<story><title>Princeton researcher apologizes for GDPR/CCPA email study</title><url>https://privacystudy.cs.princeton.edu/?update</url></story><parent_chain><item><author>throwawyaaccoun</author><text>[Throwaway for privacy.]&lt;p&gt;I know this was hashed out on the other threads a bit, but can someone please explain to me why folks are so up in arms about this, compared to, say, studies that scrape user data without consent (something the IRB allows &lt;i&gt;all the time&lt;/i&gt; by saying that no human subjects are involved)? Is it simply because there is no visibility into this practice (i.e., no email sent?) Scraping user data from public profiles, aggregating it into a model, and publishing a paper or whatever -- that seems demonstrably more invasive to individuals, storing and keeping their user data, than an email quoting a statute.&lt;p&gt;I &lt;i&gt;agree&lt;/i&gt; that the deception was unnecessary, but that&amp;#x27;s it. It doesn&amp;#x27;t feel any wronger than that.&lt;p&gt;Especially because these researchers really were acting in &amp;quot;meta&amp;quot; good faith trying to probe the privacy ecosystem, I fear there may be a chilling effect. Consumers deserve privacy rights and privacy knowledge in the asymmetric surveillance economy we find ourselves in, IMO.&lt;p&gt;I&amp;#x27;m open to being wrong.</text></item></parent_chain><comment><author>ineedasername</author><text>Ethical guidelines on research exist to prevent an adverse impact on participants. This study had adverse impacts: fear, stress, time &amp;amp; money in consulting lawyers. It was therefore defacto an unethical research study. Speculation as to why the protocol slipped through the IRB cracks are that the language used in the study proposal (at least the part made public) dehumanized the protocols by referring to &amp;quot;websites&amp;quot; rather than humans that would be responding to the inquiries.&lt;p&gt;The IRB ruled this was not a human subject piece of research, but that is contradicted by the deception protocol. Deception was justified as necessary because people&amp;#x27;s behavior might change if they knew it was a research request. That acknowledgement made it implicit that human behavior and potential changes to it due to the experiment was a core factor in the study-- ergo, it had human subjects. Behavioral research on human subjects is required to go through a much more rigorous IRB oversight process precisely to anticipate and mitigate potential adverse reactions.&lt;p&gt;Some people are focussing on the deception, but that is, under some circumstances, allowed by research ethics. The more serious problem was adverse impact which, again, is the primary motivator for why we now have laws and regulation-mandated IRB processes to make sure it doesn&amp;#x27;t become an issue.</text></comment>
<story><title>Princeton researcher apologizes for GDPR/CCPA email study</title><url>https://privacystudy.cs.princeton.edu/?update</url></story><parent_chain><item><author>throwawyaaccoun</author><text>[Throwaway for privacy.]&lt;p&gt;I know this was hashed out on the other threads a bit, but can someone please explain to me why folks are so up in arms about this, compared to, say, studies that scrape user data without consent (something the IRB allows &lt;i&gt;all the time&lt;/i&gt; by saying that no human subjects are involved)? Is it simply because there is no visibility into this practice (i.e., no email sent?) Scraping user data from public profiles, aggregating it into a model, and publishing a paper or whatever -- that seems demonstrably more invasive to individuals, storing and keeping their user data, than an email quoting a statute.&lt;p&gt;I &lt;i&gt;agree&lt;/i&gt; that the deception was unnecessary, but that&amp;#x27;s it. It doesn&amp;#x27;t feel any wronger than that.&lt;p&gt;Especially because these researchers really were acting in &amp;quot;meta&amp;quot; good faith trying to probe the privacy ecosystem, I fear there may be a chilling effect. Consumers deserve privacy rights and privacy knowledge in the asymmetric surveillance economy we find ourselves in, IMO.&lt;p&gt;I&amp;#x27;m open to being wrong.</text></item></parent_chain><comment><author>codazoda</author><text>The post here on hacker news mentioned the down sides for one receiver. That person was stressed out thinking that they were about to be sued. They considered retaining council, which could have cost them a few thousand dollars, in order to get ahead of the threat. It didn’t come to that, so it’s a “what if”, but I could see myself trying to retain council too. Hopefully, a lawyer would have talked me down and advised me to wait it out. On the flip side, they may have offered to respond on my behalf (which would cost money).&lt;p&gt;I would not respond to such an email myself, ignoring it until I was able to defer to an attorney.&lt;p&gt;I publish a simple personal blog and I worry about the _worldwide_ legal implications of doing so. As one example, I have some old information about making model rocket fuel at home. At the time I had carefully reviewed U.S. law and knew how much I could legally make and have in my possession. Then I got questions from people in other countries and I got spooked. What if I break a law somewhere else?</text></comment>