CCPA Scam – Human subject research study conducted by Princeton University

Organizations are made up of humans.

Human experimentation is very broadly defined, for IRB purposes. As I understand it, if you're going to be asking humans to interact with researchers, in any way, and gathering data based on those interactions, that's human subjects research, and requires reasonable scrutiny from the IRB.

Source: I have worked fairly extensively with my own university's IRB, as I put together and maintain the website that they use to handle submissions.

These fall into three groups.

First, there are those jurisdictions in which you and/or your site are actually located. You almost always have to care about the laws in these jurisdictions.

Second, there are jurisdictions where the people who visit your site live. For these there are two questions. #1 does the jurisdiction think their law applies to you? #2 Does your jurisdiction, or someone else that you have to obey, agree?

The answer to #1 often depend on what your relationship is with the visitor. If you are selling (or trying to sell) them something it is more likely that the jurisdiction will think their law applies. If your website is not in any way targeted to them or encouraging them it is more likely that the jurisdiction won't think its law applies. (But some, like the EU with GDPR, do think it applies if you are tracking the behavior of EU users regardless of whether or not you are selling anything or trying to get EU visitors).

#2 is murkier. Say I've got a site in X specifically selling to people in Y. Y brings a civil case against me in Y. I ignore it thinking they can't touch me here in X, and Y gets a monetary judgement against me. I may be in for a surprise, because X may consider my sales to people in Y as taking place in Y, and so agree that Y has jurisdiction. If Y then brings the judgement to an X court to enforce, there is a decent change the X courts will enforce it. Oops.

Another thing you need to consider when thinking about #2 is entities that both you and the jurisdiction deal with. If you use a service provider (credit card processor, cloud service, hosting provider, etc) that operates in that jurisdiction, you may face pressure via that provider to obey the jurisdiction's law.

Finally, there are jurisdictions that you are not in, you aren't selling to or doing anything to attract visitors from, you are sure your jurisdiction won't cooperate with them on enforcing their laws, you don't use any services that operate there, and you aren't even going to visit there so even if you thoroughly annoy them no big deal.

You can probably mostly ignore these jurisdictions as far as privacy laws go.

If you are in the US I'd say that this currently means that you should be aware of GDPR and CCPA, and have some idea of how you will response to requests under them. For a lot of sites (like the OP's) a short form letter explaining that you are not covered should be fine.

As more states in the US pass their own CCPA-like laws, or we get Federal action on privacy, I'd expect those will generate large threads here. Keep an eye out for them and update your form letters appropriately.

I think this is where you may be overlooking the context.

People aren't mad they asked about compliance with a law, they are mad about the way it was asked: from fake personas implying legal threat, while cataloguing the replies for their study no one asked to be involved in.

In the absence of an organization that's good at this (which doesn't seem to exist and should), this probably should be the supervising professors.

Collectors of data should know what they have and who they have shared it with. Think of holding data as risky, as if the data is toxic. Think of the monetary and reputational risk of a data breach.

Incidentally, the data collected must be done so for a specific business purpose. And can even be kept if there are other requirements such as AML or KYC.

Just slapping a zero over the data is not a viable solution.