Law Professor Claims Any Internet Company 'Research' On Users Without Review Board Approval Is Illegal

from the you-sure-you-want-to-go-there dept

For many years I've been a huge fan of law professor James Grimmelmann. His legal analysis on various issues is often quite valuable, and I've quoted him more than a few times. However, he's now arguing that the now infamous Facebook happiness experiment and the similarly discussed OkCupid "hook you up with someone you should hate" experiments weren't just unethical, but illegal. Grimmelmann, it should be noted, was one of the loudest voices in arguing (quite vehemently) that these experiments were horrible and dangerous, and that the academic aspect of Facebook's research violated long-standing rules.

But his new argument takes it even further, arguing not just that they were unethical, but flat out illegal, based on his reading of the Common Rule and a particular Maryland law that effectively extends the Common Rule. The Common Rule basically says that if you're doing "research involving human subjects" with federal funds, you need "informed consent" and further approval from an institutional review board (IRB), which basically all research universities have in place, who have to approve all research. The idea is to avoid seriously harmful or dangerous experiments. The Maryland law takes the Common Rule and says it applies not just to federally funded research but "all research conducted in Maryland."

To Grimmelmann, this is damning for both companies -- and basically all companies doing any research involving people in Maryland. In fact, he almost gleefully posts a letter he got back from Facebook concerning this issue and alerted the company to the Maryland law. Why so gleeful? Because Facebook's Associate General Counsel for Privacy, Edward Palmieri, repeatedly referred to what Facebook did as "research," leading Grimmelmann to play the "gotcha" card, as if that proves that Facebook's efforts were subject to that Maryland law (making it subject to the Common Rule). He further then overreacts to Palmieri, noting (accurately, in our opinion) that the Maryland law does not apply to Facebook's research as Facebook is declaring that the company "is above the law that applies to everyone else."

Except... all of that is suspect. Facebook is not claiming it is above the law that applies to everyone else. It claims that the law does not apply to it... or basically any company doing research to improve its services. Grimmelmann insists that his reading of Maryland's House Bill 917 is the only possible reading, but he may be hard pressed to find many who actually agree with that interpretation. The Common Rule's definition of "research" is fairly broad, but I don't think it's nearly as broad as Grimmelmann wants it to be. Here it is:

Research means a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.

I think it's that last bit that may be problematic for Grimmelmann. It focuses on academic research "designed to develop or contribute to generalizable knowledge." That wording, while unfortunately vague, really appears to be focused on those who are doing research for the purpose of more publicly available knowledge. And while perhaps the Facebook effort touches on that, since it eventually became published research, it still seems like a stretch. Facebook wasn't doing its research for the purpose of contributing to generalizable knowledge -- but to improve the Facebook experience. Based on that, the company also shared some of that data publicly. Similarly, OkCupid's research was to improve its own services.

But under Grimmelmann's interpretation of the law, you'd have some seriously crazy results. Basic a/b testing of different website designs could be designated as illegal research without IRB approval or informed consent. I was just reading about a service that lets you put as many headlines on a blog post as you want and it automatically rotates them, trying to optimize which one gets the best results. Would that require informed consent and an IRB? Just the fact that companies call it "research" doesn't make it research under the Common Rule definition. How about a film studio taking a survey after showing a movie. The movie manipulates the emotions of the "human subjects" and then does research on their reactions. Does that require "informed consent" and an IRB?

How about a basic taste test -- Coke or Pepsi? Which do you prefer? It's research. It's developing knowledge via "human subjects." But does anyone honestly think the law for running a taste test means that any company setting up such a taste test first needs to get an IRB to approve it? The results of Grimmelmann's interpretation of the law here are nonsensical. Grimmelmann is clearly upset about the original research, and certainly there were lots of people who felt it was creepy and potentially inappropriate. But Grimmelmann's focus on actively punishing these companies is reaching obsession levels.

For one thing, many academic journals require Common Rule compliance for everything they publish, regardless of funding source. So my colleague Leslie Meltzer Henry and I wrote a letter to the journal that published the Facebook emotional manipulation study, pointing out the obvious noncompliance. For another, nothing in Facebook’s user agreement warned users they were signing up to be test subjects. So we wrote a second letter to the Federal Trade Commission, which tends to get upset when companies’ privacy policies misrepresent things. And for yet another, researchers from universities that do take federal funding can’t just escape their own Common Rule obligations by “IRB laundering” everything through a private company. So we wrote a third letter to the federal research ethics office about the Cornell IRB’s questionable review of two Cornell researchers’ collaborations with Facebook.

