CCPA Scam – Human subject research study conducted by Princeton University
blog.freeradical.zone
blog.freeradical.zone
> Did an Institutional Review Board consider this study?
> We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research.
From the social experiment[as reported by OP's link]:
> I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code.
I'm pretty sure most people would find that to be a thinly veiled threat of a lawsuit. I'd like to know if the review board considered the text of the email that the "researchers"[1] intended to send and the fact that they were likely to send it to individuals instead of solely publicly traded companies.
[1] Seems to fall more under experimental psychology to me https://en.wikipedia.org/wiki/Experimental_psychology?wprov=...
Not trying to turn this thread into a generic flameware against "academic" research methods, but this whole things seems oddly reminiscent of the "let's try to insert malicious code into Linux" fiasco [1]. I'm conceptually fine with generic passive tools like web crawlers to conduct research, but since when did the internet become a place where nonconsensual interactive research became fine?
[1] https://www.bleepingcomputer.com/news/security/linux-bans-un...
Anything related to food & drug testing is usually its own special category of review within the IRB, but it's not just meant-- and has never been meant-- to only deal with biomed research. The Belmont Report in 1979 that gave rise to the modern IRB explicitly addressed research with human subjects, not just biomedical research. Anyone in that field is aware of the extreme examples like Milgram's work and the Stanford Prison experiment that make this review necessary.
It may be the case that some IRB's don't take that side of thing as seriously as they should, but that doesn't mean the ethical burden is primarily on the researchers. The legal liability is on the institution, and the IRB is the regulation-mandated body required to ensure compliance.
The IRB review determination is going to be based on the typology of what you are doing not the internal contents for the most part. Once they decide the level of appropriate review then they will typically look at the ‘details’.
In a very real sense, every landing page A/B test is nonconsensual interactive research.
Or at least, if there is line between them, however blurry, I can't find it.
I am skeptical of the idea that such a line should be drawn according to who is doing the experimentation, I don't think that a manipulative act becomes okay just because it is being done by an academic for research purposes, nor do I think that it becomes okay just because it is being done by a layman with a profit motive (or a political one, for that matter).
I think that lots of benign testing is only this a bit pedantically, at least for the general "two variants of a page" type of thing, context matters of course.
"I want to use this service" -> "OK, here is the page for that service" is a certain interaction where, granted, you might be presented with a different kind of look, but... well, you are getting what you asked for I suppose. Though you could get into the ethics of price differentiation by geo-data, and other general things that lead you to feeling ripped off.
OK, maybe lots of "growth-hacking" A/B test stuff does fall into this category...
I think the primary component of both this CCPA thing and the Linux kernel is, esentially, dishonesty. Researchers are doing things to outright lie to others. Here they are using fake identities! And it probably fails the general smell test of "if the counterparty was informed of the details, would they feel bad about the whole interaction". I said it elsewhere, I don't know if it's really fraud legally but it sure feels like it.
A lot of forums have issues with spam and sock puppets, and not all of that is obvious nor all of it honest.
Even many large, curated news sites have now succumbed to the benefits of deceiving their audience; whether through outright misrepresentation, or merely selective ommission, or merely editorial emphasis that prioritizes their agenda over their readers' understanding of the material.
Attempts to course correct here run into vast vested interests (when it comes to e.g. advertising or biases media), and also against the implementation of free speech protections in the US (and many other places), and more subtly, against public opinion on free speech, which refuses to countenance any attempts at reform.
In essence, we prioritize the right to deceive over the right not to be deceived - in all but the most extreme of circumstances.
Chalk one up for team deception - while this surely isn't a good trend, I can't see how this research is even close to some of the more problematic stuff floating around.
I think the difference here is that the user requests a page with a web browser (which could be argued as giving consent to view the contents) while the person that received this email didn't request the experimental email (and therefore didn't consent to the experiment).
People don't go through the trouble of digging up the particular section number of the specific statute of the specific jurisdiction in question for the mere sake of a generic "helpful reminder of the timeframe" required by law.
And similarly for the "without undue delay" part.
It's either a veiled threat or a serious error. Either way, this study needed more oversight.
That sounds like you're referring to the CCPA itself as the bureaucracy gone mad, and probably have already made up your mind about what outcomes research like this will find. If so, that's not really a helpful attitude for this kind of discussion.
No. Absolutely not. A helpful reminder of the timeframe would be "the deadline for our study is ..., please try to send your response by then if you wish to be included."
Quoting legal code is not at all a helpful reminder of a timeframe, but is a direct implication of legal ramifications for failure to comply.
IRB review is typically required even for just simple research surveys.
Passive-aggressive language, sure, but still not exactly inviting the recipient to a picnic, and passive-aggressive language doesn't get you off the hook.
Related, doesn't matter if it is completely without merit and could never succeed.
This entire story and thread is just something else. Talk about failing to meet even baseline ethical standards.
And if you're not a lawyer it's just a very normal message of someone trying to get answers and have their privacy rights respected. I've both sent and received many messages like this one over the years (CNIL requests) and there's nothing frightening about it.
> Talk about failing to meet even baseline ethical standards.
This study certainly meets my ethical standard of trying to hold corporations accountable to what they do with out data. I really don't see what the fuss is about: if freeradical.zone admin had received this email from anyone else (as could well be the case) would we even talk about it?
It's clear as day. And if for whatever reason you don't see it that way the rest of the email and the way it's written should set off alarm bells as being a potential scam.
In the same way that "This is a nice place you've got here, it'd be a real shame if something were to happen to it", when spoken by a Mafia enforcer is most definitely a threat.
It's not, outright, threatening to bring a lawsuit, however the language of that last paragraph is definitely something which you'd expect to see from a lawyer in preparation for such legal action.
I wouldn't be sleeping well if I were involved in this study. There is no way an IRB could determine that this is not human subjects research if you're emailing people and asking them anything.
If I want to ask random people about the weather and publish the results in a journal, that qualifies as human subjects research and IRB protocols must be followed. Emailing people asking about privacy policies is definitely human subjects research. Either they misrepresented the study in their IRB application, or the IRB didn't do due diligence reviewing the application.
An example of something that's not human subjects research would be emailing people who have websites and asking about their privacy policy.
An example of something that is human subjects research would be emailing people who have websites and asking what inspired them to start a website.
I realize that may seem like a subtle difference, but it's an important distinction from an IRB perspective. For reference, and because a lot of people seem confused on this thread, here's what the human subjects research training at my university says about this...
"...some research that involves interactions with people does not meet the regulatory definition of research with human subjects because the focus of the investigation is not the opinions, characteristics, or behavior of the individual. In other words, the information being elicited is not about the individual ('whom'), but rather is about 'what.' For example, if a researcher calls the director of a shelter for battered women and asks her for the average length of stay of the women who use the shelter, that inquiry would not meet the definition of research with human subjects because the information requested is not 'about' the director. If the researcher interviewed the director about her training, experience, and how she defines the problem of battering, then the inquiry becomes about her - and therefore 'about whom.'"
When you deliberately deceive someone in order to obtain information that you think they would be otherwise unwilling to give you, the response you get back is as much "about" their behavior in response to your deception as it is about the subject of your inquiry. (And if the researchers in this case didn't think the deception would make their targets more willing to cooperate, why the threatening language?)
That doesn't necessarily mean this kind of research should never be allowed, but it should definitely go through an IRB's oversight.
No, that's an example of human subjects research that may be exempt from the regulations due to specific reasons, such as by only interacting with subjects through surveys and interviews (while adhering to further restrictions, that this research probably runs afoul of since it's not anonymous).
> For example, if a researcher calls the director of a shelter for battered women and asks her for the average length of stay of the women who use the shelter, that inquiry would not meet the definition of research with human subjects because the information requested is not 'about' the director.
What a terrible example. They've only demonstrated that the director does not qualify as a human subject, while ignoring the question of whether the women staying at the shelter would qualify as human subjects!
