I think most businesses have changed their menus around, relocated products in the store, and in other ways changed aspects of the experience, specifically to see how customers would respond so that they could improve their operations.
Facebook got in a lot of hot water for changing its algorithm around to see how its users would react. Now, the users aren't exactly customers, as they're not paying for anything and are volunteering to use the service. But that just means that if FB is going to get into hot water for such studies, other businesses that are analyzing their customers' behavior might get into hot water too.
But there's really no standard or discussion, that I know of (and maybe I'm quite wrong here, which would be fine) as to when IRB approval would be necessary for businesses to change their way of doing business to test customer activity. Should there be, and what should that protocol be?