6 ms·

The issue here was not primarily about deception. It seems mainly to be that (a) at least one recipient interpreted their mail as a legal threat, and (b) it was

by _jal 5y ago

The issue here was not primarily about deception. It seems mainly to be that (a) at least one recipient interpreted their mail as a legal threat, and (b) it was a mass-mailing. Spend a minute thinking through the implications if that were true, and you get a firestorm. I suspect visibility plays a role in the comparison you're making; out of sight, out of mind and all that. But much more importantly, someone sending you what you think is a legal threat is a lot more salient.

throwawyaaccoun 5y ago
Interesting. Ok, so let's say the deception wasn't the problem, suppose for the moment. Would the study have been more palatable if the researchers had more properly vetted the email list to ensure, say, >95% or perhaps even 100% were corporations that did fall under the law?
- _jal 5y ago
  Unless you're studying how people react to online legal threats, why would you not try to avoid this problem with your study entirely?
- s1artibartfast 5y ago
  Deception is a necessary part but not the key. The key is potential for distressing a real human being. The problem is that we live in a legal Society where everyone is at risk of life-altering legal consequences.
  - throwawyaaccoun 5y ago
    Oh, our society, especially America's, is overly litigious. I agree. But, pushing back a bit (in good faith), do you think asking an entity for your data, or asking them to delete it, should really be considered unusual and panic provoking? I said in another comment the same thing, but do you think this could be a moment of cultural learning?
    - s1artibartfast 5y ago
      In a perfect world, I do not think it should be stressful, but we don't live in that world. I think a stress response is reasonable, given the risk of legal consequences. Perhaps it is a learning moment, but I think the lesson should be to consider the impact of these kinds of studies. I'm sure it is a learning experience for bloggers as well, and some of them will learn that hosting a Blog is not worth the legal risk and take it down
      - s1artibartfast 5y ago
        The fact that everyone violates the law in some form, and anyone with sufficient will and resources could ruin a life with legal proceedings is why we have the concept of standing in American law. It acts as a filter so that only someone with skin in the game can bring suit. It is one protection against abuse, and why laws like that give anyone standing Texas abortion ban and forthcoming California gun legislation are problematic.
    - rcpt 5y ago
      > America is overly litigious. I recall seeing Ralph Nader speak at a fundraising event 20 years ago and asking the crowd "how many people have actually tried to sue someone?" and in a room of hundreds only a few hands went up. And a year ago when I took my landlord to small claims it was insane how complex the process was and how many paperwork pitfalls are in the way to disqualify you. I remember sitting on the half-day zoom call and watching case after case get thrown out because plaintiffs "forgot to file proof of service" or whatever. I'm generally good with paperwork and still nearly missed out. There may be some people in America who are overly litigious but for the general population the legal system is wholly inaccessible.
      - kortilla 5y ago
        It doesn’t matter. This isn’t a case where an individual would be suing. This is the government regulation coming down on someone after being flagged by “a victim”.
    - 5y ago
- nightpool 5y ago
  The requirements to be subject to the CCPA are any of: have a gross annual revenue of over $25MM; buy, receive, or sell the personal information of 50,000 or more California residents; derive 50% of more of your annual revenue from selling California residents’ personal information. Yes, I believe that if they emailed only sites for which that was true, I would have no issues with the study. The requirements to comply with the GDPR are much, much stricter and have a much more outsized effect on small, non-commercial site operators. There are no exceptions to the GDPR for non-profits or non-corporate entities. (except a limited carveout for "household processing" that AIUI has been interpreted very narrowly by the courts). I do not think the GDPR is strict enough in this instance, and I think it would have outsized harms on small and non-corporate operators to email them in this way if your only criteria is "could technically be subject to the GDPR in some possible world".
  - joshdata 5y ago
    I operate a website that likely meets one of the requirements to be subject to CCPA that received the emails from the research study. We have basically no revenue or staff. I didn't appreciate being lied to (about who was sending the message), being threatened (with legal enforcement), wasting my time (the study was scrapped), and being used for research without consent (the fact that this happens all the time doesn't excuse it). If they wanted to know our CCPA/GDPR policies, they could have simply asked. I also received emails from the study at two other domains I own and one that mentioned a domain I don't even own, but which probably don't matter for CCPA - all of which made me think that this was a scam and legal trap to take seriously.
- yjftsjthsd-h 5y ago
  Yes; if they had ensured that 100% of their targets were corporations then I would have very little concern about it.
- matkoniecz 5y ago
  5% of emails going to hobby websites would be unacceptable and unethical. If it would went solely to major corporations - more OK. Another part: do not lie that study does not involve human subjects.

by _jal 5y ago

throwawyaaccoun 5y ago

Interesting. Ok, so let's say the deception wasn't the problem, suppose for the moment. Would the study have been more palatable if the researchers had more properly vetted the email list to ensure, say, >95% or perhaps even 100% were corporations that did fall under the law?

