What California's New Privacy Law Means for Developers Building Compliance Tools

California's newest privacy law, SB 923, brings significant changes for developers creating compliance tools. Starting January 1, 2027, deletion requests under the California Consumer Privacy Act (CCPA) will extend to cover third-party data. If your application merges user profiles with data from external sources, those records are now subject to the same deletion rules.

For businesses operating solely online, the requirements are even more stringent. A mere email address is no longer sufficient for handling deletion, correct, or correction requests. Companies must provide a dedicated form or portal for users to exercise their rights.

This new landscape presents a genuine opportunity in the market. Most small teams managing user data lack the infrastructure to maintain suppression lists across various vendor systems, track third-party data sources, or build the necessary request infrastructure from scratch. The compliance burden is considerable, but the necessary tooling seems fragmented at best.

One potential solution could be a focused privacy workflow tool. This tool would connect deletion requests to vendor suppression lists, flag gaps in request intake, and maintain records of what has been addressed. Such a tool already seems to be a missing piece in the market, but it's not clear if anyone has already tackled this challenge. Developers might be overlooking this opportunity, or they might be underestimating the demand for such a solution.