Key Takeaways
- SB 690 narrows CIPA exposure for digital tracking. Effective January 1, 2027, the law eliminates private claims under the pen register and trap-and-trace provision for conduct involving websites and online or mobile applications.
- The amendment has retroactive reach. SB 690 applies to claims filed within two years before its effective date, potentially limiting pending and recently filed actions.
- Significant risks remain. Companies may still face claims under CIPA’s wiretapping and eavesdropping provisions, California common law, federal law and other state wiretapping statutes, as well as enforcement by the California attorney general.
California has eliminated private rights of action under California’s Invasion of Privacy Act (CIPA) for violations of Section 638.51, known as the statute’s pen register and trap-and-trace section.
Plaintiff attorneys and several pro se litigants have spent the last few years asserting claims for purported violations of CIPA based on the use of website tracking technology. These plaintiffs alleged that the tracking technology constituted forms of wiretapping, pen register, and/or trap-and-trace devices. According to them, the use of such technology violated CIPA because, upon visiting the defendant’s website, the tracking technology was placed on their devices without their consent (e.g., because there was no cookie consent banner or because the cookie consent banner was not working properly) and tracked their actions on the website. Some California courts rejected these claims outright, but many allowed them to proceed, resulting in an uptick of lawsuits, arbitrations, and demand letters. But as of last Wednesday, CIPA is being amended to curb these claims.
On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 690 (SB 690), eliminating the private right of action for claims for violation of California Penal Code Section 638.51, the pen register and trap-and-trace section, based on conduct occurring on an internet website, online application, or mobile application. SB 690 will take effect on January 1, 2027, and will apply retroactively to claims filed within two years of that date.
SB 690 is a meaningful step towards providing companies with some relief from CIPA claims arising from website tracking technologies. However, it does not get rid of those claims entirely. SB 690 does not apply to California Penal Code Section 631 (the wiretapping section), California Penal Code Section 632 (the eavesdropping section), or any claims under California’s common law. And California’s attorney general can still bring an enforcement action for violations of Section 638.51.
Because CIPA provides for statutory damages and attorneys’ fees, we anticipate that CIPA claims (while now limited) will remain popular amongst plaintiff attorneys. We also anticipate, and have already seen, a focus on other state wiretapping statutes, the Electronic Communications Privacy Act, and common law.
