[volta83]

This might be an error on both sides.

They want to study how websites handle GDPR and CCPA, and that's probably what they submitted.

The IRB reasoned that "websites are not people", which is true, but failed to reason that "websites are operated by people", and therefore certain measures should be taken.

The IRB bears some responsibility for this.