This was the biggest concern when GDPR came in, adding CCPA adds a whole other layer to the mess.
The issue is, you go this route then you get a dozen + “federal” level laws as well.
GDPR really opened a can of worms, and sadly for SMBs there is no real way to get out in front of them.