On September 30, 2026, Governor Newsom signed SB 690, ending private lawsuits that treat ordinary website and app tracking tools as illegal "pen registers" or "trap and trace" devices under the California Invasion of Privacy Act (CIPA). Starting January 1, 2027, only the Attorney General may bring those claims against private businesses. However, SB 690 leaves CIPA's wiretapping provisions untouched and the plaintiffs' bar is already pivoting there.

Takeaways

• SB 690 eliminates private actions for website, online application and mobile application based pen-register and trap and trace claims under CIPA.
• Commencing January 1, 2027, only the Attorney General may sue a private actor under Penal Code section 638.51.
• The bill applies retroactively to certain claims filed on or after January 1, 2025.
• Wiretapping claims under CIPA survive. Expect demand letters and complaints to be recast as wiretap claims, particularly those targeting session replay, chat, and advertising pixels.
• Consent mechanisms, accurate disclosures, and vendor controls remain the best defense against the remaining private claims and any Attorney General enforcement.

What is CIPA?

CIPA (Penal Code § 630 et seq.) was enacted in 1967 to combat wiretapping and eavesdropping. In 2015, the Legislature added provisions regulating "pen registers" and "trap and trace devices," tools that capture dialing, routing, addressing or signaling information, historically used by law enforcement on phone lines. Plaintiffs have since filed hundreds of lawsuits, and sent countless more pre-suit demand letters, arguing that routine website tools such as cookies and pixels are illegal "pen registers" or "trap and trace" devices, seeking $5,000 in statutory damages per violation under section 637.2.  Courts have taken notice: In October 2025, Judge Vince Chhabria called CIPA "a total mess." (Doe v. Eating Recovery Ctr. LLC, No. 23-CV-05561-VC, 2025 WL 2971090, at *1–2 (N.D. Cal. Oct. 17, 2025))

Sen. Anna Caballero, the bill’s author, said SB 690’s goal is to “protect California businesses from a new wave of abusive lawsuits” driven by a handful of firms and serial plaintiffs.

What Changed?

SB 690 amends Penal Code section 637.2 to provide that an action against a private actor for violation of section 638.51 alleged to arise from conduct occurring on a website, online application or mobile application may only be brought by the Attorney General.

The amendment applies retroactively to pen register cases filed on or after approximately January 1, 2025. The amendment does not apply to cases filed earlier than that date or cases that are already resolved.

SB 690 does not amend section 631 (interception of communications in transit, including aiding a third party's interception), section 632 (recording confidential communications), or section 632.7.  Unfortunately for businesses, the final bill is narrower than the 2025 version and does not exempt data processing for a commercial business purpose.

Expect plaintiffs to re-plead claims under section 631 and to test other statutes such as the Federal Wiretap Act.

What Do Businesses Need to Do Now?

Businesses should act on several fronts:

1. If you were sued under section 638.51 on or after January 1, 2025 and the matter remains unresolved, evaluate a stay or early dispositive motion timed to the January 1, 2027 effective date of SB 690 and reassess settlement value now as the plaintiff's leverage may have dropped sharply. Likewise, pre-litigation demands resting on a pen-register theory should be scrutinized.
2. Businesses should routinely audit their data collection and processing practices, in addition to ensuring that they are obtaining and keeping record of consumer consent to same. Businesses should also make sure that consent tools block non-essential tracking technologies unless and until the consumer consents.
3. Evaluate vendor contracts for restrictions concerning use of website and app data for their own purposes, a recurring issue in CIPA litigation.

Bottom Line

SB 690 takes one of the plaintiffs' bar's favorite theories off the table, but CIPA litigation will continue until the Legislature or the appellate courts rein in section 631. Businesses that tighten consent and vendor practices now will be best positioned for what comes next.

How Newmeyer Dillion Can Help

If you have any questions about how these claims may affect your business based on how your website is currently constructed, please call 949-854-7000 or email us at Tara.Dudum@ndlf.com & Kyle.Janecek@ndlf.com. Newmeyer Dillion can assist in assessing any current practices that may leave you susceptible to claims and provide guidance on updating your privacy practices to stay compliant with CIPA after SB 690.