Are you talking about the article or the paper? The paper is published at the Workshop on the Economics of Information Security (WEIS) with the conference char being people like Bruce Schneier. Besides, the author is Alessandro Acquisti and the details of their experiments are well outlined in the paper.
I understand that you see challenges, issues with their methods but you need to perform your own experiments and make a sound argument to make any strong statement. I'd be very cautious before I make a casual remark at a well conducted study. The study may have limitations but this doesn't mean the conclusions of the study are invalid.