The unethical part is not that the experimenters sent these messages to the owners of the websites. It's that they: a) did not get the people's informed conse

The unethical part is not that the experimenters sent these messages to the owners of the websites. It's that they: a) did not get the people's informed consent to participate in human subjects research, b) misrepresented themselves as being potentially-litigious parties interested in the handling of their own data under the CCPA, who further were misrepresenting the degree to which the CCPA applied to them, and c) misled their IRB into believing this was not human subjects research, so that they did not get stopped from doing (a). (That, or the IRB itself is culpable for this aspect of the unethical behavior; I haven't seen specific information one way or the other.) And to be clear about these requirements: You may recall stories about psychological experiments during the Cold War, like the Milgram Experiments (where the participants were told to administer electric shocks to people), and the Stanford Prison Experiment (where they assigned a bunch of undergrads to be prisoners and guards). Due to wildly unethical experiments like those, the scientific institutions of our country developed the system of Institutional Review Boards (the aforementioned IRB), which have fairly clear standards that they hold researchers to (though, granted, those standards will naturally vary somewhat from institution to institution). One of the primary purposes of IRBs is to ensure that all human scientific research participants give informed consent to participate in the study. That means, among other things, they have to be informed of the risks of the study—and those risks, by design, must include the mental distress that can be caused by the experiment. (That, after all, was the primary negative outcome of the Milgram Experiments and the Stanford Prison Experiment: they caused serious psychological distress.) I don't work at Princeton, so I can't speak to the specifics of how they consider such things, but I do work for the psychology department of a university with a strong tradition of research—in fact, I built the web-based system the IRB here now uses to manage their workflow, so I've worked closely with them for over a decade now—and I can tell you with some certainty that letters like these would not in any way be considered acceptable without a signed informed consent form. They are very clearly designed to evoke an emotional response in the recipients—a fear response, specifically—and that absolutely requires the full scrutiny of the IRB.