> When the system has even higher confidence, it sends up to several emails that simulate real user inquiries about GDPR or CCPA processes. This research method is analogous to the audit and “secret shopper” methods that are common in academic research, enabling realistic evaluation of business practices. Simulating user inquiries also enables the study to better understand how websites respond to users from different locations.
They are not just asking for the existing privacy policy, they are actively attempting to put the subjects into a realistic environment and seeing how they respond. The focus is the behavior of the individual. This should also be evident from the fact that they felt the need to lie to and threaten them...
As to whether it's deceptive and threatening (the latter of which I find pretty hyperbolic, this is a pretty boilerplate request), that has no relevance as to whether it's human subjects research.
Maybe they should have limited the scope to larger organizations.
There are different ways to gather pure factual information, too. In particular where the factual information you are trying to gather is information about the extent to which someone complies with the law, there's some real danger in being able to fall back on a 'we're just gathering facts' defense.
Take this example: "a researcher calls the director of a shelter for battered women and asks her for the average length of stay of the women who use the shelter"
What are the regulatory requirements shelters need to comply with? Do any of them concern length of stay? Are there any liabilities a shelter might expose itself to if it were known that it had women staying there for longer than a certain period? Or individual liabilities if it were discovered that they restrict how long people can stay? Would they potentially expose any of their clients to danger if the length of stay information were revealed to a particular person?
If so, then providing the answer to that question is something the shelter needs to give some thought to. And the manner of their response might be different if that question were posed to them by:
- a woman enquiring about staying at the shelter
- a government inspector
- their landlord
- a random man phoning them
- a journalist
- an academic researcher identifying themselves and the nature of the study they are conducting
So if as an academic you ask a 'just gathering information' question, but conceal your identity, don't share whether the information will be aggregated or identifiable, and don't explain what you're gathering the information for, you are not just collecting a fact - you are forcing the person you are asking to make an evaluation of what information to provide; in other words, you are creating a human behavior, and what you are studying will be the outcome of that.
Like the semantic distinction doesnt matter because nobody gives a fuck about Princeton’s organizational policy.
Nobody can disagree with that.
Determining which category a specific research project comes under usually involves checking specific criteria, in the US they have flowcharts, in Europe they have tables. Either way you can be sure a lot of people are going to be looking at it, most of whom have had to undertake ethics training as part of their career, and some of whom have spent their entire life studying these questions and seen them put to the test over hundreds of trials.
In that light, whether this category of research has got "human" in its name is not going to get you far wrt understanding the problem at hand.
source: I've undertaken interventionist medical research in the U.S and Europe.
When you lie about who you are, what your purposes are, and use scary legal language in an attempt to elicit a response, that is absolutely human research. You may be able do those things ethically as scientist but you absolutely need IRB review becausr it is definitely human research.
My guess is that the IRB in this case was not informed of the deceptive nature of some of the emails as lieing is absolutely a red flag that you are doing human research and not just information gathering. Indeed, evaluating such lies for potential harm is an important part of why we have IRBs for psychological and sociological research.
Do you have a citation for this? What I'm seeing from random Googling is that you have to be obtaining information about the person for it to count.
If I were researching, say, price trends in some commodity and I called up several companies' sales lines and asked for their current price that looks like it would not be human subject research despite the fact that I'm talking to a human to get each company's price.
If I were researching pay trends at those companies and called up their sales lines and asked the people who answered how much they were paid it would be human subject research.
The word "you" appears in every question.
To quote my IRB training (citiprogram.org):
"Most research in the social and behavioral sciences involves gathering information about individuals. However, some research that involves interactions with people does not meet the regulatory definition of research with human subjects because the focus of the investigation is not the opinions, characteristics, or behavior of the individual. In other words, the information being elicited is not about the individual ("whom"), but rather is about "what." For example, if a researcher calls the director of a shelter for battered women and asks her for the average length of stay of the women who use the shelter, that inquiry would not meet the definition of research with human subjects because the information requested is not "about" the director. If the researcher interviewed the director about her training, experience, and how she defines the problem of battering, then the inquiry becomes about her - and therefore "about whom."
The current example is similar, in my opinion, to "how she defines the problem of battering" which the IRB training identifies as human subjects research. The people receiving the researchers' email in the current study are being ask to define the way they interpret and comply with a legal statute.
I can accept that some people don't see the information requested as being "about whom" and therefore is not human subjects research. But the fact that people who have received this email have panicked indicates that the recipients, at least, felt that the questions were more than merely recording impersonal data about their websites.
I guess the distinction is whether you see a website as an organization, even when that 'organization' is as small as a sole proprietorship or DBA, or even a personal site or blog.
But at the end of the day someone has to look at the email and respond, and in many cases that can cost money.
To wave off the whole thing as "we're contacting a website not a person" just shirks all the responsibility of ethically experimenting on people, which is what the study actually does.
If you called up companies' sales lines to ask for prices, that's just gathering facts.
If you called up companies' sales lines to see what happens when you ask them for prices for things they don't sell, or to see if they're willing to accept a bribe, or to see if they respond with different prices when you lie to them about who you are, you're researching human behavior.
In this case, they are testing what procedures, if any, companies have in place for handling CCPA and GDPR law, by posing as nonexistent customers and making potentially bogus and misleading requests under the terms of those laws.
This is like performing research on retail refund practices by going into a bunch of shops and seeing how they handle being asked for a refund for an item you didn't buy from there in the first place.
There's a more ethical way to do that study, though, which is to actually buy something from the store first, then go back and try to refund it.
Similarly, there's a more ethical way to discover how websites handle CCPA/GDPR requests, which is to use the website first, and determine in the course of that what possible information about you the website should have; then, within the terms of your rights under CCPA/GDPR, to contact them and make reasonable and legitimate requests to see if/how they are able to handle them.
Imagine someone showing up to your office building pretending to have an interview , walking into the office waiting room, then walking out saying “oh, just an experiment!”
“It’s just an email” the ease of the mode of communication here is not super relevant to the action, right?
I'm not aware of the details, but maybe there's an actual Victor Coutant from Nice on the research team. If not, what does it change? The point is precisely to study how a random person trying to defend their rights to privacy will be received/treated by hosts. You can't study that if you sign your emails with "Princeton privacy researcher".
> the mode of communication here is not super relevant to the action, right?
Exactly. Researchers will declare themselves as such before conducting interviews, but they'll rarely hesitate to take notes or ask a simple question as part of a field study.
I mean if you're not happy this researcher is doing their job to investigate how corporate America mistreats people's data privacy rights, i'd be happy to be the person sending tons of pseudonymous automated emails and handing them over to a researcher. Would that change something for you?!
"Answer my questions within 45 days or I will sue you." That seems to read like a demand for a specific action.
Totally different. Obviously. /s
Maybe in your Silicon Valley culture where lawsuits are more easily triggered than private data requests things are different, though. The point is, if the author acknowledged they're running a study in the original email (not the follow-up) they would have skewed their data because corporate assholes don't treat college researchers and common people the same.
The message said:
> I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code.
This is clearly a threat of legal action. Your experiences with CNIL might be misleading. There are few risks of getting bankrupt because of a frivolous lawsuit in Europe, but this is a very real risk in the US. Even if you are in the right and did nothing wrong.
There was a Twitter thread of a number of in-house forwarding to external council which costs time and money. This study incurred monetary damages.
The underlying ethos is that researchers should respect the people who are participating in their studies. People should know that you are conducting a study, the aims of the study, and choose whether or not they want to participate.
It reads: "CCPA Scam November 2021"
Story update notes: "This is a human subject research study conducted Princeton University"
I was attempting to submit my own instance of this when I discovered ColinWright's. My suggested title was going to be "CCPA Scam ... is a human subject research study conducted by Princeton University".
Panicking small web operators without consent being the issue.
I was concerned that might be too much adaptation. Apparently not.
The guidelines call for original titles unless excessively long or clickbait, and request no editorialisation:
https://news.ycombinator.com/newsguidelines.html
The typical options for alternatives are:
- Shorten the original title, especially by elmininating superlatives or counts. "Ten things you should know ..." becomes "Things you should know...", "Incredible new light..." becomes "New light ..."
