If 20 people are in a coffee shop, then there are at least 21 cameras: One embedded in each person’s phone and, usually, one tucked high in the corner. What you say may be overheard and tweeted; you might even appear in the background of another patron’s selfie or Skype session. But that doesn’t stop even the most private people from entering coffee shops. They accept the risk inherent in entering a public place.

This notion—of a “reasonable” expectation of privacy—guides researchers hoping to observe subjects in public. But the very idea of what’s reasonable is a complicated one. Faculty at three universities—Duke, Stanford, and the University of Colorado at Colorado Springs—are facing backlash after creating databases built using surveillance footage of students as they walked through cafes and on college campuses. You might reasonably expect being overheard in a coffee shop, but that’s different from suddenly becoming a research subject, part of a data set that can live forever.

Ethics boards approved all three research projects, which used student data to refine machine-learning algorithms. The Duke University researcher Carlo Tomasi declined an interview with The Atlantic, but said in a statement to the Duke Chronicle that he “genuinely thought” he was following Institutional Review Board guidelines. For their research, he and his colleagues placed posters at all entrances to public areas, telling people they were being recorded, and providing contact information should they want their data erased. No one reached out, Tomasi told the Chronicle.

But when the parameters of his research changed, Tomasi admits he didn’t inform the IRB. For minor changes, that’s allowed. But Tomasi got permission to record indoors, not outdoors. And more significantly, he promised to allow access to the database only upon request. Instead, he opened it to anyone to download, he admitted to the Chronicle. “IRB is not to be blamed, as I failed to consult them at critical junctures. I take full responsibility for my mistakes, and I apologize to all the people who were recorded and to Duke for their consequences,” his statement reads.

Duke ultimately decided to delete the data set related to the research. Stanford did the same thing with a similarly derived data set its researchers created from patrons filmed at a San Francisco café. At UCCS, where researchers recorded students to test identification software, the lead researcher says the team never collected individually identifying information. Researchers for the Stanford and UCCS projects didn’t respond to requests for comment. In separate statements, each university reiterated that ethics boards approved all research, and underscored its commitment to student privacy.