Claiming that this study was "human research" is straight-up insane. There's as much "human research" going on there as there is when statisticians acquire data

Claiming that this study was "human research" is straight-up insane. There's as much "human research" going on there as there is when statisticians acquire data by going to a human who possesses it and asking for it (e.g. they want to study baseball, so they go to the Head Excel Overlord of the MLB and ask for their data) - that is, exactly none. Analyzing data that was given to you by a human does not automatically make your research project "human research", full stop. The research question here is "How do organizations fulfill their legal requirements due to the GDPR and CCPA?" and has nothing to do with individuals. The researchers didn't want any data about the humans, they didn't ask for it, they weren't studying reaction time, psychological response, brain activity, or anything else about any humans at all. If the answer to the question "Could you replace a human in experiment with an automated process and still perform a meaningful experiment with conceptually identical results?" is "yes", then there is no human research going on. Test: Stanford Prison Experiment: answer "no" (because the students were actually the ones being studied), turns out to be human research. Test: studying the properties of a crystal in a lab, and one of the machines is operated by a human grad student, answer is "yes", not human research. (note also that this test just proves that human research isn't being done - if you replace the baseball players in the above example with robotic batters, the answer the above question is "no", but clearly human experimentation isn't happening) Similarly, if each of the individuals who were contacted were replaced with a Perl script scanning for keywords that automatically replied with the organization's GDPR and CCPA policies, the results from the experiment would be. Exactly. The. Same. In fact, let's go and look up the definition of "human subjects research": According to 45 CFR 46, a human subject is "a living individual about whom an investigator (whether professional or student) conducting research: Obtains information or biospecimens through intervention or interaction with the individual, and uses, studies, or analyzes the information or biospecimens; or Obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens." ...from the NIH at https://grants.nih.gov/policy/humansubjects/research.htm https://grants.nih.gov/policy/humansubjects/research.htm, and clearly does not describe what's going here. Let me repeat again: the fact that humans responded to the emails about GDPR+CCPA compliance of an organization owning the email is completely irrelevant. The experimenters didn't care about whether their request was serviced by a human or a computer, and in fact would have preferred computerized responses (instant response, more standardized formats, no possibility of human error). Claiming that this is "human experimentation" is disingenuous to the point of malice.