CCPA Scam – Human subject research study conducted by Princeton University

Note that the title doesn't provide the full meat.

It reads: "CCPA Scam November 2021"

Story update notes: "This is a human subject research study conducted Princeton University"

I was attempting to submit my own instance of this when I discovered ColinWright's. My suggested title was going to be "CCPA Scam ... is a human subject research study conducted by Princeton University".

Panicking small web operators without consent being the issue.

Also here: https://news.ycombinator.com/item?id=29599154

I'm the person who wrote that blog post. I got an email from a fake person in France who asked several questions about my small social media site's CCPA compliance, then ended the letter with:

> I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code.

I thought I was about to be sued by someone who was the equivalent of a patent troll, but for the CCPA. I had a minor panic attack before I was able to calm down and piece together an open response (as I wasn't about to reply directly to them, not after their thinly veiled legal threat). I briefly considered lawyering up just in case, which would have cost me a fair chunk of money.

After all that, it turns out it was research by Princeton University: https://privacystudy.cs.princeton.edu

The lead researcher, Ross Teixeira, says that:

> We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. The focus of the study is understanding website policies and practices, and emails associated with the study do not solicit personally identifiable information.

Either:

1. Teixeira misrepresented his research to the IRB, or

2. The IRB is grossly incompetent or unimaginative.

I don't see a middle ground on this, particularly after the University of Minnesota vs Linux contributors debacle (see https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...). I see Teixeira's research as the equivalent of sending a bunch of fake legal notices to random people to "study the legal system", while claiming with a straight face that it doesn't involve human subjects research. Frankly, that's bullshit, and I can't believe someone signed off on this.

As noted on the blog post, I've reported this to Princeton's Research Integrity & Assurance department. This isn't OK. I didn't consent to be a part of their human research (which it absolutely is, however they might try to claim otherwise), and this research seriously freaked me out. I slept poorly for a couple of days thinking I was facing possible legal issues over hosting a little not-for-profit hobby website.

We've gotten them too, including one as far back as last April.

You did not lawyer up, but some other recipient might have had. Is there a ground for a lawsuit here for... well.. fraud? After all, resources were spent; surely, there was some stress..

Yeah, I agree with you.