California SB 690: How it Curbs CIPA Lawsuits (and How it Doesn’t)

Key Takeaways

• Effective January 1, 2027, Senate Bill 690 (“SB 690”) eliminates the private right of action under CIPA’s pen register and trap and trace provision, applying retroactively to lawsuits that have been filed over the prior two years.
• SB 690 does not eliminate website-based tracking technology litigation risk, as plaintiffs can continue pursuing claims under other CIPA provisions as well as other statutory or common law theories.
• Companies should continue to prioritize review of their websites, including assessing third-party tools, privacy policies, and consent mechanisms and disclosures.

On September 30, 2026, California Governor Gavin Newsom signed SB 690 into law, enacting a widely anticipated amendment to the California Invasion of Privacy Act (“CIPA”). The amendment will take effect January 1, 2027, applying retroactively to any claim filed on or after January 1, 2025.

CIPA Website Tracking Lawsuits: Legal Background

CIPA is a California law originally passed in 1967 to stop phone wiretapping. In recent years, serial plaintiffs and plaintiffs’ firms have repurposed the statute to assert that CIPA also applies to common website and mobile application technologies provided by third parties such as cookies, pixels, analytics tools, session replay technology, and chatbots. Plaintiffs have alleged multiple theories of CIPA violations with respect to these third-party tools, including claims that use of these technologies constitutes:

1) illegal wiretapping or eavesdropping under California Penal Code §§ 631 and 632; and

2) unlawful use of a pen register or trap and trace device under California Penal Code § 638.51.

Organizations of all industries and sizes have been facing a slew of litigation, arbitration, and demand letters asserting CIPA claims, which carry the potential of $5,000 statutory damages per violation.

What Claims Does SB 690 Curtail?

SB 690 amends CIPA such that private plaintiffs can no longer assert web-related claims under the CIPA pen register and trap and trace provision (Cal. Penal Code § 638.51). Instead, only the California Attorney General may bring such claims. For companies facing pending lawsuits or demands based on a pen register or trap and trace CIPA theory, SB 690 may provide a basis to oppose the plaintiff’s ability to pursue the claim. The plaintiffs’ bar, however, is expected to challenge SB 690 — particularly its two-year lookback provision — on constitutional grounds.

What Claims Does SB 690 Not Curtail?

SB 690 does not restrict private plaintiffs’ ability to bring claims under CIPA’s wiretapping and eavesdropping provisions (Cal. Penal Code §§ 631 and 632). While those provisions tend to pose a higher pleading burden than CIPA’s pen register and trap and trace provision, plaintiffs have often asserted both theories based on the same operative facts. Courts have not yet reached a consensus on the scope of CIPA’s application to website tracking technologies, and CIPA plaintiffs know that many companies prefer to avoid the financial burden of litigation. Thus, settlement demands are likely to continue. Beyond CIPA, plaintiffs will continue to bring website tracking claims and demands under alternative legal theories based on other state and federal privacy statutes as well as common law — all of which remain unaffected by SB 690.

What Businesses Should Do Now to Reduce CIPA and Related Litigation Risk

Accordingly, businesses should not interpret SB 690 as resolving the broader litigation risk associated with online tracking technologies. To reduce exposure to CIPA and similar claims moving forward, organizations are encouraged to conduct an inventory of third-party tools and tracking technologies present on their websites, review agreements with providers of such technologies, review public-facing privacy and cookie policies and disclosures, and implement a properly functioning cookie consent mechanism.

For more information, please contact AGG Privacy & Cybersecurity attorneys Erin Doyle and Kelley Chandler.