California’s SB 690 Clears the Legislature: What It Means for California Invasion of Privacy Act Website-Tracking Claims

On Friday, August 28, 2026, the California Legislature passed SB 690, a long-anticipated and closely watched bill that narrows the private rights of action available under the California Invasion of Privacy Act (CIPA). The bill cleared both houses with overwhelming, bipartisan support (including a unanimous 66–0 vote in the Assembly¹) and now sits on Democratic Gov. Gavin Newsom’s desk.

Although a substantial milestone and a step in the right direction for any business operating a website or app, even if signed, SB 690 will not end CIPA website-tracking litigation. But for businesses currently facing pen-register and trap-and-trace claims, it is a meaningful and overdue course correction.

SB 690 Passage and Legislative Background

CIPA was enacted in 1967 to address the interception of telephone communications, one of many state wiretapping laws passed in that decade. It was rarely used in civil litigation until recently, when an aggressive plaintiffs’ bar began to repurpose the statute to argue that routine website technologies (e.g., analytics tags, pixels, session-replay tools, and chatbots) amount to wiretapping or eavesdropping under §§ 631 and 632 or function like “pen register” or “trap and trace” devices under Penal Code § 638.51.

Because CIPA permits statutory damages starting at $5,000 per violation with no requirement to demonstrate actual harm, and plaintiffs contend that violations may be counted on a per-visitor or per-session basis, ordinary website activity can expose businesses to significant liability. According to the sponsors of SB 690, the number of CIPA website-tracking lawsuits grew from roughly 600 to nearly 4,000 since SB 690 was first introduced.² The lawsuits are only half — or less than half— of the story as businesses and nonprofits of all sizes have collectively received thousands of demand letters threatening suits based on the pen-register theory, often thought to be AI-generated.

While the vast majority of these claims have been settled, those that have proceeded to litigation have yielded mixed results for plaintiffs and defendants alike on motions to dismiss. This uncertainty coupled with the costs of litigation have supercharged what some California legislators earlier characterized as a rash of “shakedown” demands brought by the plaintiffs’ bar under CIPA.³

From Broad Reform to a Narrow Fix

As originally introduced in March 2025, SB 690 proposed a considerably broader intervention, which would have created a “commercial business purpose” exemption eliminating private lawsuits under CIPA’s wiretapping and eavesdropping provisions (§§ 631, 632, and 632.7) in addition to the pen-register and trap-and-trace provisions (§§ 638.50 and 638.51). That version did not advance, however, and the bill was revived in this year’s legislative session and substantially narrowed.

The version passed last week amends only § 637.2, limiting the provision to provide that solely the California Attorney General — not private plaintiffs — may bring an action against a private business for an alleged § 638.51 pen-register or trap-and-trace violation arising from conduct on a website, online application, or mobile application. The bill also applies retroactively to any pending claim in an action commenced within two years before its operative date.

It bears emphasizing that SB 690 does not clarify the substantive reach of trap-and-trace provisions of CIPA with respect to tracking technologies, leaving that rather dubious theory for courts to address. Rather, confronted with lobbying by California’s plaintiffs’ bar, the legislature adopted a narrower approach, removing private plaintiffs from the enforcement mechanism for this specific theory and vesting exclusive enforcement authority in the Attorney General. If history is any guide, it is unlikely that the state’s Attorney General will devote meaningful resources to prosecuting these types of claims based on the use of tracking technologies. The California Attorney General has had the authority to bring such claims for more than a decade but has not done so, opting instead to address issues related to tracking technologies under other theories and statutes such as the CCPA.

Claims under §§ 631 and 632 remain unaffected, continuing to be available to private plaintiffs. As a practical matter, until appellate courts clarify the reach of these provisions of CIPA, we may continue to see website operators use cookie banners to mitigate litigation risks arising from the expansive read of CIPA being advanced by the plaintiffs’ bar.

