> IRBs have intentionally broad mandates and cover quite a lot of things that most people would not immediately recognize as 'research' or 'experiments'.

And yet, professors routinely assign their students to conduct informal "studies" for class credit (perhaps a final project) or learning experience. These sort of "studies" are rarely, if ever, sent to any kind of IRB, and yet plenty of undergraduates are capable of creating a python scraper to download data from OkCupid.

> "There's a difference, based on the barrier to accessing that information"

What is "that information" in the case of this OkCupid study, and what is the "barrier," before and after the research was published? If the "information" is, for example, the fact that your spouse is cheating on you, does this research really remove any "barrier" to make it easier to discover than it was before publishing? If I wanted to know if my spouse was cheating on me, I could simply create an OkCupid profile and check the listings in my local town around my spouse's age range. Releasing the data of 60,000 OkCupid accounts, all of which is accessible from simply logging into the website, does not make it any easier for me to find that profile.

Also note that this is different from, say, the Ashley Madison hack, where email addresses were released from an internal, private database. The emails were not "public" information before the data dump, and therefore the data dump lowered the "barrier" to searching for a target individual amongst the thousands of members. In this case, it seems the "data dump" did not introduce any new paths of accessing information. Instead it simply mirrored information that already exists and is readily accessible by effectively anyone with a computer.