- Replace vague terms. "This guy who.,." becomes "<Name of guy>...". Note that this often (though not always) shortens the title.
- Substitute an alternative title. The <title> tag might work, if present, otherwise a line picked verbatim from the article if possible. Occasionally gluing two phrases together is justified, as here, where "CCPA Scam" was the obvious substitution for the pronoun "This".
The key here is to find something that clearly expresses the significant content / context of the article, without sensationalisation.
Different types of submissions have their own challenges. Many commercial pieces are clickbaity, vague, listicles, or sensationalised. Microblogs (Mastodon, Twitter) have no title, and the lede line may not be especially descriptive. Blog titles run the gamut from infuriatingly vague to pretentious to long to overly terse. So long as I think I can make a reasonable argument for a substitution and it improves the headline, I'll propose it. If it's my own submission, I'll include a comment describing any changes made. (The start of this thread was to be that comment except that the article was already submitted.)
There's an exception to the clarity rule in practice for major announcements, as in corporate earnings and departures, which are often simply titled "Letter to..." or "<period> Earning statement ...". Rather than highlight the principle point, especially in the first case, HN tends to shy from that, largely to help tamp down hot takes and emotive responses. Which probably does help improve the quality of discourse. (See for example Jeff Bezos's CEO resignation announcement, or Jack Dorsey's.)
My suggestions for alternatives are frequently accepted by HN mods, or they'll come up with something close to it.
The emails were from fake people. So any work preparing any response regarding those fake peoples personal data is obviously not required by law. They don't exist.
And, as pointed out elsewhere in the thread, the researchers are probably not protected by either of CCPA or GDPR.
No costs would have been incurred without Princeton asking a very scary question.
Additionally, by not disclosing that the question was research, they also skewed the results if they were looking to see what prevailing attitudes and practices actually are.
The survey was making a fraudulent legal threat, requiring the recipient do some things for the benefit of the sender (namely, providing them with data for the study; also lying about how that data will be used) based on false allegations that there is a legal duty for them to respond in some certain time, while in fact there is none.
* one honest email
* thousands or millions, sent under false pretenses
There are two differences:
1) I'm allowed to cold call you. I'm not allowed to set up a robot to place millions of automated phone calls.
2) If I lie, I may have a problem. Someone runs up to your home and yells that your house is on fire, and you believe them. You jump out of a second-story window, breaking your windows and your legs. They do it in a stunt for TikTok. Who do you think is liable?
A third difference is IRBs. The right place to handle this are complaints to OMB; Princeton should lose federal funding here.
A huge amount of the people that got this were ethical, individual, not corporate, not profit.
We’re some students from Princeton trying to understand how businesses are responding to CCPA and GRPR requests. Could you help us with our study? How would you answer these questions?
…
The point is disclosure. It’s unethical to do otherwise, especially given that is about the use of data. I’d love for there to be more data published about the impacts of these policies, but please don’t use the tactics of creeps in the process.
Even assuming your premise is true (it's not), you think the solution to not have people lie is....to lie to them?
The compound of deception, legal intimidation, and scatter shot automated selection of unwilling participants is a particularly egregious ethical failure.
Possibly. And the IRB review process may allow for non disclosure under circumstances of that sort.
The problem is not merely that the IRB allowed non disclosure. It's that the IRB also granted an exemption from full review as human subject research. If the researcher expected that human behavior might change based on secrecy vs. disclosure then it is fundamentally not passive data collection.
But debating the secrecy issue or limits if what constitutes a human subject are all besides the point: the research protocol had an adverse impact on humans involved with the study. Not matter any other considerations, that makes the research defacto one that should have had full IRB review. Evaluating the potential for adverse impact is literally one of the foundational reasons for the existence of IRBs. The presence of an adverse impact is defacto proof that an exemption should not have been granted and that a full review should have been done to determine how the protocols could be tweaked to mitigate the issue.
That letter and their social media posts are nothing more than a facade to maximize return with no consideration of impact.
Total negligence.
From the study's website: "Please contact the lead researcher for this study, Ross Teixeira (rapt@princeton.edu), if you have any questions, believe you received an email in error, or would like to opt out of any future communication related to the study. The additional members of the study team are Professor Jonathan Mayer at the Princeton University Center for Information Technology Policy, who is the Principal Investigator, and Professor Gunes Acar at the Radboud University Digital Security Group."
The point is that the "these are all ivory tower idiots who don't know how real people work" is a silly argument to make given their backgrounds.
https://news.ycombinator.com/item?id=29539266
I was concerned enough about this that I updated our project privacy policy with pre-emptive wording about CCPA (now reverted):
https://web.archive.org/web/20211218125309/https://textpatte...
I'm mildly annoyed about the time I wasted on this, but I guess that in itself is anecdata for this study.
As a side note I find the "outrage" about these small academic studies quite hipocritical. This is a community where a significant proportion of people work in related to ads/clicks who constantly experiment on human subjects (at least by the definition applied to the cases above). Let's not even talk about the research done by Facebook et al (where a significant proportion of developers here work as well), who literally looked at how changing the time line affects the mental health of users.
And the backlash is not hypocritical. You're of course right that FB has also done really questionable research, but that doesn't matter here. I've also seen significant uncertainty about this spam series in the data protection/privacy community, i.e. criticism by those people who get to deal with these emails.
It remains also hypocritical. If you (not you personally but in general) are outraged by this research as unethical and you are working for companies who do any optimisation of their ads/engagement etc., you are contributing to the same (and arguably much worse) behaviour that you condem as unethical. I call complaining in others about something that you do yourself on an often much larger scale hypocrisy.
When you study where rubbish is being transported to, you study a system designed by humans.
There's an obvious difference.
Also, I think most of optimisation of ads/engagement is plain unethical. So there's no hypocrisy on my part.
https://www.theguardian.com/technology/2014/jul/02/facebook-...
The assumption that everyone complaining about this works in adtech or even does A/B testing is ridiculous. HN has a very strong contingent of people who are antagonistic to that entire field so making such a generalization is absolutely false.
I would point out that A/B testing minor changes without consent is a little creepy, deceiving your users in the process (by say changing pricing measure on them) makes it far more creepy. If you add bogus legal intimidation (or other language designed to elicit a strong emotional response) to that, it becomes creepy on a whole different scale.
By the relevant federal regulations (https://irb.ufl.edu/index/humanrsch.html)
================================================================
(l) Research means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. Activities that meet this definition constitute research for purposes of this policy, whether or not they are conducted or supported under a program that is considered research for other purposes. For example, some demonstration and service programs may include research activities.
================================================================
This is a good overview: https://irb.ufl.edu/index/humanrsch.html
If you work for a political campaign before the candidate announces their support for killing puppies, holding you responsible for that position is "guilt by association", but if you go to work for that same candidate after the announcement, it is no longer guilt by association, you have made a deliberate choice to support someone who wants to kill puppies and now share some responsibility.
Much of Facebook's anti-privacy behavior is widely documented. Going to work for Facebook absolutely makes you a little responsible for that behavior.
Specifically, he confuses "does not constitute human subjects research" with "exemption" which is a pretty big difference and anyone who works with human subjects should know this.
From his Twitter thread, "Update: They are now saying they have an exemption. They have not made any forms available or explained the lack of informed consent."
Exemptions are protocols that have been reviewed, and deemed exempt based on one of 8 very specific criteria. Studies deemed not constituting human subjects research are returned by the IRB, and not considered reviewed.
Given that the authors actually said "...to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research" this is clearly NOT an exemption, and informed consent is not a consideration as far as the IRB is concerned.
I can't imagine how much time and potentially money was wasted on these mass emails.
[1] https://joewein.net/blog/2021/04/21/questions-about-gdpr-dat...
Previously it said they were sending these emails up until Spring 2022[1]
[1] https://web.archive.org/web/20211216002029/https://privacyst...
> What happens if a website ignores an email that is part of this study?
> We are not aware of any adverse consequences for a website declining to respond to an email that is part of this study.
But the email sent out states:
> I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code.
