CCPA Scam – Human subject research study conducted by Princeton University
I&#x27;m the person who wrote that blog post. I got an email from a fake person in France who asked several questions about my small social media site&#x27;s CCPA compliance, then ended the letter with:<p>&gt; I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code.<p>I thought I was about to be sued by someone who was the equivalent of a patent troll, but for the CCPA. I had a minor panic attack before I was able to calm down and piece together an open response (as I wasn&#x27;t about to reply directly to them, not after their thinly veiled legal threat). I briefly considered lawyering up just in case, which would have cost me a fair chunk of money.<p>After all that, it turns out it was research by Princeton University: <a href="https:&#x2F;&#x2F;privacystudy.cs.princeton.edu" rel="nofollow">https:&#x2F;&#x2F;privacystudy.cs.princeton.edu</a><p>The lead researcher, Ross Teixeira, says that:<p>&gt; We submitted an application detailing our research methods to the Princeton University Institutional Review Board, which determined that our study does not constitute human subjects research. The focus of the study is understanding website policies and practices, and emails associated with the study do not solicit personally identifiable information.<p>Either:<p>1. Teixeira misrepresented his research to the IRB, or<p>2. The IRB is grossly incompetent or unimaginative.<p>I don&#x27;t see a middle ground on this, particularly after the University of Minnesota vs Linux contributors debacle (see <a href="https:&#x2F;&#x2F;www.theverge.com&#x2F;2021&#x2F;4&#x2F;30&#x2F;22410164&#x2F;linux-kernel-university-of-minnesota-banned-open-source" rel="nofollow">https:&#x2F;&#x2F;www.theverge.com&#x2F;2021&#x2F;4&#x2F;30&#x2F;22410164&#x2F;linux-kernel-uni...</a>). I see Teixeira&#x27;s research as the equivalent of sending a bunch of fake legal notices to random people to &quot;study the legal system&quot;, while claiming with a straight face that it doesn&#x27;t involve human subjects research. Frankly, that&#x27;s bullshit, and I can&#x27;t believe someone signed off on this.<p>As noted on the blog post, I&#x27;ve reported this to Princeton&#x27;s Research Integrity &amp; Assurance department. This isn&#x27;t OK. I didn&#x27;t consent to be a part of their human research (which it absolutely <i>is</i>, however they might try to claim otherwise), and this research seriously freaked me out. I slept poorly for a couple of days thinking I was facing possible legal issues over hosting a little not-for-profit hobby website.