipients, sensitive inferences, retention, and participant rights. Distinguish confirmed inconsistencies from matters requiring institutional interpretation. Suggest questions for ethics and data-protection review without declaring that broad consent automatically authorizes the activity or that reconsent is always necessary."
The researcher should verify the resulting assessment and obtain the appropriate institutional determination.
Identifiable participant information should not be uploaded to an unauthorized AI service merely to evaluate whether that service may be used.
What If the Future AI Analysis Falls Outside the Original Consent?
If the proposed activity exceeds the original consent or authorization, the research team should not proceed on the assumption that broad consent provides unrestricted permission.
Depending on the applicable framework, the institution may determine whether additional consent, another lawful processing basis, a permitted secondary research pathway, or a revised research design is appropriate.
Researchers should not independently assume that a waiver is available or that the scientific value of the new analysis automatically overrides participant expectations.
Where the necessary conditions cannot be satisfied, the proposed AI analysis may need to be modified or abandoned.
The appropriate response is similar to the broader question of whether AI-related processing changes require reconsent.
Why Broad Consent Should Not Become an Ethical Shortcut
Broad consent can support valuable future research by allowing appropriately defined secondary uses without requiring every future analytical question to be known at recruitment.
However, it should not become a mechanism for avoiding scrutiny of new technologies or processing arrangements.
For example, the existence of broad consent does not establish that an external AI provider has appropriate safeguards or that AI-generated participant classifications are methodologically valid.
Researchers should distinguish permission for future research from the separate responsibility to evaluate each proposed use under applicable conditions.
The value of broad consent lies in enabling appropriately governed future research, not removing the boundaries of that governance.
