I just wrote a blog post about the ethical/professional obligations of the researchers associated with this study: http://www.maxmasnick.com/2014/06/28/facebook/

When you publish a paper, you are supposed to write in the body of the manuscript if it's been approved by an IRB and what their ruling was. I'm surprised it was published without this, even though it apparently was?

It's also appropriate to address ethical issues head-on in a paper about a study that may be controversial from an ethical perspective.

If it really was approved by an IRB, then the researchers are ethically in the clear but totally botched the PR.

If not, then I think the study was not ethical.