What California's New Privacy Law Means for Developers Building Compliance Tools

I spent some time reading through California's SB 923, and the implications for anyone building privacy compliance tools are worth talking about.

Starting January 1, 2027, deletion requests under CCPA will cover third-party data too. If your app enriches user profiles using external sources, those records now fall under the same deletion obligations. And if you're running an online-only business, a simple email address won't cut it anymore—companies need an actual form or portal for requests to know, delete, or correct.

This is a genuine gap in the market. Most small teams handling user data aren't set up to maintain suppression lists across every vendor system, track which third-party sources feed their databases, or build out the request infrastructure from scratch. The compliance burden is real, but the tooling is scattered at best.

I'm thinking about what a focused privacy workflow tool could look like—one that connects deletion requests to vendor suppression lists, flags gaps in request intake, and keeps a record of what's been handled. It's the kind of thing that probably should exist but doesn't feel like it's been done cleanly yet.

Has anyone been working on something in this space? I'm curious whether others see the same opportunity or if I'm overestimating the demand side of this.