> as long as all representations made to customers about the service are met Exactly this. The thing that some people seem to be missing is that there is a (ve

> as long as all representations made to customers about the service are met Exactly this. The thing that some people seem to be missing is that there is a (very) good chance nothing is banned. It's just that you have to actually ask the customer. And IRB could waive a lot of the usual requirements (that are primarily intended for experiments with a LOT more risk). The Common Rule, in these cases, is primarily about enforcing that stuff like a boilerplate EULA does not count as properly informing the customer and getting their approval. When humans are involved you have to get explicit approval each time as a precaution, which isn't actually that hard.