This article argues that the study conducted by Facebook in conjunction with Cornell University did not have sufficient ethical oversight, and neglected in particular to obtain necessary informed consent from the participants in the study. It establishes the importance of informed consent in Internet research ethics and suggests that in Facebook's case (and other, similar cases), a reasonable shift could be made from traditional medical ethics 'effective consent' to a 'waiver of normative expectations', although this would require much-needed change to the company's standard practice. Finally, it gives some practical recommendations for how to implement such consent strategies, and how the ethical oversight gap between university-led research and industry-led research can be bridged, potentially using emerging Responsible Research and Innovation frameworks which are currently gathering momentum in Europe.