We never had to deal with similar issues before. We didn't adopt the more conservative PLOS approach of denying users the right to publicly discuss ethical matters, but we reached a compromise by allowing you to flag the publication using this thread but removing it from the peer review thread.
That's not entirely true. There are at least two instances where it has been clear on this forum that Kirkegaard's actions were quite iffy. Once his ethics were directly questioned, and his answer was, in my judgement, unsatisfactory. Unfortunately no one in the forum acted on it.
At this point, I'd say we should wait for OKC legal office's reaction to your complaint letter. If they dismiss it or do not consider this a strong violation of their rules, then we can consider this issue resolved and close this ticket. If they take action, we'll have to keep this ticket open.
The ethical concerns exist independently of the legal concerns. I suggest you read up, for instance, on the Facebook Emotion Study. There the legal questions are much more favorable to the researchers (although some law professors still think some of their actions illegal in local laws, such as Maryland). Nevertheless, there was sufficient ethical concerns that this led the editorial board of PNAS to issue a formal "Editorial expression of concern" after the article's publication. It is even conceivable in my mind that some academic disciplines would have no trouble finding clearly illegal actions entirely ethical (reverse engineering internet platforms, for instance, is often against Terms of Service and is more and more likely to be a needed effort in science; note that the OkCupid dataset is not such an effort).
Let's now focus on the legal situation.
Since my complaint is against OkCupid, not Kirkegaard, OkCupid does not have the option to dismiss it or not consider it a strong violation of their rules. Of course, they could ignore my request for pre-arbitration dispute resolution, but then it would be up to a judge to decide on whether there was harm, negligence by OkCupid, or harm resulting from negligence. That judge would not be empowered to decide if Kirkegaard had violated Terms of Service, or at least it would not be his/her focus (and Kirkegaard would not be able to defend themselves there). On the other hand, OKCupid obviously has the option of turning against Kirkegaard and co-authors directly, or even U.S.-based co-conspirators such as Jayman and HBDchick (I am under the impression many of you would know them). They sort of already have started that process through DMCA takedowns on the data. We may never hear the result of this publicly however, and the editors might need to ask the authors directly for information in this direction.
Even then, the legal situation is not limited to the U.S. The Danish data protection authority might also investigate, and in fact
they are considering it. They might need additional encouragement, so I
wrote to them a letter (just mailed today) with hints that it might be wise to enlarge their investigation to Kirkegaard and co-authors' actions in Danish schools (i.e. previous papers which appeared here). I guess I will hear a response to this, but not editors to this journal unless they ask Kikegaard and co-authors.
While I applaud the editorial team's decision to proceed carefully on the matter, I do also think that it should proactively seek more information from the author as part of the open peer review process, and that these actions should be informed by ongoing legal procedures but also be independent. In any case, they are definitely part of the open peer review process.