I see them boasting that the IRB determined "our study does not constitute human subjects research."
I don't see them acknowledging that they slipped under the IRB's radar by consistently referring to human subjects as "websites."
That's probably the big thing that people should learn from this, I think this is a pretty common misconception.
There is a lot of precedent in using the mystery shopper technique to assess companies that aren't considered Human Subjects Research even if the interface to that company is a single human being.
Your analogy with mystery shopper doesn't hold the water as well since the researchers in such cases are just executing the primary function of the businesses in question. So while for the bigger sites you might be correct that the research is not a human subject research but it's still an abuse of service which in unethical without consent as well.
They want to study how websites handle GDPR and CCPA, and that's probably what they submitted.
The IRB reasoned that "websites are not people", which is true, but failed to reason that "websites are operated by people", and therefore certain measures should be taken.
The IRB bears some responsibility for this.
I prefer action, charitable interpretation, and progress. I found this update rather encouraging:
> Third, I will use the lessons learned from this experience to write and post a formal research ethics case study, explaining in detail what we did, why we did it, what we learned, and how researchers should approach similar studies in the future. I will teach that case study in coursework, and I will encourage academic colleagues to do the same. While I cannot turn back the clock on this study, I can help ensure that the next generation of technology policy researchers learns from it.
Instead of wasting time by making another person or entity go through the humiliation gauntlet, let them improve their surroundings.