So the email very clearly states that there is an adverse consequence for a failure to respond, namely a violation of the California Civil Code.
>So the email very clearly states that there is an adverse consequence for a failure to respond, namely a violation of the California Civil Code.
I've read and re-read (and read many comments) but where is the adverse consequence stated?
Here:
> as required by Section 1798.130 of the California Civil Code.
If you tell someone that they are obliged to do something as per the law, the meaning is obvious that not doing so is a violation of the law, which is an adverse consequence (the consequence being breaking the law and whatever penalties come with that).
This completely undermines his receipt of exempt status for full review of human subjects in research. If he anticipated that behaviors of recipients would be different as a result of knowing whether or not the communication was an authentic request from a user.
This is a bit of a subtle point and wouldn't necessarily expect a PhD student to pickup: It's really something-- depending on how the application was presented-- that the IRB should have caught. I'm surprised that any IRB would grant an exempt status under those conditions because it fundamentally meant the study was not passive data collection such as a surveys, which usually are exempt.
Hopefully there is a public post mortem of how this approval went down. Considering the adverse impacts on display it was defacto a study that needed complete human subject review.
> I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code.
I thought I was about to be sued by someone who was the equivalent of a patent troll, but for the CCPA. I had a minor panic attack before I was able to calm down and piece together an open response (as I wasn't about to reply directly to them, not after their thinly veiled legal threat). I briefly considered lawyering up just in case, which would have cost me a fair chunk of money.
After all that, it turns out it was research by Princeton University: https://privacystudy.cs.princeton.edu
The lead researcher, Ross Teixeira, says that:
> We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. The focus of the study is understanding website policies and practices, and emails associated with the study do not solicit personally identifiable information.
Either:
1. Teixeira misrepresented his research to the IRB, or
2. The IRB is grossly incompetent or unimaginative.
I don't see a middle ground on this, particularly after the University of Minnesota vs Linux contributors debacle (see https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...). I see Teixeira's research as the equivalent of sending a bunch of fake legal notices to random people to "study the legal system", while claiming with a straight face that it doesn't involve human subjects research. Frankly, that's bullshit, and I can't believe someone signed off on this.
As noted on the blog post, I've reported this to Princeton's Research Integrity & Assurance department. This isn't OK. I didn't consent to be a part of their human research (which it absolutely is, however they might try to claim otherwise), and this research seriously freaked me out. I slept poorly for a couple of days thinking I was facing possible legal issues over hosting a little not-for-profit hobby website.
Yeah, I agree with you.
IRB does allow for deception, just to be clear. Its annoying, but sometimes that's what's needed to get genuine responses. HOWEVER, the hoops the team needed to do to justify its use here was very poorly executed.
https://undergraduateresearch.princeton.edu/compliance/human...
Waivers of informed consent can be obtained under some circumstances, for example in the case of a retrospective study where the data has already been collected and contacting subjects would be difficult/unnecessary, or it can be shown to adversely affect the outcomes of the study [2, search for waiver].
But regardless, even if informed consent were to be waived, the fact that this is human research means that the researchers should be trained in Research Ethics and Good Clinical Practice (even if the research is not clinical), and understand that the goal is always to minimize risk for the participants - risk which was clearly not properly evaluated under the current project.
[1] https://grants.nih.gov/policy/humansubjects/research.htm [2] https://www.law.cornell.edu/cfr/text/45/46.116
Adding something about a timeframe and quoting the law clearly signals legal troubles. I would have 'reacted strongly' too.
[0] https://www.ftb.ca.gov/file/business/types/sole-proprietorsh...
The actual-not-fake-researcher (instead of fictional people) could have sent a nice friendly request saying, "I'm a PhD candidate working on public policy in the tech sector. Could you please answer the following questions regarding your process of CCPA compliance, if applicable"
I have, and received a real legal threat. A bit of panic as you contemplate the financial devastation & wreckage it might leave your life in... well, a little bit of panic is actually a pretty reasonable response there.
If you've been in that situation and been totally calm about it then that's a good thing for you, but that's not the common response for someone contemplating a life-changing encounter with the legal system.
The email also clearly says they are not sending a request at this time and it seems nicely written to me. I guess I don't get why this is on HN and everyone is so livid about it.
I think this kind of scam would end up on HN even if it was a bunch of Nigerians doing it, and what's making people angry instead of merely taking note while rolling their eyes at scammers stooping to a new low is the fact that it's respectable universities rather than Nigerians.
Edit: Oops, here’s a story: https://www.azag.gov/press-release/serial-litigant-permanent...
And those are all illegal. If the telecoms weren't incompetent and protected from liability, you could find the people who did those things and either sue them or file charges.
For good measure, his research advisors should hear about this as well. Per his own website (now unavailable but archived on wayback [2]) they are Jonathan Mayer [3] and Jenifer Rexford. [4]
Ross: should you come across this HN post, read through every comment. You need to understand-- especially studying tech policy!!!-- just how poorly done this was. Really not a great way to begin your reputation in this field.
[0] https://ria.princeton.edu/report-concern
[1] https://ogc.princeton.edu/
[2] https://web.archive.org/web/20210122100955/https://www.rosst...
2. The IRB is grossly incompetent or unimaginative
My experience with IRB's is that they are often extremely conservative in their interpretations. Legal liability is attached to them. Human-involved research requires an order of magnitude more review to get approved. There are gray areas, and my (very limited) direct observations are that people will try to frame their material to avoid the extra review. I can't rely completely on Princeton's reputation for this, but if I had to guess, Ross either did a poor job presenting to the IRB or deliberately downplayed the nature of the of things.
> I also study anonymous communication networks such as Tor, and investigate deceptive and manipulative (dark) design patterns
Radboud has policies about informed consent [1] that were clearly ignored, or were explained away with the idea that informing should be allowed afterwards to not taint the experiment (even though this is just a basic data policy).
I believe the recipients of these emails should file a complaint against Teixeira's co-conspirator as well. Contact information for the Radboud ethic's board can be found at [2], though the documentation is mostly aimed at students.
[1]: https://www.ru.nl/rdm/collecting-data/informed-consent-ethic...
[2]: https://www.ru.nl/science/research/about-our-research/ethics...
I also have experience with the Princeton IRB on similar topics. The reality is that Princeton's IRB, and IRBs in general, are not equipped to deal with this sort of online research. IRBs were created as a reaction to unethical medical research, in particular the Tuskegee Syphilis Study [1]. My experience has been that the IRB has a greater expertise on medical and sociological studies. This leads the IRB to having a very narrow view of its remit in other domains. Unless humans are in a very literal way "subjects" of the study, then the IRB doesn't see it as human subjects research. In this case the IRB likely saw "Free Radical" and other websites as the subject. In both my studies and those done by my peers, the responses on what is and isn't human subjects research is uneven and you will often get a generic "this study does not constitute human subjects research" response from the IRB. This can be the case even if there possible negative repercussions to the "not subjects" in your research.
For example, say your study involves testing the vulnerability disclosure policies. How well do websites respond to vuln reports? In your study you send out 100 vulnerability disclosures. After you report these vulnerabilities, a human may read your vulnerability report and make a decision based on it. This presents a risk that the individual security team employees involved in your study will be scapegoated and fired when you publish your (potentially damning) results. How do you balance the value this study provides the public against the risk to the individual employees' livelihoods? The IRB isn't going to help you do this balancing, they will just say "this isn't human subjects research".
IRBs quite simply aren't equipped to evaluate this sort of research at the moment. This can be frustrating for a young twenty-something researcher just out of college trying to do the right thing while generating impactful research. You come in thinking that the IRB will be a guiding hand of wisdom and prudence, but you are quickly disabused of that notion after most of your interactions feel like conversations with lawyers in a compliance department. Many researchers in "CS" don't even involve the IRB, because they don't always see the ethical dimension of their work, but the fact that Ross did shows that he was trying to do the right thing here.
In the absence of an organization that's good at this (which doesn't seem to exist and should), this probably should be the supervising professors.
