Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CCPA Scam – Human subject research study conducted by Princeton University

blog.freeradical.zone

Post reply on HN
Print view View original

51–60 of 353 posts

Re: CCPA Scam – Human subject research study conducted by Princeton University

#51

Post by ineedasername »

kstrauser wrote: post #6

I'm the person who wrote that blog post. I got an email from a fake person in France who asked several questions about my small social media site's CCPA compliance, then ended the letter with: > I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. I thought I was about to be sued by someone who was the equivalent of a…

1. Teixeira misrepresented his research to the IRB, or

2. The IRB is grossly incompetent or unimaginative

My experience with IRB's is that they are often extremely conservative in their interpretations. Legal liability is attached to them. Human-involved research requires an order of magnitude more review to get approved. There are gray areas, and my (very limited) direct observations are that people will try to frame their material to avoid the extra review. I can't rely completely on Princeton's reputation for this, but if I had to guess, Ross either did a poor job presenting to the IRB or deliberately downplayed the nature of the of things.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#52

Post by dangrossman »

ineedasername wrote: post #26

Ross Teixeira, the PhD student that did this, had the brazen nerve to post this lie on Twitter: Responses to the study have been overwhelmingly positive, and I particularly appreciate the notes of encouragement that some websites have sent. We look forward to sharing results in the coming year, with the goals of identifying best practices and informing future policy making. https://mobile.twitter.com/RossTeixeira/sta…

> Responses to the study have been overwhelmingly positive

7 days ago my response to this study included that the "vague legal threat at the end of your mail is immoral and gross". I guess he considered that a positive.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#53

Post by ncallaway »

the_optimist wrote: post #25
apignotti wrote: post #5

Yep, we got the same. Seriously unethical behavior.

Please explain why this is unethical. The worst case is that you’re simply subject to the law. Presumably you’re abiding by the law. edit: I'm playing devil's advocate. I think the law sucks, the study is weird, and I empathize directly with the blog author. That said, downvoting to 'disagree' without explaining your reasoning is below the grade of this fine institution.

Sure. In my view there are two things that are unethical about this email.

The first is that they lied about who they were (and lied by omission about the purpose of the email). The ethics of deceiving someone for research are complicated, but should go through an IRB evaluation. Since they avoided the IRB by claiming it was a study about process, they should have avoided the ethics issues from lying in the survey.

They should have been up-front and honest about who they were, and why they were asking the question.

If their research truly requires deceiving the participant (and, I’m not at all convinced that it does), then it needed to be rigorously evaluated by the IRB, which almost certainly should and should have rejected it.

Second, their research makes a demand for a response “without undue delay”, rather than a request. That is also unethical, as it’s misrepresenting the law and implying a response within 45 days is required by law. It is not.

Many of the involuntary subject participants are not subject to the cited provision of the law. As such, demanding a response within the time frame and citing that provision of the law is misleading. Also, the law makes no requirement for a business to respond to such a query within 45 days. The legislative text is here (https://casetext.com/statute/california-codes/california-civ...) and the only 45 day window that exists is for responding to an actual CCPA request, which this query explicitly disclaimed from being. So even if this was a business required to comply with CCPA, they are not required to respond to this query. So, they lied (by implication) to claim that provision of the law approach lied to the business, and lied (explicitly) by claiming the law created a duty to respond to the email within a 45 day period, which it does not.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#55

Post by numpad0 »

User23 wrote: post #20

Serious question: why should academic institutions be held to a higher standard than commercial ones? Google and Facebook, to just name two, routinely perform human subject research without informed consent as a matter of course. That's what A/B testing is. Ethically speaking the fine print in the ToS obviously isn't actually informed consent, even if the law says it is. I don't see why being a for-profit company sho…

I thought similar - it's such a routine and basic task to set up and run A/B testing to measure and optimize websites and apps for preferred conscious or subconscious response to visual stimuli. If this is a human subject research and human subject research without consent is a crime against humanity, most if not any proper web developer and the whole Web industry collectively are technically guilty of such a mouthful and abstract crime, which by the way I think they are.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#56

Post by ncallaway »

reactspa wrote: post #13

> reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code So I looked this up and it really exists. I wonder if an account holder of a Facebook or Google account can use this law to get actual customer service.

There are three things that you can demand of a company (that meets certain revenue thresholds) if you’re a California resident:

- that they delete information about you that they have (with potential exceptions) - that they provide you with what information they have about you, and for what purposes they have that information (with exceptions) - that they opt you out of sharing data with other entities (with exceptions)

You cannot, as implied by the email, demand a response to an arbitrary query. There are essentially three queries the companies are required to answer with 45 days (90, if they opt for the 45 day extension). So, it can certainly be helpful in some situations, but will not serve as a general purpose CS tool.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#57

Post by ineedasername »

kstrauser wrote: post #29
labcomputer wrote: post #22

Earlier quoted context omitted.

Might be worth reaching out to Princeton's IRB? https://undergraduateresearch.princeton.edu/compliance/human...

Done, thanks. I'm not sure what the difference is between that and their RIA ( https://ria.princeton.edu/report-concern ), but now I've reported it to both.

The IRB is underneath the RIA. If this was the IRB's screwup, it's the RIA they will answer to. And probably a nice chat with general counsel to assess any liability.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#58

Post by kstrauser »

annoyingnoob wrote: post #49
kstrauser wrote: post #16

Earlier quoted context omitted.

If there's a settlement, I hope it's in the form of a nice bottle of scotch, and a letter from Princeton apologizing and swearing not to do it again. I'm not out money; I'm out peace of mind.

I don't think this reaches the level of a cash settlement, personally. It is certainly shocking and would upset me. I agree that Princeton should try harder.

Same. I’m neither asking for nor wanting any kind of a settlement or anything. I just want them not to do it again.

Re: CCPA Scam – Human subject research study conducted by Princeton University

#59

Post by ineedasername »

ajkjk wrote: post #30
kstrauser wrote: post #6

I'm the person who wrote that blog post. I got an email from a fake person in France who asked several questions about my small social media site's CCPA compliance, then ended the letter with: > I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code. I thought I was about to be sued by someone who was the equivalent of a…

I don't understand why you reacted so strongly. I feel like it's not a big deal to receive a message like that; what am I missing?

Because receiving a letter citing chapter & verse of the legal code is generally never the precursor to a nice friendly chat.

The actual-not-fake-researcher (instead of fictional people) could have sent a nice friendly request saying, "I'm a PhD candidate working on public policy in the tech sector. Could you please answer the following questions regarding your process of CCPA compliance, if applicable"

Post reply on HN