_jal 5y ago
Unless you're studying how people react to online legal threats, why would you not try to avoid this problem with your study entirely?
s1artibartfast 5y ago
Deception is a necessary part but not the key. The key is potential for distressing a real human being. The problem is that we live in a legal Society where everyone is at risk of life-altering legal consequences.
- throwawyaaccoun 5y ago
  Oh, our society, especially America's, is overly litigious. I agree. But, pushing back a bit (in good faith), do you think asking an entity for your data, or asking them to delete it, should really be considered unusual and panic provoking? I said in another comment the same thing, but do you think this could be a moment of cultural learning?
  - s1artibartfast 5y ago
    In a perfect world, I do not think it should be stressful, but we don't live in that world. I think a stress response is reasonable, given the risk of legal consequences. Perhaps it is a learning moment, but I think the lesson should be to consider the impact of these kinds of studies. I'm sure it is a learning experience for bloggers as well, and some of them will learn that hosting a Blog is not worth the legal risk and take it down
    - s1artibartfast 5y ago
      The fact that everyone violates the law in some form, and anyone with sufficient will and resources could ruin a life with legal proceedings is why we have the concept of standing in American law. It acts as a filter so that only someone with skin in the game can bring suit. It is one protection against abuse, and why laws like that give anyone standing Texas abortion ban and forthcoming California gun legislation are problematic.
  - rcpt 5y ago
    > America is overly litigious. I recall seeing Ralph Nader speak at a fundraising event 20 years ago and asking the crowd "how many people have actually tried to sue someone?" and in a room of hundreds only a few hands went up. And a year ago when I took my landlord to small claims it was insane how complex the process was and how many paperwork pitfalls are in the way to disqualify you. I remember sitting on the half-day zoom call and watching case after case get thrown out because plaintiffs "forgot to file proof of service" or whatever. I'm generally good with paperwork and still nearly missed out. There may be some people in America who are overly litigious but for the general population the legal system is wholly inaccessible.
    - kortilla 5y ago
      It doesn’t matter. This isn’t a case where an individual would be suing. This is the government regulation coming down on someone after being flagged by “a victim”.
  - 5y ago
nightpool 5y ago
The requirements to be subject to the CCPA are any of: have a gross annual revenue of over $25MM; buy, receive, or sell the personal information of 50,000 or more California residents; derive 50% of more of your annual revenue from selling California residents’ personal information. Yes, I believe that if they emailed only sites for which that was true, I would have no issues with the study. The requirements to comply with the GDPR are much, much stricter and have a much more outsized effect on small, non-commercial site operators. There are no exceptions to the GDPR for non-profits or non-corporate entities. (except a limited carveout for "household processing" that AIUI has been interpreted very narrowly by the courts). I do not think the GDPR is strict enough in this instance, and I think it would have outsized harms on small and non-corporate operators to email them in this way if your only criteria is "could technically be subject to the GDPR in some possible world".
- joshdata 5y ago
  I operate a website that likely meets one of the requirements to be subject to CCPA that received the emails from the research study. We have basically no revenue or staff. I didn't appreciate being lied to (about who was sending the message), being threatened (with legal enforcement), wasting my time (the study was scrapped), and being used for research without consent (the fact that this happens all the time doesn't excuse it). If they wanted to know our CCPA/GDPR policies, they could have simply asked. I also received emails from the study at two other domains I own and one that mentioned a domain I don't even own, but which probably don't matter for CCPA - all of which made me think that this was a scam and legal trap to take seriously.
yjftsjthsd-h 5y ago
Yes; if they had ensured that 100% of their targets were corporations then I would have very little concern about it.
matkoniecz 5y ago
5% of emails going to hobby websites would be unacceptable and unethical. If it would went solely to major corporations - more OK. Another part: do not lie that study does not involve human subjects.