What Is Dynamic Consent in Biobanking? A Guide
Dynamic consent in biobanking is a digital, ongoing model of consent in which participants use a secure online interface to see how their samples and data are being used, change their consent choices over time, and receive information about new studies, rather than signing a single form once at enrollment. It turns consent from a one-time event into a continuing relationship between a biobank and the people who give it their data.
Why dynamic consent matters now
Biobanks collect samples and data for research that has not yet been imagined. A participant who enrolled fifteen years ago agreed to a description of research written before whole-genome sequencing became routine, before linkage to electronic health records was common, and before machine learning models could be trained on population-scale data. Traditional consent forms cannot anticipate that change, so biobanks have relied on broad consent: permission for a wide range of future research, overseen by ethics committees and access governance.
Broad consent remains ethically and legally accepted in many jurisdictions. Recital 33 of the EU General Data Protection Regulation (GDPR) explicitly recognizes that it is often not possible to fully identify the purpose of processing for scientific research at the time of collection. But broad consent has a weakness: once given, participants rarely hear from the biobank again. Public trust has become a hard operational constraint. When approved researchers walked UK Biobank data out through a centralized platform’s normal workflow in May 2026, the lesson was that people care about what happens to their data after they hand it over, and they expect custodians to show them. Dynamic consent is one of the most direct ways to do that.
The term itself comes from academic work on research networks. Kaye and colleagues described dynamic consent in the European Journal of Human Genetics in 2015 as a personalized digital communication interface that connects researchers and participants and places participants at the heart of decision making.
How dynamic consent works
The participant interface
At the center of dynamic consent is a secure portal or app. Participants log in to see what they agreed to, read plain-language summaries of studies using their data, and set preferences. Typical choices include whether their data can be used by commercial researchers, whether they want to be recontacted about new studies, whether they want to receive individual research results, and which categories of research they support.
Granular, changeable preferences
Unlike a signed form, preferences can be updated at any time. A participant might agree to academic research but not commercial use, then change their mind after reading how a pharma collaboration benefits patients. Withdrawal is one option among many rather than the only lever a participant has.
Two-way communication
Dynamic consent is also a communication channel. Biobanks can report findings, explain new uses, and ask for specific consent where a study goes beyond the original scope, such as recontact for a clinical trial.
A machine-readable consent record
Behind the interface sits a consent registry: a structured, auditable record of each participant’s current preferences and their history. This is the part most programs underestimate. Preferences only matter if every analysis respects them, which means the registry must be connected to the systems where research actually happens.
The Federated TRE angle: enforcing consent where the data lives
The hard problem in dynamic consent is not the portal. It is enforcement. If a participant withdraws commercial consent on Tuesday, every analysis run by a commercial researcher from Wednesday must exclude their data. In a centralized model where data has been copied into researcher workspaces, cloud buckets, and downstream extracts, that promise is almost impossible to keep. Each copy must be found and updated, and copies that have already left the platform cannot be recalled.
A federated Trusted Research Environment (TRE) changes the mechanics. Because data never leaves the source, there is one authoritative copy at the custodian. The consent registry sits alongside it, and consent flags can be applied as a filter at the moment a query or workflow runs. A change in preference takes effect on the next analysis without chasing copies across the internet. Outputs pass through an automated airlock that releases only reviewed, aggregate results, so individual-level data that a participant later restricts was never distributed in the first place.
This is the architectural point: dynamic consent is a promise about the future use of data, and only an architecture that keeps data at source can keep that promise reliably. Our explainer on automated airlocks in a TRE describes how outputs are controlled, and the Lifebit Federated Trusted Research Environment page describes the platform model.
Consent models compared
| Model | What participants agree to | Can preferences change? | Ongoing contact | Enforcement burden |
|---|---|---|---|---|
| Specific consent | One named study | Only by withdrawal | Usually none after the study | Low per study, but new consent needed for each new use |
| Broad consent | A wide range of future research under governance | Only by withdrawal | Minimal | Low, relies on access committees |
| Tiered consent | A menu of categories chosen at enrollment | Rarely in practice | Minimal | Medium, categories must be tracked per participant |
| Meta-consent | How and when they want to be asked for consent in future | Yes | As the participant specifies | High, requires recording consent preferences about consent |
| Dynamic consent | Ongoing, granular choices through a digital interface | Yes, at any time | Continuous, two-way | High, every analysis must check current preferences |
Real-world examples
Dynamic consent has moved from theory into working research programs. The RUDY study in the UK, which studies rare diseases of the bones, joints, and blood vessels, used an online dynamic consent platform so participants with rare conditions could manage their involvement and choose how they wished to be contacted. The CHRIS study, a population-based study in South Tyrol, Italy, adopted a dynamic consent approach to keep participants informed and involved over time. Academic evaluations of these programs, including a 2017 review by Budin-Ljøsne and colleagues in BMC Medical Ethics, describe dynamic consent as a practical response to the challenges of long-lived research resources, while also noting implementation costs and questions of digital inclusion.
