The study methodology apparently involved a sample of high-traffic websites from https://tranco-list.eu. I have a hard time believing that the operators did not have to deal with such requests before. I always add the 30 day statements in my GDPR requests, mostly to make sure the support people set a calendar reminder to reply before the date. The next step if no reply is received is to complain to the data privacy watchdog in the country of the website operator or in your country if the website is operated outside EU (though I always begin with an email follow-up). Nobody would go to court after 30 days of a GDPR request without going through the govt data protection agency first. And to be clear, only requests are entitled to a 30-day reply and the email said that no formal request is being filed at the time [1].

But yes, that was clearly human research and the IRB should have grilled the PI about that.

[1]: https://christine.website/blog/princeton-study-2021-12-17

Edit: as you can see from the replies below, not only the study ethics is questionable but also the technical details about its methodology.