I definitely see a problem in that some people think that if the IRB doesn't object to what they're doing, it's OK. But ethics is a responsibility of the entire research team, and the research team is usually far better placed to understand the implications of their research strategy than the IRB.
The following are big problems here:
- lack of informed consent
- deception
IRB's exist, in part, to weight the cost to the humans/etc vs the possible benefit of the study.
Take: https://www.nber.org/system/files/working_papers/w21560/w215...
Look at footnote 3.
There is often a tendency to dehumanize things when it involves sending stuff to corporations. Even in that footnote, it's not employers processing fictious resumes, it's people.
So it's much more likely you'd get approval to do something "to a corporation" even though 99% of the time, it's really still being done to humans
Let's look: https://services-web.research.uci.edu/compliance/human-resea...
"Any systematic investigation (including pilot studies, program evaluations, qualitative research), that is designed to develop or contribute to generalizable (scholarly) knowledge, and which uses living humans or identifiable private information about living humans qualifies as human subjects research. See Definition of Human Subjects Research for more information."
Down the rabbit hole to https://services-web.research.uci.edu/compliance/human-resea...
"Research is as a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. ...
Examples of systematic investigations include:
Surveys and questionnaires
"
So far, we got it in one.
I'll skip the part of whether it's generalizable - it's clearly intended to be here.
"A human subject means a living individual about whom an investigator (whether professional or student) conducting research:
Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or
<The or is about getting PII in more cases, but this study is not getting PII>
...
Interaction includes communication or interpersonal contact between investigator and subject.
... "
Well, there we go.
Seems a lot more straightforward in various IRBs than you seem to say. As an aside, lots of IRB's also have mass email policies and are required to approve the text.
Now, maybe Princeton's IRB does not have as clear a definition. I can buy it, in fact!
But honestly, it doesn't seem that hard. If you are going to simulate fake emails to humans, for the purpose of gathering their responses, you are in fact, doing human subject research.
It also doesn't seem very hard to draw bright lines:
1. If you are interacting with people to see what their response is, even by email, they need to consent.
2. Do not deliberately deceive humans.
(You can even modify #2 to "do not deliberately deceive humans without an IRB explicitly understanding and weighing the cost/benefit" if you like, but most of the time, you actually do not need to deceive humans)
It's also really really hard to believe someone went to an IRB, and said "i'm going to survey people by sending them emails from fake people that seem mildly threatening, and seeing how they respond.", and an IRB was like "yeah, that seems okay, it's definitely not human subjects research".
It's up to the researchers to explain precisely what thy are doing in an accurate way. Saying you are surveying websites is totally inaccurate and confusing.
If a sociological researcher was like "whoa, i'm not emailing people asking for their family histories", that would be human subject research. Instead, i'm just "retrieving directed graph data from remote email addresses". I don't think that would go over very well.
Finally, as for not seeing the ethical dimension of their work, there is an easy fix for this (IMHO): Make ethics classes required. In fact, in lots of places, IRB's wont' review things if you haven't!
People talk about emailing web sites any time they don't know if it's a person or a company in my experience. And ethics classes don't give everyone the same understanding of ethics.
[1] https://www.hhs.gov/ohrp/regulations-and-policy/regulations/...
Berkeley's IRB is similarly illed -- resulting, a lot of trust (i.e. empathy) is placed that the lead will not do anything as obviously unethical as this. This is not the mistake that someone as intelligent as Ross makes, this was a conscious decision that backfired.
>> When we got patients, I would give them the bipolar screening exam and record the results. Then Dr. W. would conduct a full clinical interview and formally assess them. We’d compare notes and see how often the screening test results matched Dr. W’s expert diagnosis. We usually got about twenty new patients a week; if half of them were willing and able to join our study, we should be able to gather about a hundred data points over the next three months.
Would there be an issue if they sent out letters to businesses asking how they comply with a California regulation?
I think this is where you may be overlooking the context.
People aren't mad they asked about compliance with a law, they are mad about the way it was asked: from fake personas implying legal threat, while cataloguing the replies for their study no one asked to be involved in.
The researcher was an actual human being, so all they would have to do to require a response is to register on the site before sending the email. If they had registered accounts, then requested their information be sent to them and required its deletion, it would have been an order of magnitude more work for the site owners than just sending answers about the process (which, if the site is subject to the law, should already be prepared.)
I think people are mad precisely because they were asked about compliance with a law. Largely because emails went out to sites that were not commercial or too small to be bound by the law, so they weren't aware of it and panicked.
According to the linked blog, the owner wasn't covered by CCPA anyway as I suspect is the case for a lot of the recipients, so there would still not be a response required. Some of the sites may have data exports and account deletion clearly available to users anyway, in which case no human interaction would be needed; but the research wasn't looking for that.
(720 ILCS 5/17-50) (was 720 ILCS 5/16D-5 and 5/16D-6) Sec. 17-50. Computer fraud. (a) A person commits computer fraud when he or she knowingly: (1) Accesses or causes to be accessed a computer or any part thereof, or a program or data, with the intent of devising or executing any scheme or artifice to defraud, or as part of a deception;
With regard to GDPR, the "respond within x" is simply not applicable. The one month period is strictly for any requests concerning Article 15 through 22 and none of the questions are talking about any of that.
Now, if one of the questions was something along the lines of "do you process any information related to me?" then it would potentially fall under Article 15.1 and would require a timely response. IANAL, however, I think in such cases you could simply point to a privacy policy, which you are already required to have.
Skip to 12:29 where he recalls Facebook in 2011 experimenting with users news feeds.
This research looks like a dark pattern to me.
[1] https://privacystudy.cs.princeton.edu/ [2] https://dl.acm.org/doi/abs/10.1145/3411764.3445610
There's a whole other blog post waiting to be written about the intersection between GDPR/CCPA threats and spam.
The first is that they lied about who they were (and lied by omission about the purpose of the email). The ethics of deceiving someone for research are complicated, but should go through an IRB evaluation. Since they avoided the IRB by claiming it was a study about process, they should have avoided the ethics issues from lying in the survey.
They should have been up-front and honest about who they were, and why they were asking the question.
If their research truly requires deceiving the participant (and, I’m not at all convinced that it does), then it needed to be rigorously evaluated by the IRB, which almost certainly should and should have rejected it.
Second, their research makes a demand for a response “without undue delay”, rather than a request. That is also unethical, as it’s misrepresenting the law and implying a response within 45 days is required by law. It is not.
Many of the involuntary subject participants are not subject to the cited provision of the law. As such, demanding a response within the time frame and citing that provision of the law is misleading. Also, the law makes no requirement for a business to respond to such a query within 45 days. The legislative text is here (https://casetext.com/statute/california-codes/california-civ...) and the only 45 day window that exists is for responding to an actual CCPA request, which this query explicitly disclaimed from being. So even if this was a business required to comply with CCPA, they are not required to respond to this query. So, they lied (by implication) to claim that provision of the law approach lied to the business, and lied (explicitly) by claiming the law created a duty to respond to the email within a 45 day period, which it does not.
An email asking an organization for answers to questions is human experimentation?
I must be missing something.
No. Obviously not. How could you have missed the fact that they were "collecting information" under false pretenses?
* The participants / subjects of the study are people, not "websites" as the study claims. Websites don't read and respond to emails, people do.
* The participants of this study were selected without their consent
* The participants were not told that they are in a study, nor the purpose of that study
* The participants were lied to, as the researcher pretended to be someone else
* The researcher deliberately communicated in a way that heavily implied legal consequences if they don't get what they demand
* The researcher's threats and demands do not actually match what is afforded to them by the law
* The study caused undue stress and financial losses (e.g. hiring lawyers) to the participants, including those that were not subject to CCPA at all.
I don't care what labels you choose to put or not put on it, it's a shitty, abusive study that should have never passed ethics review.
That's not the official definition an IRB would use. The official definition is a lot less broad than a lot of people on this thread seem to think. It requires that are collecting biospecimens, identifiable private information, or certain kinds of information about a specific person. [0]
[0]: https://grants.nih.gov/policy/humansubjects/research.htm
> a living individual about whom an investigator (whether professional or student) conducting research:
> - Obtains information [or ...] through [... or] interaction with the individual, and uses, studies, or analyzes the information [or ...]; or
> - [...]
