When a customer asks you to delete their data, the clock is already running.

Nineteen states now give consumers enforceable rights over their personal data — including the right to know what you've collected, the right to correct it, the right to take it elsewhere, and the right to have it deleted. The three most recent, Indiana, Kentucky, and Rhode Island, switched their laws on in January 2026 and are already in force, and each grants the full slate of access, deletion, correction, and portability rights. These aren't suggestions: under the CCPA, a business generally has 45 days to respond to a verified consumer request, and missing that obligation carries real cost.

Regulators have made the price of getting it wrong concrete. California's first major CCPA settlement required Sephora to pay $1.2 million, and the CCPA authorizes penalties of $2,663 per violation and $7,988 for each intentional one — multiplied across every affected consumer. The hard part for most businesses isn't willingness; it's the operational reality of receiving a request, verifying the requester's identity, finding the data across systems, and fulfilling it accurately within the deadline — every time, in every state, with proof.

DataRightsOS turns that scramble into a workflow. The widget gives consumers a clear, compliant request channel; verifies identity; routes the request through your systems; and keeps a complete, time-stamped audit trail — so a deletion request becomes a logged process instead of a fire drill.