The websites have to comply with the law, but a university should not be sending them emails lying about their obligations under any law. The emails were from

The websites have to comply with the law, but a university should not be sending them emails lying about their obligations under any law. The emails were from fake people. So any work preparing any response regarding those fake peoples personal data is obviously not required by law. They don't exist. And, as pointed out elsewhere in the thread, the researchers are probably not protected by either of CCPA or GDPR.