And that's before the letters to Facebook and OkCupid -- and, of course, to Maryland's attorney general, Doug Gansler. Of course, if Gansler actually tried to enforce such an interpretation of the law (which is not out of the question, given how quick many attorney generals are to jump on grandstanding issues that will get headlines), it would represent a very dangerous result -- one in which very basic forms of experiments and modifications in all sorts of industries (beyond just the internet) would suddenly create a risk of law-breaking. That's a result incompatible with basic common sense. Grimmelmann's response to that seems to be "but the law is the law," but that's based entirely on his stretched interpretation of that law, one that many others would likely challenge.

Filed Under: common rule, experiments, human subjects, informed consent, irb, james grimmelmann, maryland, research
Companies: facebook, okcupid

Facebook Messed With The Emotions Of 689,003 Users... For Science

from the and-maximum-creepiness dept

As you may have heard (since it appears to have become the hyped up internet story of the weekend), the Proceedings of the National Academy of Sciences (PNAS) recently published a study done by Facebook, with an assist from researchers at UCSF and Cornell, in which they directly tried (and apparently succeeded) to manipulate the emotions of 689,003 users of Facebook for a week. The participants -- without realizing they were a part of the study -- had their news feeds "manipulated" so that they showed all good news or all bad news. The idea was to see if this made the users themselves feel good or bad. Contradicting some other research which found that looking at photos of your happy friends made you sad, this research apparently found that happy stuff in your feed makes you happy. But what's got a lot of people up in arms is the other side of that coin: seeing a lot of negative stories in your feed appears to make people mad.

There are, of course, many different ways to view this: and the immediate response from many is "damn, that's creepy." Even the editor of the study, admits to the Atlantic, that she found it to be questionable:

"I was concerned," she told me in a phone interview, "until I queried the authors and they said their local institutional review board had approved it—and apparently on the grounds that Facebook apparently manipulates people's News Feeds all the time... I understand why people have concerns. I think their beef is with Facebook, really, not the research."

Law professor James Grimmelmann digs deeper into both the ethics and legality of the study and finds that there's a pretty good chance the study broke the law, beyond breaking standard research ethics practices. Many people have pointed out, as the editor above did, that because Facebook manipulates its news feed all the time, this was considered acceptable and didn't require any new consent (and Facebook's terms of service say that they may use your data for research). However, Grimmelmann isn't buying it. He points to the official government policy on research on human subjects, which has specific requirements, many of which were not met.

While those rules apply to universities and federally funded research, many people assumed that they don't apply to Facebook as a private company. Except... this research involved two universities... and it was federally funded (in part) [Update: Cornell has updated its original story that claimed federal funding to now say the study did not receive outside funding.]. The rest of Grimmelmann's rant is worth reading as well, as he lays out in great detail why he thinks this is wrong.

While I do find the whole thing creepy, and think that Facebook probably could have and should have gotten more informed consent about this, there is a big part of this that is still blurry. The lines aren't as clear as some people are making them out to be. People are correct in noting that Facebook changes their newsfeed all the time, and of course Facebook is constantly tracking how that impacts things. So there's always some "manipulation" going on -- though, usually it's to try to drive greater adoption, usage and (of course) profits. Is it really that different when it's done just to track emotional well-being?

As Chris Dixon notes, doing basic a/b testing is common for lots of sites, and he's unclear how this is all that different. Of course, many people pointed out that manipulating someone's emotions to make them feel bad is (or at least feels) different, leading him to point out that plenty of entertainment offerings (movies, video games, music) also manipulate our emotions as well -- though Dixon's colleague Benedict Evans points out that there's a sort of informed consent when you "choose" to go to see a sad movie. Though, of course, a possible counter is that there are plenty of situations in which emotions are manipulated without such consent (think: advertising). In the end, this may just come down to being about what people expect.

If anything, what I think this does is really to highlight how much Facebook manipulates the newsfeed. This is something very few people seem to think about or consider. Facebook's newsfeed system has always been something of a black box (which is a reason that I prefer Twitter's setup where you get the self-chosen firehose, rather than some algorithm (or researchers' decisions) picking what I get to see). And, thus, in the end, while Facebook may have failed to get the level of "informed consent" necessary for such a study, it may have, in turn, done a much better job of accidentally "informing" a lot more people how its newsfeeds get manipulated. Whether or not that leads more people to rely on Facebook less, well, perhaps that will be the subject of a future study...

Filed Under: consent, emotions, ethics, informed consent, newsfeed
Companies: facebook