IRBs are an American institution. My understanding is that research ethics in Europe are governed by inter-institutional ethics committees, but only for biomedical research (i.e. clinical trials).
That aside, IRBs have been very slow to adjust review procedures for online studies. For example, the nonmedical IRB at Cornell determined that the Facebook emotional contagion experiment was outside of its jurisdiction, since Facebook was the data collection agent-- from their perspective the Cornell researchers were working with a pre-existing dataset. So it's not necessarily the case that ethics review is a silver bullet for cases like this.
It's not clear to me that we have a good understanding of what ethical responsibility looks like in this domain, in large part because the organization of research on online behavior (a joint venture between social scientists, software engineers, universities, companies like OKCupid, etc.) is still poorly understood by most of the academic world.
That aside, IRBs have been very slow to adjust review procedures for online studies. For example, the nonmedical IRB at Cornell determined that the Facebook emotional contagion experiment was outside of its jurisdiction, since Facebook was the data collection agent-- from their perspective the Cornell researchers were working with a pre-existing dataset. So it's not necessarily the case that ethics review is a silver bullet for cases like this.
It's not clear to me that we have a good understanding of what ethical responsibility looks like in this domain, in large part because the organization of research on online behavior (a joint venture between social scientists, software engineers, universities, companies like OKCupid, etc.) is still poorly understood by most of the academic world.