This is an interesting question. I was technical lead for CCPA and GDPR implementation at my company. We keep hashes of email addresses that have asked to be fo

This is an interesting question. I was technical lead for CCPA and GDPR implementation at my company. We keep hashes of email addresses that have asked to be forgotten and we compare new email signups with the hash list to make sure we never collect their information. Both laws allow companies to keep lists of requests but we like to be extra secure.