Stuff that would never pass an IRB is somehow just unregulated outside of academia

I would prefer them to go after mechanisms like this over tying all web activity to IDs I guess, but punishing and penalizing companies that have clear ill intent and demonstrate a lack of moral scruples seems the most efficient way to address the issues we’re seeing with social media design.