The actual legal definition is here [1], and further clarifies that "interaction" is very broad, specifically "Interaction includes communication [or ...] between investigator and subject."
This clearly qualifies OP as a human subject and this as human subjects research.
[1] Search "(e)(1) Human subject": https://www.hhs.gov/ohrp/regulations-and-policy/regulations/...
> a living individual about whom an investigator (whether professional or student) conducting research:
The mere fact that you're interacting with a human doesn't trigger it. If you're associated with a university, I'd encourage you to reach out to your IRB and ask them. The fact that the researchers in this case specifically were told by their IRB that it wasn't human subject research should be a good hint
Are you accidentally reading an "is" into that clause to interpret it as "about whom an investigator is conducting research"? What matters is not whether the researcher considers the human to be the target of the research, but whether the human (or their privacy) is actually affected by the research.
"about whom" is a key criteria from the federal government to determine whether something fits the definition of human subjects research. Here's a quote from HHS:
"The phrase ‘about whom’ is important. A human subject is the person that the information is about, not necessarily the person providing the information. In the case of biospecimens, the human subject is the person from whom the specimen was taken."
https://www.hhs.gov/ohrp/sites/default/files/OHRP-HHS-Learni...
Reading that, it's clear that the Princeton study does not fit the definition of human subjects research. The complainants may be able to sue for damages to the university, but not because the study was improperly classified as human subjects.
> If for the purpose of a research study [...] An investigator [...] interacts with a living individual, [...] Then The research likely involves human subjects.
What's up for debate here is whether this research qualifies for one of the specific exemptions in the regulation. The general definition in the regulation is broad enough to include all interaction with living humans that produces information used for the study, and is only narrowed by later enumerated exemptions.
1) this is clearly not an exempt study, which is a category of its own that the IRB reviews and makes a judgment on. The authors would immediately have been able to point out the protocol number of the exempt study if it were exempt. Rather it's not considered human subjects as the authors clearly state on their FAQ.
2) it seems like you're thrown off by the example, because if you ended your sentence as "The bit you've quoted is intended to clarify that "about whom" means the subject is the patient" then we would be in agreement, and it'd be more obvious that the subject is, in fact, the website's policies/procedures. Here's an excerpt from the written text of the common rule,
"“About whom” – a human subject research project requires the data received from the living individual to be about the person."
Please don't use such circular logic. We're debating whether the research properly qualifies as human subject research; we're not debating about what the IRB actually decided on that question, because they may have gotten it wrong.
> then we would be in agreement, and it'd be more obvious that the subject is, in fact, the website's policies/procedures.
The policy itself is certainly the intended subject of the research. But the methods they've chosen mean they are also collecting and analyzing information about the responses of real live humans to their interactions and interventions, and that qualifies this as human subject research irrespective of the naive intentions of the researchers. Having a non-human subject does not preclude also having a human subject.
Yes that's what we're debating. But you used the word "exemption" which has a specific technical meaning in human subjects research, and I'm saying that it's not an exemption. There are 8 tests for exemption, and I'm pointing out that this is not an IRB exemption.
> The policy itself is certainly the intended subject of the research. But the methods they've chosen mean they are also collecting and analyzing information about the responses of real live humans to their interactions and interventions, and that qualifies this as human subject research irrespective of the naive intentions of the researchers. Having a non-human subject does not preclude also having a human subject.
Do you have a source for this interpretation? It sounds like this is your interpretation, but not the federal one. Following your interpretation, surveys of companies (e.g. emailing contact@company.com to ask how many employees they have) would fall under the definition of human subjects.
Thanks for the continued conversation, but I think this is my last comment. Nothing personal, but this is a bit exhausting. It seems like you're debating two other people on this forum about this exact definition, and you might consider that maybe you're just wrong about your interpretation?
Here's one final source, if it helps provide closure:
To meet the definition of human subjects, you must ask “about whom” questions. Questions about your respondents' attitudes, opinions, preferences, behavior, experiences, or characteristics, are all considered “about whom” questions. Questions about an organization, a policy, or a process are “about what” questions.
https://campusirb.duke.edu/resources/guides/defining-researc...
Sure. Click through the NIH's Decision Tool [1], and you'll find that collecting information only through surveys or interviews leads to the tool saying "Your study is most likely considered exempt from the human subject's regulations, category 2 (Exemption 2)." That particular exemption requires that the research qualify under at least one of three further criteria. (I'll also note that for someone who complained about people not referring to primary sources, you seem to be citing more .edu sources than .gov sources.)
Furthermore, this particular research unquestionably went beyond mere surveys and interviews. Legal threats under false pretenses are way outside those bounds. So even if a mere survey about how many employees a company has doesn't qualify as human research (which I'm willing to concede), that doesn't help settle the question about this research.
[1] https://grants.nih.gov/policy/humansubjects/hs-decision.htm
To be a bit more pithy, here is one example of such an analysis (admittedly, I'm not sure comments on twitter count): https://twitter.com/RossTeixeira/status/1471249559879929861
If you are doing research with an institution governed by an IRB then you cannot do anything involving a human being without it getting reviewed by the IRB. There are criteria whereby the IRB may exempt the research from a full review, but only the IRB can make that determination.
Perhaps the #1 absolute goal of the IRB is to assess potential adverse impacts of the research on any humans involved. It should be clear from the comments here, and if you read through any of the links to twitter threads, that people were adversely impacted by this study either through anxiety, time spent unecessarily, and perhaps money. I might understand (though disagree) with a point of view that said these adverse results were not foreseeable, but review of the study itself under an IRB for its involvement of humans was absolutely required.
When they email a single person who runs a website, that's very different.
All AB testing is a human experiment?
Organizations are made up of humans.
Human experimentation is very broadly defined, for IRB purposes. As I understand it, if you're going to be asking humans to interact with researchers, in any way, and gathering data based on those interactions, that's human subjects research, and requires reasonable scrutiny from the IRB.
Source: I have worked fairly extensively with my own university's IRB, as I put together and maintain the website that they use to handle submissions.
[1] https://researchdata.princeton.edu/research-lifecycle-guide/...
> A human subject means a living individual about whom an investigator (whether professional or student) who is conducting research:
> (i) Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens
The information they were looking for is 'how does this person respond when they receive an email threatening legal action under CCPA?'
A human subject means ... a living individual ... about whom an investigator... obtains information... through intervention or interaction... and studies... the information.
That they mistakenly thought they were investigating how "an organization" responds when they receive an email is based on an erroneous assumption that an organization is itself an autonomous, sentient entity whose behavior can be studied independently of its human constituents.
Your interpretation would make most of the definition redundant. They could just say any individual an investigator interacts with. IRBs don't interpret it like that.
Not quite, because the definition needs to also encompass individuals that researchers acquire information about without directly interacting—eg. getting patient data from a healthcare provider.
This was clearly seeking a human response and is a human experiment.
You can think the study is poorly designed, unethical, etc. But if they're not obtaining data about a living individual, then it's not human subjects research.
>But if they're not obtaining data about a living individual, then it's not human subjects research.
Sure, if you completely ignore the other half of the definition, per the NIH:
https://grants.nih.gov/policy/humansubjects/research.htm
> Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens;
They are absolutely collecting information to analyze by interacting with the individual.
We don't even need to get into the weeds on this just being "answers to questions". All you need to do is look at the human impact: This research study has caused anxiety, time, and potentially money to many people being asked to unknowingly participate in the study. IRB's exist to evaluate-- among other things-- potential adverse impacts on people involved in a study. This has had an adverse impact and should not have been allowed through IRB review in this form.
I have no problem following these laws and extended the data/privacy rights to everyone (not just CA or EU residents). I must say though, when people threaten me or resort to name calling I make the process deliberately difficult.
edit
I just scanned my email and I got the same email, with CCPA swapped out for GDPR via a "Tom Harris".
