Thanks for an honest reply. California has either already, or is in the process to introduce similar legislation, so you might need to worry about sooner than you might think.

I personally don't make my profile public on any service (LinkedIn in particular), but with your product being a browser extension, it sounds as if it's not limited to public profiles, but profiles visible to the current user.

In general, it is the responsibility of whoever might use your service to acquire permission from whomever they want to include in their databases, and to explicitely state what external data processors they use. You'd only be a data processor in that case, and you'd need to have a suitable contract with every customer, but IANAL, so take all this with a bucket of salt.

There is no simple way to chase after anyone who might be keeping my personal data, so I ain't doing that, but if you end up popular, you may get some good will if you make it easy for people to directly opt out.