Online surveys is designed to protect respondent anonymity. Online surveys does not use cookies for survey completion and external tracking software such as Google Analytics is not supported on online surveys. Additionally, you cannot access any information about respondents’ IP addresses.
However, the anonymity of survey responses ultimately depends on the survey design decisions you make.
If respondent anonymity is a key aspect of an online survey, then we suggest that you carefully consider the following aspects of your survey design:
1. Survey questions
- Do any of the survey questions ask the respondent to provide directly identifying information? (e.g. name, address, phone number, etc.).
- Do the survey questions ask for demographic information to such a level of specificity that a participant can be indirectly identified? (e.g. asking a respondent to provide their age, ethnicity, gender, occupation, workplace and department may provide enough information for them to be identified).
- If pre-population parameters are being used, does any of the pre-populated information directly or indirectly identify the respondent? (e.g. pre-populating student/staff numbers into the responses will compromise the anonymity of responses).
2. Survey distribution
If the survey is only being disseminated to a small group of potential respondents, the likelihood that a respondent can be identified from their responses is quite high. You should consider whether the survey population is wide and diverse enough to maintain the anonymity of individual respondents.
3. Survey access control
Respondent access to a survey can be controlled either by setting a survey password or setting up a respondent list.
3.a. Survey password
The use of a survey password does not necessarily compromise respondent anonymity, however you should ensure, as per point 2. above, that the survey password is provided to a wide and diverse enough population that respondents cannot be easily identified.
3.b. Respondent list
Setting up a respondent list allows you to restrict access to a predefined group of respondents, via either a username/password login or a personalised URL.
If a respondent list has been set up, the survey can only be completed once by each listed respondent. You can also use up to 10 pre-population parameters for each respondent, so that information that is already known about the respondents can be pre-filled in to the survey responses.
Using a respondent list does mean that the survey population can be identified, but it is still possible for the survey responses to be anonymous.
To maintain respondent anonymity, you must ensure that no identifying information from the respondent list is captured in the survey responses – this means that the username, email address and token fields must not be used as pre-population parameters in the survey.
You should also take care to ensure that any information entered into the x1-x10 pre-population parameters does not directly or indirectly identify the participants (as per point 1. above).
Maintaining respondent anonymity in this way means that the email tool and the respondent tracking functionality within online surveys cannot be used.
4. Tracking who has/has not completed the survey, and using the inbuilt email/reminder tool
To enable both the email tool and the tracking of finished/unfinished respondents, it is necessary to set up a respondent list and then capture identifying information about the respondents in the survey responses. This information can be purged (permanently and irretrievably deleted) from the survey responses at any time, even while the survey is open.
However, in the period of time between the identifying information being captured in the responses, and the information being purged from the responses, it is possible for anyone with access to both the results and the respondent list to identify which respondent provided a particular response.
It is also always possible to identify the first respondent to provide a response (during the period of time that the survey only has one response), even if the identifying information is purged immediately after it has been captured.
We therefore do not recommend enabling the respondent tracking and/or the inbuilt email tool functionality if respondent anonymity is a key aspect of your survey.
Should you wish to make use of the respondent tracking/email functionality, it is theoretically possible to maintain respondent anonymity if:
- the survey is being run from an Organisation account, where survey permissions can be restricted; and
- the management of the survey can be split between two online surveys users.
In this scenario, one online surveys user has access to the Distribute tab (including the respondent list) but not the Analyse tab, and therefore cannot view any results information. This person can keep track of who has and has not completed the survey, and can send email invitations and reminders, but cannot see any responses.
A second online surveys user has access to the Analyse tab (and therefore the responses) but not the Distribute tab, so they are unable to view the respondent list, nor can they see the information that shows who has and has not completed the survey.
For anonymity to be maintained in this scenario, it is imperative you set the survey up so that the information captured in the responses necessary to activate the respondent tracking and email functionality is non-identifying when viewed independently of the respondent list (e.g. the online surveys-generated token is used, or random usernames). This will ensure that the person with access to the responses is not able to use the pre-populated information to tie back a response to a respondent’s identity.
Should more than two people have access to the survey, access must be restricted so that no one person has simultaneous access to the Analyse and Distribute tabs until the survey has been closed and the identifying information has been purged.