> Where your position falls apart is that they sent emails to private individuals. That in no way counteracts any part of my argument. Actually, if anything, i

> Where your position falls apart is that they sent emails to private individuals. That in no way counteracts any part of my argument. Actually, if anything, it reinforces it - the fact that the emails sent to private individuals were unintentional proves that there was no human research being done. It's quite clearly impossible to accidentally do research on humans. It is possible to unintentionally harm people as a result of doing non-human research - but then again, you can unintentionally harm others through traffic accidents, business deals, entering the wrong information into a database, engaging in gossip, accidentally bungling a normal research experiment (high-energy physics?) and doing just about anything in life. It should be really obvious that the possibility (or reality) of human harm doesn't imply human research. > Although I'm employed, I received the email to my personal address regarding a not-for-profit, zero-revenue hobby website I maintain. Another story here on HN was from them sending the letter to a blogger. ...and, really, there should have been no harm done. If you run a website, then you have a certain set of rights and responsibilities, and one of those responsibilities is to know exactly what data your site collects, and how to respond to a GDPR or CCPA request. That applies to you, to that other blogger, Xe, and every single person (and organization) that received these emails. And, if you weren't prepared for that, that's your fault, and consider this bungled research project a wake-up call.