When news emerged this summer that Facebook had manipulated its users’s feeds to run a psychological experiment, people were angry. Many claimed the experiment was unethical.

But did it break the law?   

Two law professors at the University of Maryland now allege that it did. And, they add, online dating company OkCupid probably broke the law too, in an experiment the company’s CEO disclosed in a blog post called “We Experiment On Human Beings!”

The law professors, James Grimmelmann and Leslie Meltzer Henry, announced the allegation in a letter to the Maryland state attorney general yesterday and a blog post explaining their logic. They claim that Facebook and OkCupid specifically violated House Bill 917, a Maryland state statute that extends federal protections for human research subjects to all research conducted in the state.

Grimmelmann and Henry hope that the attorney general will halt all of Facebook and OkCupid’s research on Maryland residents until the two companies comply with the “Common Rule,” the federal regulations that dictate how human research should go through.

“The requirements specified by the federal Common Rule and Maryland law do not apply to research conducted under these circumstances,” said Facebook in a statement responding to the allegations. “We know some people were upset by this study and we are taking a hard look at our internal processes as a result.”

OkCupid did not respond to my request for comment.

To understand the law professors’s complaints, it helps to briefly review the law that governs research funded by the federal government—the so-called  “Common Rule.”

With some exceptions, the Common Rule requires all federally funded research to adhere to two procedures.

The first requirement: All human subjects must give informed consent before the experiment begins. That means more than saying “yes”: Human subjects must be given enough information by researchers to know what they’re getting themselves into.

The second: Any research involving humans must be vetted by an “institutional review board,” or an IRB, which vets the legality of the experiment.

This two-edged regime applies to all research that the U.S. government funds. Maryland's law, House Bill 917, extends those protections to all research conducted in the state, even if it isn’t federally funded. According to Grimmelmann and Henry, that catches Facebook and OkCupid, who both admitted to doing research on such large sets of users that they almost certainly included Maryland residents.

But was what Facebook and OkCupid did research? The two law professors argue that yes, it was.

“Both Maryland law and federal law define research as a systematic investigation designed to develop or contribute to generalizable knowledge,” says Henry. Because Facebook published the results of its study in the a scientific journal, the Proceedings of the National Academy of Sciences, and because OkCupid shared the results of its study online, the two companies clearly intended for their findings to be taken generally.

Since publishing his blog post, OkCupid’s CEO, Christian Rudder, has gone on a national press tour to promote his new book about the riches of user data. Rudder claims that his experiments on the dating site can help people understand all sorts of issues, down to the most pressing: OkCupid studies, he lightly writes, prove that racism “is pervasive.”

Grimmelmann and Henry wrote to Facebook and OK Cupid, informing them of the alleged law-breaking. OkCupid did not respond, but Facebook lawyer Edward Palmieri did. In a letter excerpted in the Washington Post, Palmieri said: “The federal Common Rule and the Maryland law you cite were not designed to address research conducted under these circumstances and none of the authorities you cite indicates otherwise.”

Facebook insists that the testing it was doing originated as product testing. And, indeed, “consumer acceptance study” is a specifically exempt kind of research under both federal and Maryland law.

But, in an email, Henry writes:

The Facebook deception study is categorically different from corporate optimization. It was not about product testing or maximizing business-oriented results for Facebook. It involved deceptively manipulating people's emotions for the purpose of testing a scientific hypothesis about emotional contagion, the results of which were ultimately published in a peer-reviewed scientific journal.

Grimmelmann said that this difference—between corporate testing and academic research—has been debated before.

“Websites are not the only entities that do both research and not research,” he told me by phone. “The line has been litigated, written about, and thought hard about. It’s not as though this problem has never been considered before.”

Even if a hospital changed internal procedures to waste fewer drugs, he added, it wouldn’t constitute research because their aims would be all internal. It’s publishing the research and making it generalizable that triggers the state law.

To Grimmelmann and Henry, Facebook’s legal response to their allegation contains a tell. Palmieri repeatedly referred to Facebook’s News Feed manipulation as “research” in his letter to them, and they believe this reveals that the study was, in fact, a systematic investigation to a generalizable end.

Some bioethicists are less certain.

“Besides relying on a (perhaps) poorly selected choice of words in Palmieri’s letter (referring to the manipulated feed as ‘research’), I do not believe that it has been demonstrated that what Facebook did was ‘human subjects research’ as defined by the Common Rule,” said Valerie Gutmann Koch in an email. Koch is a law professor at the Illinois Institute of Technology, and she previously served as the senior attorney to New York state’s bioethics commission.

Koch said she largely agreed with a July letter published in Nature by six bioethicists that said that, while it would have been preferable for Facebook to run its study past an IRB, the experiment did not constitute “an egregious breach of either ethics or law.”

Koch added: “I also believe that the actions taken by Facebook in this instance were similar, if not identical to, what we would expect from the company on a daily basis, rendering informed consent unnecessary.”

Maryland is not the only state with more advanced protection for human research subjects. New York and California have similar statutes. I asked Koch if either company was likely to raise the empire state’s ire.

She didn’t think so.

“Purely behavioral, social science, and epidemiological research are exempted from the definition of research under Article 24-A,” she wrote, referring to the clause that protects human subjects in New York state’s larger Public Health Law. “To the extent that the Facebook trial qualifies as behavioral or social science research, it may therefore not be subject to New York State law.”

If the attorney general enforced the Maryland law, it would be the first time House Bill 917 had been applied to a private company. The law was passed by overwhelming majorities in 2002, after two experiments—one that exposed Baltimore infants to lead dust, and another that led to the death of a 24-year-old technician—attracted local attention for ethics violations.

Both of the studies that led to the law were federally funded, and thus IRB-vetted, according to Henry. But, she added, the two studies “created awareness of the real costs—and often tragic costs—that we suffer when we don’t have ethical oversight of research.”

For now, Grimmelmann and Henry await a response from the state’s attorney general.

“Informed consent and review aren’t that hard. They’re doable. There’s no serious reason not to do them,” said Grimmelmann.

“I hope they will be interested in pursuing this,” he said of the state’s lawyers. “And I hope Facebook and OKCupid will be more open about taking this seriously.”