As someone whose done work on "human subjects" during grad school, this is also a fireable offense, even in some deeply protective places like academia, except that this is a private company and can vaguely claim user consent. As for how this would have played out in any other research setting: http://www.thefacultylounge.org/2014/06/how-an-irb-could-hav...