Digital clinical-trial recruitment advertising: what FDA and Health Canada expect, including tracking pixels and IRB/REB review

Recruitment advertising is one of the few sponsor-facing activities that regulators treat as an extension of the informed consent process rather than as marketing. That framing drives almost everything below: content limits, prohibitions on efficacy claims, and mandatory ethics-committee review apply to a banner ad or a social-media post exactly as they apply to a printed flyer. Where digital methods add new questions, chiefly around tracking pixels and web analytics, the named FDA and Health Canada guidance is largely silent, and the obligation shifts to the IRB/REB privacy review and to general data-protection law.

FDA: advertising is the start of the consent process

FDA's foundational position is that direct advertising for study subjects is "the start of the informed consent and subject selection process," not a separate promotional activity ¹⁵. That has two consequences. First, the ad's content is bounded by what the approved consent form and protocol already say. Second, the IRB has to review it.

What an ad may contain. FDA expects advertisements to be limited to the information a prospective subject needs to decide whether they are interested and potentially eligible ¹⁵. Appropriately worded ads may include the name and address of the clinical investigator or facility, and the condition under study or purpose of the research ¹. A "basic information" listing, if confined to the study title, purpose, a protocol summary, basic eligibility criteria, site locations, and contact information, does not require IRB review ³.

What is coercive or misleading. FDA's line items here are specific and long-standing ¹²:

• Ads should not be unduly coercive and should not promise a certainty of cure or a favorable outcome beyond what is stated in the consent document and protocol ¹².
• Ads should not claim, explicitly or implicitly, that the investigational drug, biologic, or device is safe or effective for the purpose under study, or that it is equivalent or superior to any other product. FDA treats such claims as both misleading and a violation of the rules against promoting investigational products ¹².
• Ads should not use "new treatment," "new medication," or "new drug" without explaining that the article is investigational ¹².
• Ads should not promise "free medical treatment" when the intended meaning is only that subjects will not be charged for participating ¹.
• Ads may state that subjects will be paid, but should not emphasize the payment or the amount through larger or bold type ¹.

The IRB's role. FDA expects IRBs to review and approve recruitment advertising, and it must review all materials used in the informed consent process, advertisements included ¹³. Any posting that provides more than the "basic information" described above should be submitted for IRB review ³. The IRB reviews both the content of the ad and the mode of communication, to confirm the process is not coercive and does not imply benefits beyond the consent form and protocol ¹². For print ads the IRB should see the final copy, including type size and visual effects; for broadcast ads it should review the final audio or video ¹. Where the ad wording maps cleanly onto the approved consent document, the IRB chair or a designated member may use expedited review; if there are doubts or complicating issues, the ad should go to a convened meeting ¹⁶. A copy of the advertisement should be submitted for IRB review whenever advertising will be used to recruit subjects, a point FDA's Bioresearch Monitoring (BIMO) inspection program reinforces ⁴. Device sponsors get parallel treatment in FDA's guidance on preparing notices of availability of investigational devices and recruiting subjects ².

FDA on digital and social-media recruitment

FDA's more recent guidance actively encourages online and social-media recruitment. Its enrollment-practices guidance advises sponsors to use online and social-media strategies to reach participants who would not be captured by a traditional referral center, and to use social-media sites that target the relevant population ⁷¹⁰. It also contemplates digital communication tools, secured email, social-media platforms, and other digital health technology tools, in trial conduct and participant interaction ⁸.

What that guidance does not do is restate the IRB-review obligation in digital terms. In the passages retrieved, the only IRB-specific point is that participant payment may raise questions the IRB should address ⁸. The operative rule therefore still comes from the recruiting-subjects and informed-consent guidance: because digital ads, banner ads, and social posts are recruitment materials used in the consent process, they carry the same IRB-review requirement and the same content limits as any other advertisement ¹³. Nothing in the digital-recruitment guidance carves out an exception.

