The Bottom Line
- SB 690 would significantly curtail private CIPA pen-register claims involving websites, online applications, and mobile applications, removing a legal theory that has fueled thousands of website-tracking lawsuits in recent years.
- The bill does not eliminate CIPA exposure altogether. Private plaintiffs may continue bringing claims under other CIPA provisions, and courts will continue to shape how those provisions apply to website-tracking technologies.
- Businesses should continue strengthening privacy compliance programs, including auditing website-tracking tools, reviewing consent and disclosure practices, evaluating pending CIPA matters, and monitoring new privacy legislation.
On August 28, 2026, the California Legislature passed Senate Bill 690 (SB 690), delivering the strongest legislative response yet to the surge of website-tracking lawsuits under the California Invasion of Privacy Act (CIPA), as discussed in our prior alert. If signed by Governor Gavin Newsom, the bill will prevent private plaintiffs from bringing claims under Penal Code section 638.51, the provision that has driven much of the CIPA website-tracking litigation, for conduct involving internet websites, online applications, or mobile applications. If enacted, the measure will take effect on January 1, 2027, and apply retroactively to pending actions commenced within the prior two years.
This is promising news for businesses that have faced a mounting wave of demand letters, arbitrations and class action complaints alleging that commonplace digital tools such as cookies, pixels, and analytics scripts function as unlawful pen registers. However, SB 690 is not a blanket safe harbor, and the full impact on the litigation landscape will take time to materialize.
The Litigation Landscape before SB 690
CIPA was enacted in 1967 to prohibit the unauthorized recording or interception of private communications via wiretapping, eavesdropping, or related surveillance. Over time, lawmakers have periodically amended the statute to address evolving telecommunications technologies, but CIPA has never been updated sufficiently to keep pace with the modern internet.
Beginning around 2022, plaintiffs’ attorneys began using Penal Code section 638.51, CIPA’s pen-register and trap-and-trace provision, as a vehicle for website-tracking claims. Plaintiffs typically argue that ordinary website tools collecting IP addresses, URLs, device identifiers, and similar routing or signaling information constitute unlawful pen registers. By mid-2026, approximately 4,000 CIPA lawsuits had been filed, each carrying statutory damages of up to $5,000 per alleged violation.
Plaintiffs appear to have been drawn to section 638.51 because, unlike CIPA’s wiretapping provision (section 631) or its eavesdropping and recording of confidential communications provision (section 632), a pen-register claim does not require showing that the contents of a communication were intercepted contemporaneously with transmission.
Courts have likewise issued inconsistent rulings under CIPA, with some decisions favoring plaintiffs and others favoring defendants. Among other issues, courts have differed on what constitutes “wiretapping” under CIPA, including whether the use of third-party analytics tools or session replay software can trigger liability, and on issues of consent and standing. These conflicting decisions have created legal uncertainty, which continues to incentivize plaintiffs to file new claims and test the boundaries of CIPA liability.
What SB 690 Changes
SB 690 delivers a significant change through a narrowly drawn amendment. The bill leaves section 638.51’s substantive prohibition in place and instead changes CIPA’s civil-remedies provision so that only the California Attorney General may bring actions arising from alleged section 638.51 violations involving internet website, online application, or mobile application.
The limitation extends to pending claims in actions commenced within the two years preceding the bill’s operative date. For businesses currently defending against or facing threatened pen-register lawsuits, that retroactive reach could materially affect whether cases remain viable and/or the respective settlement leverage of the parties.
What SB 690 Leaves Intact
SB 690 does not, however, resolve the broader CIPA exposure businesses may face. The legislation addresses only one category of CIPA claims. Other provisions continue to support private rights of action, including:
- Section 631 (wiretapping), which bars unauthorized interception or use of communications; and
- Section 632 (confidential communications), which prohibits eavesdropping on and recording of confidential communications without consent.
Likely Impact on the Litigation Landscape
SB 690 is meaningful, but not a silver bullet. By foreclosing private section 638.51 actions for website-related conduct, the measure removes the theory most frequently asserted in recent CIPA litigation and puts immediate pressure on pending pen-register cases. Businesses defending section 638.51 claims could gain leverage to resolve those matters more efficiently.
That said, time will tell how the amendment reshapes the broader litigation environment. Plaintiffs’ counsel may attempt to replead website-tracking theories under sections 631 or 632. However, traditional website-tracking technologies may not fit neatly within those provisions, which generally require interception of the contents of a communication contemporaneously while it is being transmitted. Standard cookies, pixels, and analytics tools that capture routing or device-identification data — without intercepting the substance of a communication at the time it is made — may not satisfy those elements. If courts reach that conclusion, some plaintiffs could find themselves without a viable CIPA claim.
The bill’s impact may also extend beyond California. Class action attorneys who have built practices around CIPA website-tracking theories may look to other jurisdictions for analogous claims. Businesses with a national online presence should be on alert that similar claims may emerge in other states under similar privacy statutes or common-law theories.
Beyond SB 690: Another Privacy Development to Watch
The prospect of relief from SB 690 is no reason for businesses to scale back compliance efforts. Pending gubernatorial action and the January 1, 2027, effective date, organizations should:
- Continue auditing website-tracking technologies, third-party scripts, and vendor data flows to understand what information is collected, by whom, and for what purposes
- Review consent mechanisms and privacy disclosures to ensure they accurately reflect data-collection and data-sharing practices and operate consistently with applicable legal requirements
- Reassess any pending section 638.51 matters in light of SB 690’s retroactivity provision and its potential effect on viability and settlement value
- Monitor AB 1542 and similar sensitive-data legislation in other states to stay ahead of new restrictions on selling or sharing sensitive personal information
- Consult with counsel to develop a compliance strategy that accounts for remaining CIPA exposure, CCPA requirements, and the broader multistate privacy landscape