>
>
> To Whom It May Concern:
>
> My name is Tom Harris, and I am a resident of Sacramento, California. I have a few questions about your process for responding to General Data Protection Regulation (GDPR) data access requests:
>
> Would you process a GDPR data access request from me even though I am not a resident of the European Union?
> Do you process GDPR data access requests via email, a website, or telephone? If via a website, what is the URL I should go to?
> What personal information do I have to submit for you to verify and process a GDPR data access request?
> What information do you provide in response to a GDPR data access request?
>
> To be clear, I am not submitting a data access request at this time. My questions are about your process for when I do submit a request.
>
> Thank you in advance for your answers to these questions. If there is a better contact for processing GDPR requests regarding nymeria.io, I kindly ask that you forward my request to them.
>
> I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR.
>
> Sincerely,
>
> Tom Harrispriv...@princetonprivacystudy.org Tue, Dec 14, 12:25 AM (5 days ago) to me
To Whom It May Concern,
We are researchers at Princeton University conducting a study of how websites are implementing the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). We are reaching out to you because this email address is provided as a contact on the website seifried.org.
Your website may be required to implement one or both of GDPR and CCPA, and we would appreciate if you would answer a few brief questions about your privacy practices.
1) Does seifried.org implement GDPR or CCPA? If not, could you please explain why? If you are uncertain about whether seifried.org is required to implement these laws or answer questions like ours, we have included informative resources at the end of this email.
2) If you implement GDPR or CCPA, do you process data access requests from individuals who are not residents of the EU or UK (for GDPR) or who are not residents of California (for CCPA)?
3) If you implement GDPR or CCPA, do you process data access requests via email, a website, or telephone? If via a website, what is the URL?
4) If you implement GDPR or CCPA, what personal information must a user submit for you to verify and process a data access request?
5) If you implement GDPR or CCPA, what personal information do you provide in response to a data access request?
Thank you in advance for your answers to these questions. If there is a better contact for questions about privacy practices on seifried.org, I kindly ask that you forward my request to them.
Sincerely, Ross Teixeira
The real overarching problem is that anyone can be subject to life-altering lawsuits through the legal system, which will cost unreasonable amounts of time, money, and personal sanity. There's no hope for justice for small time actors, since the damage has been dealt out before ever seeing an informed decision by a judge. And even if you can invest enough to pay for a real judgement, the chance of getting awarded legal fees is slim, never mind rewards for lost time and emotional distress!
I don't think the problem is specifically the CCPA, since it does except small time actors. Rather the setup for the problem is a heavyweight legal system, draconian laws that do apply to individual actors, and the massive fan out caused by being globally connected. Anybody is basically one doxxing away from a barrage of legal demands, and our poor technical architectures basically guarantee anybody who puts themselves out there even slightly can be doxxed.
I don't know that there is a straightforward fix. The dynamics have been explored to death, and we seem to be trapped in this state because the real beneficiaries of the legal system (well-funded corporations and other professional actors) are happy to keep it this way. But this situation is a lightning rod that illustrates how outrage over it is growing. If it continues to not be reformed, eventually something is going to break catastrophically.
I've gotten no response to my e-mail messages sent to the 3 researchers who have identified themselves, or the Princeton IRB. But I was able to find phone numbers for all 3 of the researchers in their c.v.'s posted online. The Principal Investigator has yet to return my calls, but the grad student took my call. He referred most of my questions to the principal investigator, but he did tell me that they sent e-mail to between 200K and 300K addresses scraped form a list of the "top" 1M Web sites.
https://www.solipsys.co.uk/Chartodon/107464941539596242.svg
Language warning.
For shame, Princeton.
So I looked this up and it really exists.
I wonder if an account holder of a Facebook or Google account can use this law to get actual customer service.
That said, there's also a clever but effective workaround to all that redundancy - They store all your documents and photos encrypted with a key that's unique per user. When you request all your data, they delete the key - It's much easier for them to completely and quickly purge all that as a singular key, and clean up the files later. It's not a cop-out, because there's no effective way to get at your data once the key has been deleted. Those systems still have backups, but with much shorter lifetimes and explicit audit logs.
Quite likely they do (or their staffers who do the actual work do).
This is an example of regulatory capture.
Collectors of data should know what they have and who they have shared it with. Think of holding data as risky, as if the data is toxic. Think of the monetary and reputational risk of a data breach.
Incidentally, the data collected must be done so for a specific business purpose. And can even be kept if there are other requirements such as AML or KYC.
Just slapping a zero over the data is not a viable solution.
- that they delete information about you that they have (with potential exceptions) - that they provide you with what information they have about you, and for what purposes they have that information (with exceptions) - that they opt you out of sharing data with other entities (with exceptions)
You cannot, as implied by the email, demand a response to an arbitrary query. There are essentially three queries the companies are required to answer with 45 days (90, if they opt for the 45 day extension). So, it can certainly be helpful in some situations, but will not serve as a general purpose CS tool.
I wouldn't say that the questions were arbitrary; they were exactly the things you would need to know in order to submit a request for information, but without the actual request.
The only alternative that I can think of to get the same information is to register at all of these websites, use them for five minutes, then make an actual legal request, and if not provided with "information" and "purposes", to make an actual legal threat.
I don't get the impression that site owners would feel a lot happier about that approach. I can see how sending the email that was actually sent would be seen by a researcher as a better approach. And can also see a self-serving aspect, in that it's a cheaper approach - saves the labor of registering a bunch of accounts.
But I'm getting the impression that site owners went to defcon 1 after getting a single request for information that should be easily available on the site if it were subject to the law (which the blog author has stated clearly that they were not.)
If anything was missing imo, it's that there should have been help in the email mentioning the for-profit/$25MM revenue/50K Californians requirement in the law - but that might make it sound more like a threat, not less. They could also have made better guesses about whether the sites they were emailing would be bound by the law, and targeted the emails better.
But if the site does fall under the law, and they felt threatened and hired a lawyer to answer those questions, I'm not sympathetic. They're supposed to be able to answer those questions if any of the >50K Californians they work with ask, at any time. If they were, replying would be a simple matter of sending a link or a form email that they already had ready.
This doesn’t seem accurate to me. The first and fourth questions especially aren’t relevant to submitting a valid CCPA request.
But my point was that, more generally if your goal is to use CCPA to compel a company to answer your questions, I think you’re going to be disappointed.
The law simply doesn’t compel companies to answer arbitrary questions. Heck, I don’t think CCPA even compels them to answer any of these questions.
Only questions 2 and 3 are relevant to submitting a request, and CCPA requires the company to publish that information, but I don’t think it compels them to answer emailed questions asking for that information. Open to being wrong on this point though.
They made no guesses - they randomly selected sites from rankings of top websites (specifically, from an common academic time-smoothed aggregation of Alexa and some of its competitors).
From the study website (https://privacystudy.cs.princeton.edu/): "The set of websites for this study is sampled from the Tranco list of popular websites and publicly available datasets of third-party tracking websites."
Research can still be unethical even if it doesn't fit the definition of human subjects research.
It isn't human subjects research just to read what a website says about its compliance to a law (or lack thereof), but once you start reaching out to actual humans to discuss the matter, it definitely does become human subjects research (we would categorize this as an interview or survey).
At the very least, the emails should have come with a notice that they were being sent as part of an academic study - after all, misleading your participants wasn't a goal of this study!
"Please contact the lead researcher for this study, Ross Teixeira (rapt@princeton.edu), if you have any questions, believe you received an email in error, or would like to opt out of any future communication related to the study."
Lots of hours wasted.
I remember at least one article for which the journalist sent fake job applications tomdigfeeent companies, using European and Arabic names for the same CV, to uncover bias in the application process.
Is this the same or different? It also wasted the time of the people reviewing the applications.
Is the implicit legal threat what makes the difference between ok and not ok?
Companies to which these laws apply should already have a process in place to deal with subject access requests. Complying with relevant laws is just part of doing business.
All the other site owners could have figured out with a bit of googling that the laws don't apply to them—there is plenty of guidance available.