Tracking pixels, cookies, and web analytics: a guidance gap

This is where sponsors most often want a clear rule and where the named FDA guidance does not provide one. Across the FDA guidance corpus, no document addresses tracking pixels, cookies, web analytics, cookie banners, browser fingerprinting, or cross-site tracking on recruitment websites. What FDA does address is privacy and data security for digital tools in general:

• Its digital health technologies (DHT) guidance says sponsors should build in cybersecurity safeguards, prevent unauthorized access, and protect the privacy and security of collected data, including secure transmission and storage for remote assessments ²⁸.
• The ICH E6(R3) Good Clinical Practice Annex 2 draft says sponsors should ensure security safeguards, including cybersecurity, to protect the privacy and confidentiality of participants' personal information and to address breach risk ¹².
• The Diversity Action Plans draft guidance contemplates posting information on a sponsor website and linking it to a recruitment website, without addressing what tracking technologies may run on those pages ¹¹.
• The enrollment-practices guidance tells sponsors to maintain patient privacy and to obtain and maintain permissions when using identifiable EHR data ⁷, and the Patient-Focused Drug Development guidance notes that when scraping web or social-media content, permissions may be needed and privacy laws around public versus private data apply ²⁹.

The practical reading for a regulatory reviewer: FDA's guidance gives you a privacy-and-security expectation and treats the recruitment page as consent-process material, but it does not tell you how to configure analytics on a recruitment site. That configuration question is governed instead by the IRB's privacy assessment of the recruitment plan and by general US data-protection law, notably HHS Office for Civil Rights enforcement of HIPAA on online tracking technologies where the site handles protected health information. Those instruments sit outside the FDA guidance reviewed here, so a sponsor should treat pixel and analytics decisions as a privacy-law and IRB question, not as a settled FDA guidance point.

Health Canada: the same logic, routed through the REB

Health Canada does not publish a standalone recruitment-advertising policy in the way FDA does. Its Clinical Trial Applications guidance instead ties recruitment materials to the ethics package: before a site initiates a trial or implements an amendment, the protocol and informed consent form (ICF) must be reviewed and approved by a Research Ethics Board (REB) ⁴², and the sponsor must obtain REB approval for each site before starting there ⁶⁰. The REB is defined as an independent body whose mandate is to protect the rights, safety, and well-being of participants through approval and periodic review of the research ⁴⁰.

Because the REB approves the protocol and ICF, recruitment materials must be consistent with those approved documents ⁴²⁶³. The ICF itself must describe the risks and anticipated benefits to the participant's health and all other aspects of the trial the person needs in order to decide whether to participate, prepared in line with applicable consent law, ICH E6, and the Tri-Council Policy Statement (TCPS 2) ⁴⁹⁵³. The sponsor must keep on file an REB attestation confirming the REB reviewed and approved the protocol and ICF and that it operates consistently with good clinical practice ⁵¹⁶³, and any prior REB refusal must be reported with the clinical trial application ⁵³.

On the two digital-specific questions, Health Canada's guidance is thinner than FDA's. The Clinical Trial Applications document does not state specific advertising-content rules or prohibited claims, does not set privacy limits specific to recruitment advertising beyond the general requirement to keep enrollment records sufficient to identify and contact subjects if the drug may endanger health ⁵¹, and does not address online, social-media, or other electronic recruitment advertising directly ⁴²⁵³. In practice, the content and claim limits come from ICH E6 and TCPS 2 as applied by the REB, and the tracking-technology and privacy questions fall to the REB's review together with Canadian privacy law (PIPEDA and provincial health-privacy statutes such as Ontario's PHIPA), rather than to a Health Canada advertising guidance.

Bottom line for sponsors

Treat every recruitment touchpoint, print, broadcast, banner, or social post, as consent-process material subject to IRB (US) or REB (Canada) review before use, and keep the content within the four corners of the approved consent form: no efficacy or safety claims, no "new drug" language without the investigational caveat, no over-emphasized payment, no promise of benefit ¹²⁴²⁶³. Both agencies encourage digital and social-media recruitment ⁷⁸¹⁰, but neither the FDA nor the Health Canada guidance reviewed here sets rules for tracking pixels, cookies, or web analytics on recruitment sites. Sponsors should therefore document those choices through the ethics committee's privacy review and applicable data-protection law, and expect the analytics configuration on a recruitment website to be scrutinized as a privacy matter even though it is not named in the recruitment guidance itself.