Three Key Takeaways for Businesses With Consumer-Facing Websites

1. Retroactivity Affects a Substantial Number of Threatened and Pending Cases

For businesses with a pending § 638.51 claim, the retroactivity provision is the most consequential aspect of SB 690. Rather than narrowing the private right of action only on a prospective basis, the legislature drafted the bill specifically to reach claims already pending, provided the underlying action was commenced within two years of the January 1, 2027, operative date. This gives defendants in pending pen-register matters a substantive basis to seek dismissal once the law becomes operative rather than continuing to litigate those claims to conclusion or resolving them under settlement pressure.

Retroactivity does not, however, provide automatic relief to every business that has received a CIPA-related communication. The statutory language applies to a “pending claim in an action commenced,” which is distinct from a presuit demand letter. Businesses with an open § 638.51 demand should not assume the claim is extinguished by operation of the statute; rather, they should reassess the claimant’s litigation leverage and, where litigation is already pending, ensure the retroactivity issue is preserved for the court once the bill becomes operative.

2. Plaintiffs’ Counsel Are Likely to Pursue Alternative Theories

SB 690 eliminates a single theory — private § 638.51 pen-register and trap-and-trace claims arising from website and app conduct — but leaves other CIPA theories intact. Because plaintiffs have often relied on the same underlying website-tracking conduct to assert claims under §§ 631, 632, and 638.51, businesses should anticipate that some plaintiffs’ firms may simply shift their focus to §§ 631 and 632, neither of which SB 690 amended. Given that pen-register claims are already commonly pled alongside wiretapping claims, this shift may be less a change in strategy than a change in which count receives primary emphasis.

Plaintiffs’ lawyers also likely will pursue theories outside CIPA, including under its federal analog, Title I of the Electronic Communications Privacy Act (ECPA), commonly called the Federal Wiretap Act. The ECPA contains substantially similar wiretapping and pen-register provisions and has been raised alongside CIPA claims addressing similar underlying conduct. Although the ECPA has a party exception providing that a private claim cannot be maintained where one party has consented to an interception, plaintiffs’ attorneys have aggressively argued that this crime-tort carveout to this exception should allow them to pursue claims for an intentional interception of website activity. While many courts have declined to entertain this theory, plaintiffs’ attorneys have had some success in certain jurisdictions in avoiding dismissal of ECPA claims in early motion practice based on this argument.

3. The Wave of Section 631 and 632 Litigation Should Be Expected to Continue

Perhaps the most important consideration for businesses is that SB 690, although a step in the right direction, will do little to stem the overall tide of CIPA litigation. The hundreds of businesses facing demands or litigation under §§ 631 or 632 may see limited practical impact from the bill’s passage. Overall, then, businesses will need to continue to carefully navigate the broader website-tracking litigation landscape, which has expanded to include scrutiny of not only session-replay tools, chat widgets, and pixels but analytic technologies and tags, mobile applications, form-data collection practices, and third-party scripts. The bill addresses one category of claims within that landscape but does not eliminate the need for businesses to continue evaluating website practices, consent-management processes, and privacy law compliance. And because SB 690 does not amend §§ 631 or 632, those provisions may continue to feature prominently in demand letters and litigation involving digital technologies while businesses wait for favorable rulings from appellate courts regarding the proper scope of these laws.

SB 690 now awaits Governor Newsom’s signature. Given the bill’s broad support in the legislature after compromises reached with the plaintiffs’ bar, he is likely to sign it. Businesses with pending CIPA matters, whether at the demand-letter stage or in active litigation, should consult with counsel regarding how the retroactivity provision may affect their specific circumstances and should remain mindful that the bill does not alter claims arising under §§ 631 and 632 regardless of its ultimate disposition.

 

---

 

1 Sen. Anna Caballero, Senator Caballero’s SB 690 Passed the California Legislature with bipartisan support, including a 39-0 Assembly Vote, Heads to Governor, https://sd14.senate.ca.gov/news/press-release/senator-caballeros-sb-690-passed-california-legislature-bipartisan-support (Aug. 31, 2026).
2 Id.
3 Hearing on S.B. 690 Before the S. Standing Comm. on Pub. Safety, 2025–2026 Leg., Reg. Sess. at 28:35 (Cal. Apr. 29, 2025) (statement of Sen. Anna Caballero), available at https://calmatters.digitaldemocracy.org/hearings/258956#t=1715&f=a705613762a9470e2b716124efd7f48a.