RANDAZZO 001 - Beyond the Classroom: Why the "Non‑Generalizable Research" IRB Carveout in California Higher Education Does Not Eliminate California Penal Code §632 Liability Risk When Student Interviews Are Uploaded to Third‑Party Platforms

California institutions often rely on the pedagogical “non‑generalizable research” carveout to exclude many class assignments from Institutional Review Board (IRB) review. This Article shows why that administrative carveout does not foreclose liability risk under California’s Invasion of Privacy Act (CIPA) §632 when students record interviews and upload the resulting audio/video and transcripts to third‑party vendors (e.g., Canvas LMS and its sub‑processors). First, §632’s two‑party consent rule applies to “confidential communications,” regardless of IRB status, and civil remedies are available under §637.2. Second, because vendor privacy/retention terms authorize disclosure to sub‑processors and storage outside instructor control, upload events can move data outside the definitional bounds of “classroom activities,” undermining the premise of the IRB carveout. Third, where students cannot make complete and accurate disclosures of vendor processing/redisclosures, any purported “consent” to recording risks being structurally defective. We formalize these dependencies in a logic model and prove: (1) the IRB carveout is orthogonal to §632; (2) upload to third‑party platforms breaks the “classroom‑boundedness” condition; and (3) inadequate disclosure vitiates consent, re‑exposing actors to §632. Keywords: California Invasion of Privacy Act (CIPA), Penal Code §632, IRB, Common Rule, generalizable knowledge, classroom activities, Canvas, Instructure, third‑party disclosure, redisclosure, informed consent, formal methods.