Large national programs increasingly combine broad consent at enrollment with digital tools for ongoing communication and preference management, which is a pragmatic middle path between a static form and full dynamic consent.
A practical framework for implementing dynamic consent
- Decide what is actually changeable. Separate choices that participants can adjust (commercial use, recontact, return of results) from conditions that are fixed by law or ethics approval. Offering a choice you cannot enforce damages trust more than not offering it.
- Build the consent registry first. Model each preference as structured data with a timestamp and history. Where possible, align categories with the GA4GH Data Use Ontology so that consent terms can be matched automatically against the stated purpose of a data access request.
- Connect the registry to the analysis environment. Consent must filter cohorts at query time inside the TRE. If preferences live in a separate system that researchers never touch, they are decorative.
- Design for inclusion. Offer offline and assisted routes for participants without reliable internet access or digital confidence, and write in plain language. A consent model that only digitally confident people can use skews both participation and research results.
- Keep the communication promise. Plan who writes study summaries, how often participants hear back, and how research findings are reported. Silence after a dynamic consent launch undermines the model.
- Audit end to end. For any output, you should be able to show which consent state applied to the cohort at the time of analysis. This is also what regulators and ethics committees will ask for.
Common pitfalls and objections
“Participants will be overwhelmed”
Consent fatigue is real. The answer is sensible defaults and a small number of meaningful choices, not dozens of switches. Participants can engage deeply if they want to and ignore the portal if they are content with their current settings.
“Dynamic consent will shrink our cohorts”
Some participants will restrict certain uses. That is the point: the data you analyze reflects what people agreed to. Programs that invest in transparency often find that engagement builds trust rather than eroding participation, though every biobank should measure this for itself.
Confusing ethical consent with the GDPR legal basis
Under GDPR, research processing often relies on a legal basis other than consent, such as public interest, with safeguards under Article 89. Dynamic consent can still serve as an ethical safeguard and a trust mechanism even where consent is not the legal basis. Be precise about which role it plays, and see our guide to the GDPR Article 89 research exemption.
Underestimating the cost of enforcement
The portal is the visible part and often the cheapest. The expensive part is making sure every copy of the data respects current preferences. Keeping data at source reduces that cost dramatically.
What to do next
Start by mapping where your participants’ data currently lives, including every extract and researcher workspace. If the answer is “in many places,” fix the architecture before you launch a consent portal, because a promise you cannot enforce is worse than no promise. Then define a small set of changeable preferences, build a structured consent registry, and connect it to the environment where analysis happens.
Frequently asked questions
What is dynamic consent?
Dynamic consent is an ongoing, digital approach to research consent. Participants use a secure interface to see how their data is used, change their preferences at any time, and receive information about research, instead of signing a single form at enrollment.
How is dynamic consent different from broad consent?
Broad consent gives permission once for a wide range of future research, overseen by governance bodies. Dynamic consent keeps participants involved, letting them adjust granular choices such as commercial use or recontact over time.
Is dynamic consent required under GDPR?
No. GDPR allows research processing under several legal bases, and Recital 33 recognizes broad consent for areas of scientific research. Dynamic consent is an ethical and trust mechanism that organizations can choose to adopt.
What happens to research when a participant withdraws?
New analyses should exclude the participant’s data from the moment withdrawal is recorded. Results already published usually cannot be reversed, which is why the consent terms should explain clearly what withdrawal does and does not cover.
How does a federated TRE help enforce dynamic consent?
In a federated TRE, data stays at the custodian, so there is one authoritative copy. Consent preferences can filter every query at run time, and only reviewed aggregate outputs leave, so a change in preference applies to all future analyses without tracking down copies.
Does dynamic consent exclude people who are not online?
It can if designed poorly. Good programs provide assisted, phone, and paper routes, use plain language, and monitor who is engaging so that the consent model does not skew participation.