(cross posting from my comment on the other story) It isn't human subjects research just to read what a website says about its compliance to a law (or lack the

(cross posting from my comment on the other story) It isn't human subjects research just to read what a website says about its compliance to a law (or lack thereof), but once you start reaching out to actual humans to discuss the matter, it definitely does become human subjects research (we would categorize this as an interview or survey). At the very least, the emails should have come with a notice that they were being sent as part of an academic study - after all, misleading your participants wasn't a goal of this study!