I can only speak for the GDPR here, but had the requests been real and valid, the worst outcome would have been a regulator telling you to comply with it. Data protection authorities are more interested in helping companies get into compliance than punishing small businesses for minor infractions. If you look at past decisions, it usually takes serious and/or systematic violations to get fined.
The US legal system is quite different; litigants are responsible for their own legal fees[0] and frivolous lawsuits[1] are common.
[0] https://en.wikipedia.org/wiki/American_rule_(attorney's_fees)
[1] https://www.azag.gov/press-release/serial-litigant-permanent...
Oh please! A tad bit dramatic, no? A single email from someone claiming to be in France is made out to be equivalent to an official letter from a US lawyer. They even said it was not a request for data so you can ignore it.
Was this a mistake? Yes.
Was it a big mistake? Hell no.
Let's not lose perspective and keep things real.
Whatever happened to Alexa ratings?
"We designed the standard configuration of the Tranco list to improve agreement on the popularity of domains and stability over time, using the rankings from the four studied providers as our source data."
(Alexa is one of their data sources.)
I'm not sure how long anyone can last in business if this is their response to receiving a kind-of-threat of a lawsuit. I get that it may be a hassle but businesses get these kind of garbage threats frequently and often can be ignored unless and until they actually file something. If the threat is BS then its certainly wrong for them to waste your time but being so mad you can't even speak to them seems a bit much.
These fall into three groups.
First, there are those jurisdictions in which you and/or your site are actually located. You almost always have to care about the laws in these jurisdictions.
Second, there are jurisdictions where the people who visit your site live. For these there are two questions. #1 does the jurisdiction think their law applies to you? #2 Does your jurisdiction, or someone else that you have to obey, agree?
The answer to #1 often depend on what your relationship is with the visitor. If you are selling (or trying to sell) them something it is more likely that the jurisdiction will think their law applies. If your website is not in any way targeted to them or encouraging them it is more likely that the jurisdiction won't think its law applies. (But some, like the EU with GDPR, do think it applies if you are tracking the behavior of EU users regardless of whether or not you are selling anything or trying to get EU visitors).
#2 is murkier. Say I've got a site in X specifically selling to people in Y. Y brings a civil case against me in Y. I ignore it thinking they can't touch me here in X, and Y gets a monetary judgement against me. I may be in for a surprise, because X may consider my sales to people in Y as taking place in Y, and so agree that Y has jurisdiction. If Y then brings the judgement to an X court to enforce, there is a decent change the X courts will enforce it. Oops.
Another thing you need to consider when thinking about #2 is entities that both you and the jurisdiction deal with. If you use a service provider (credit card processor, cloud service, hosting provider, etc) that operates in that jurisdiction, you may face pressure via that provider to obey the jurisdiction's law.
Finally, there are jurisdictions that you are not in, you aren't selling to or doing anything to attract visitors from, you are sure your jurisdiction won't cooperate with them on enforcing their laws, you don't use any services that operate there, and you aren't even going to visit there so even if you thoroughly annoy them no big deal.
You can probably mostly ignore these jurisdictions as far as privacy laws go.
If you are in the US I'd say that this currently means that you should be aware of GDPR and CCPA, and have some idea of how you will response to requests under them. For a lot of sites (like the OP's) a short form letter explaining that you are not covered should be fine.
As more states in the US pass their own CCPA-like laws, or we get Federal action on privacy, I'd expect those will generate large threads here. Keep an eye out for them and update your form letters appropriately.
In the case of the CCPA, nothing I do is subject to it as it applies only to business, and only to those 1) making at least $25M in revenue, 2) handling the information of at least 50,000 Californians, or 3) making at least half their annual revenue from selling Californian’s personal information.
I’m running a free website as a hobby, have $0 in revenue, have way fewer than 50,000 users total, and again have $0 in revenue.
Thus to avoid unpleasant surprised like the one you had, people with websites should add "check to see if my site has any obligations under privacy laws" to the list of routine things they do to maintain the site, and then plan accordingly.
If that check reveals that they aren't doing anything that places any obligation upon them, they can write a canned response to send back to anyone who asks.
And kstrauser's point is that, due to the way this law is written, by definition nothing their small, non-profit site does can ever be regulated by this law.
If they are not, then when someone makes a request under that new law it is just a matter then of responding with a pre-canned response explaining that the law does not apply instead of being a panic and/or stress inducing incident.
And someone will eventually make such a request. Users don't check details. They just know that their jurisdiction has a privacy law and under it they can request things. They don't check to first to verify the site meets the law's thresholds for applicability or is under the law's jurisdiction.
If the new law does apply to your site, same idea. You want to find that out and figure out how to deal with it before you get a request instead of your first request being a scramble to comply.
Note that I'm not saying that kstrauser mishandled anything. I think that most of us overlooked that small non-profit hobbyist sites needed to keep an eye on the privacy law landscape. Kstrauser happened to be the unlucky person who fate chose to use as an example of how annoying it can be too have to figure out on short notice where your site stands as far as a given law goes, even if the answer turns out to be "that law doesn't apply to my site".
Fate didn't choose kstrauser. An irresponsible academic sent an email blast to people who were not relevant to his study, without making even token efforts to filter things down.
Is asking people their favorite type of ice cream unethical because a very small percentage or going to have a negative mental/emotional reaction?
> The set of websites for this study is sampled from the Tranco list of popular websites and publicly available datasets of third-party tracking websites.
If that's true, then I have a lot more sympathy for the researchers: it seems they were only targeting particularly popular sites, and sites which use tracking technology. Those sites really should have have developed processes for responding to GDPR and CCPA requests, rather than just banging in some Google Analytics code without really thinking about it.
I don’t use GA, or any other third-party trackers, on any of my sites. Given that Tranco doesn’t have access to my web logs or the little Matomo setup that I self-host, I’m not sure how they claim to be analyzing my traffic in the first place.
> I’m not sure how they claim to be analyzing my traffic in the first place
They wouldn't need to analyze your traffic to find out if you were using tracking technologies, they would just need to visit your site and examine what they were served. Companies like BuiltWith and Wappalyzer offer this kind of technology survey as a service.
[1] https://kinsta.com/blog/alexa-rank/#how-is-alexa-rank-calcul...
[2] https://umbrella-static.s3-us-west-1.amazonaws.com/index.htm...
I don't see why being a for-profit company should somehow lower the ethical bar.
In my view, the alternative is to ship something we _don't_ have data on and hope for the best. And if we demand informed consent, I have to assume it goes into boilerplate agreements nobody reads at signup, which is a mockery of the term 'informed' IMO.
But as far as other manipulations done by corporations? It's hard to say when something should require permission. Technically, a used car salesman is doing some kind of experiment when trying different sales tactics on people. But, I wouldn't make him fill out an IRB application. The same could be said of charities asking for donations who tug at your heart strings, or just about any other human interaction.
If an A/B test is likely to cause people harm (the 2012 Facebook Depression Experiment comes to mind), then it should absolutely be held to the same IRB standard as academia.
The point of IRB is to ensure that your human testing doesn't cause anybody any material or psychological harm. "Human testing" isn't a bad word, it's just something that needs to be done with care.
Also, A/B testing only happens to people who choose to interact with the corporation for a related purpose. On the other hand, when corporations go out of line, e.g. scan your address book and send invites to your friends pretending to be you, they are also demonized for that. Imagine if Facebook sent you anonymous legal threats, you think they'd get a pass?
A different aspect (not sure if it's relevant in this particular case) is that certain sources of research funding will impose certain ethical requirements, including specific process for human subject research - and that would apply also to for-profit companies if they would receive such funding for some project; and of course, the owners/shareholders of for-profit companies are also free to impose a higher ethical bar for e.g. A/B testing in their company, just as shareholders/owners currently are imposing various other ethical and social goals for their management and company policies.
But for the actual question of "why should academic institutions be held to a higher standard than commercial ones?" IMHO a good answer is "why not?" - I mean, if they do not object to having this higher ethical bar (and these institutions generally do not), that's entirely a good thing.