The Maryland House Bill 917 is at http://mlis.state.md.us/2002rs/billfile/hb0917.htm . The gist of it is:

(a) Compliance with federal regulations. -- A person may not conduct research using a human subject unless the person conducts the research in accordance with the federal regulations on the protection of human subjects.

(b) Scope to include all research. -- Notwithstanding any provision in the federal regulations on the protection of human subjects that limits the applicability of the federal regulations to certain research, subsection (a) of this section applies to all research using a human subject.

My problem is, I'm not sure what MD 917 (b) means. I'll start with §46.102 (a) (1) at http://www.hhs.gov/ohrp/humansubjects/guidance/45cfr46.html#... :

> (a) (1) Research that is conducted or supported by a federal department or agency, whether or not it is regulated as defined in §46.102, must comply with all sections of this policy.

Is MD 917 (b) supposed to mean that §46.102 (a) (1) applies to all human research in Maryland? I believe that's the case, because §46.102 (a) (2) only applies to those organizations which are regulated by a federal department, so would already be covered under the law.

Section §46.102 (b) has a list of human research which is exempt. The most relevant for Facebook and OkCupid appears to be:

> (2) Research involving the use of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures or observation of public behavior, unless: (i) information obtained is recorded in such a manner that human subjects can be identified, directly or through identifiers linked to the subjects; and (ii) any disclosure of the human subjects' responses outside the research could reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, or reputation. [Note: does not apply to children.]

If A/B testing falls under 'educational tests' or 'survey procedures' then it's exempt.

Otherwise - and this is another tricky part - §46.102 (c) says "Department or agency heads retain final judgment as to whether a particular activity is covered by this policy."

Who is the department head for Facebook and OkCupid? §46.102 (a) defines it as:

> (a) Department or agency head means the head of any federal department or agency and any other officer or employee of any department or agency to whom authority has been delegated.

MD 917 doesn't have the information for how to interpret §46.102 outside of the federal context for which it was written.

An alternative interpretation of MD 917 (b) is that no human testing is exempt, including §46.102 (b) (2) which allows surveys. Instead, all testing must go through an IRB.

However, if that's the case then the other exceptions of §46.102 (b) are also no longer allowed, including

> (4) Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.

which would require IRB review for every historian working out of previously published materials.

Therefore, I don't think this alternative interpretation is correct.

Which means I don't know if MD 917 really applies to OkCupid or Facebook. (The Facebook research was published in a journal which follows the Common Rule compliance; I presume the journals have a way to resolve the question of what "department head" means when there is no department head - it must have come up before. I only investigated MD 917 compliance here.)

_EDIT_ : The MD attorney general clarified this at http://www.oag.state.md.us/Healthpol/hb917letter.pdf .

> Implicit in the federal regulations, and therefore in House Bill 917's mandate for compliance with these regulations, is the requirement that a person have in place a reasonable process for determining whether research falls within one of the exempt categories.

So determining if A/B testing is exempt comes down to if there's a reasonable process for determining if it's exempt. It's not clearly illegal.