The survey was making a fraudulent legal threat, requiring the recipient do some things for the benefit of the sender (namely, providing them with data for the study; also lying about how that data will be used) based on false allegations that there is a legal duty for them to respond in some certain time, while in fact there is none.
The emails were from fake people. So any work preparing any response regarding those fake peoples personal data is obviously not required by law. They don't exist.
And, as pointed out elsewhere in the thread, the researchers are probably not protected by either of CCPA or GDPR.
* one honest email
* thousands or millions, sent under false pretenses
There are two differences:
1) I'm allowed to cold call you. I'm not allowed to set up a robot to place millions of automated phone calls.
2) If I lie, I may have a problem. Someone runs up to your home and yells that your house is on fire, and you believe them. You jump out of a second-story window, breaking your windows and your legs. They do it in a stunt for TikTok. Who do you think is liable?
A third difference is IRBs. The right place to handle this are complaints to OMB; Princeton should lose federal funding here.
No costs would have been incurred without Princeton asking a very scary question.
Additionally, by not disclosing that the question was research, they also skewed the results if they were looking to see what prevailing attitudes and practices actually are.
A huge amount of the people that got this were ethical, individual, not corporate, not profit.