The Consent Form Doesn’t Cover the Data: A Gap Regulators Can No Longer Ignore

Picture a participant in a decentralized oncology trial. She consented on an eConsent platform, wore a continuous glucose monitor for 16 weeks, answered weekly ePRO surveys from her kitchen table, and then withdrew. Her drug exposure data stayed in the sponsor’s database, as required. Her wearable-generated activity records stayed too. Her genomic subsample was retained for secondary research. She was never told who would access any of it, under what conditions, or for how long. The consent form she signed covered the intervention. Nobody designed it to cover the data.

That gap now has a formal name. A commentary published in Nature Medicine in 2026 identifies data rights as “the missing pillar” in consent modernization, arguing that current frameworks treat consent as a one-time procedural checkpoint rather than a durable governance relationship between participant and sponsor. The argument lands at a precise moment when three converging regulatory signals suggest the gap has grown too wide to paper over with another consent addendum.

Call this pattern the Data Rights Reckoning: the slow collision between legacy consent architecture and a clinical trial infrastructure that now generates, transmits, and secondary-uses participant data at a scale the original frameworks never anticipated.

The Architecture Never Scaled

Start with the foundational document. ICH-GCP E6(R2) defines informed consent as “a process by which a subject voluntarily confirms his or her willingness to participate in a particular trial, after having been informed of all aspects of the trial that are relevant to the subject’s decision to participate.” Read that definition carefully. The unit of disclosure is the trial. Not the data pipeline. Not the downstream repository. Not the real-world evidence reuse that may occur five years after database lock.

That definition was written for a world where a participant showed up at a site, received an investigational drug, and generated a CRF. The data ecosystem of a 2026 decentralized trial looks nothing like that. A single participant in a hybrid Phase II CNS study can generate continuous accelerometry, sleep staging, ecological momentary assessments, electrodermal activity recordings, and pharmacokinetic sampling across eight weeks. Each data stream has its own retention schedule, its own secondary use potential, and its own commercial value. ICH-GCP E6(R2) has no category for any of it.

The FDA’s September 2024 final guidance on Conducting Clinical Trials With Decentralized Elements is the agency’s most current attempt to address this infrastructure shift. The guidance is substantive on logistics: how to ship investigational products to participants’ homes, how to qualify remote site personnel, how remote consent must still satisfy 21 CFR Part 50. But search the document for provisions about participant data ownership, data portability rights, or the conditions under which wearable-generated data can be repurposed for secondary research. The provisions are not there.

The Withdrawal Problem Nobody Talks About

The irony sharpens when you look at what happens when a participant decides to leave.

Under current FDA-regulated trial rules, data collected prior to withdrawal must remain in the study database. Informed consent documents cannot grant participants the option to have their data removed upon withdrawal. This rule exists for legitimate scientific integrity reasons: you cannot allow selective data removal without introducing bias that undermines the entire trial. But the operational consequence is that a participant who withdraws because she no longer trusts how her data will be used has no mechanism for redress. The data stays. Her discomfort is administratively irrelevant.

For sponsors running DCTs with passive wearable collection, this creates a quiet compliance exposure that most IRBs have not yet grappled with. If a participant’s Fitbit generates 180 days of sleep architecture data during her trial enrollment, and she withdraws on day 90, what exactly was she consenting to retain? The pre-withdrawal readings she knew she was generating, or the algorithmic inferences the sponsor derived from them afterward? Current consent language rarely distinguishes between raw data and derived analytics. The Nature Medicine commentary is right to flag this as structural, not incidental.

Then came March 30, 2026. The FDA sent letters to more than 2,200 companies and researchers associated with over 3,000 registered clinical trials, flagging failures to publish trial results as required. The agency framed this as a transparency enforcement action. But read it as a data rights signal instead, and it looks different. Participants consented to contribute their bodies and time to trials whose results were never made publicly available. The consent process told them their participation would advance science. The sponsor’s inaction made that representation false. Data governance failed at the output end, not just the collection end.

What the Reckoning Demands

The conventional assumption in clinical operations is that modernizing consent means digitizing it. Deploy an eConsent platform, add multimedia explainers, track comprehension quiz scores, generate an audit trail. Done. That assumption misses what Nature Medicine is actually arguing: that consent modernization requires a legal and governance layer that specifies what participants own, what sponsors license, and under what conditions that license extends to secondary research, commercial partnerships, or AI model training.

For sponsors, the operational implication is uncomfortable. Consent templates built around 21 CFR Part 50 disclosure requirements were not designed to carry data governance weight. Retrofitting them requires legal, regulatory, IRB, and technology alignment that most development teams have not been asked to provide simultaneously. Sponsors running adaptive platform trials or master protocol designs, where participant data may be shared across multiple sub-studies with different sponsors, face particular exposure. A participant who consented to sub-study A did not necessarily consent to her biomarker data informing the dose selection algorithm for sub-study C.

CROs are exposed differently. The DCT guidance from September 2024 places significant operational responsibility on investigators and sponsors but is largely silent on how CROs that manage wearable data pipelines or eCOA platforms should handle data portability requests or document secondary use restrictions. A CRO managing a Phase III rare disease program across 14 countries in 2026 is handling participant data under at least three overlapping regulatory regimes (FDA, EMA, national data protection law) with consent language that was drafted to satisfy the lowest-common-denominator disclosure standard.

Technology vendors face a counterintuitive pressure here. The standard narrative holds that eClinical platform companies benefit from the DCT boom because more decentralized infrastructure means more software contracts. But the Data Rights Reckoning runs in the opposite direction for vendors who have positioned their platforms as data aggregation hubs. If the regulatory consensus shifts toward participant-controlled data portability, the locked-garden model, where a vendor’s platform retains enriched participant datasets that cannot be exported without the vendor’s cooperation, becomes a liability rather than a feature. The first regulatory body to issue formal guidance requiring participant data portability in clinical trials will force a platform architecture rethink across the entire eClinical sector.

The ICH is currently revising E6 toward an R3 version, which has been in development for several years. If E6(R3) does not address data rights explicitly, the gap will deepen: newer, more powerful data collection infrastructure layered onto a consent framework that still treats participation as a one-time transaction rather than an ongoing data relationship. Given that the FDA sent enforcement letters to over 2,200 entities in a single day over results transparency, it is not implausible that data rights disclosures become the next enforcement frontier within 12 to 18 months.

The consent form was never designed to be a data contract. Sponsors who keep treating it as one will eventually hand regulators a very clean enforcement target.

References

1. Nature Medicine — “Data rights are the missing pillar for modernizing consent in medicine”
2. Federal Register — “Conducting Clinical Trials With Decentralized Elements: Guidance for Industry, Investigators, and Other Stakeholders” (September 18, 2024)
3. ICH — “ICH Harmonised Guideline: Integrated Addendum to ICH E6(R1): Guideline for Good Clinical Practice E6(R2)”
4. University of Illinois Chicago Research — “Withdrawal of Subjects from Research” (data retention requirements under FDA regulations)
5. Clinical Trials Arena — “FDA cracks down on sponsor and researchers’ failure to publish trial data” (March 30, 2026)