By Matthew Eanet, Esq. September 2026
A bill now awaiting Governor Newsom's decision would bar private lawsuits over one of the most common theories used against California businesses for their website tracking tools, while leaving other avenues for litigation fully intact.
How a 1967 Wiretapping Law Reached the Internet
The California Invasion of Privacy Act (CIPA) was written to protect telephone conversations from interception. Over the past several years, plaintiffs' attorneys have applied its provisions to routine website features such as cookies, pixels, analytics platforms, and chat functions.
One of the most frequently used theories relies on section 638.51, which prohibits the use of a pen register or trap-and-trace device without a court order. Those terms historically referred to equipment that logged the numbers dialed to or from a phone line. Plaintiffs argue that tracking technology collecting data about site visitors serves the same function. Because CIPA allows statutory damages of $5,000 per violation without proof of actual harm, a single website can generate significant exposure as claims multiply across visitors. The result has been thousands of lawsuits and demand letters, many of which combine a pen register claim with a separate wiretapping claim under section 631.
What the Final Version of SB 690 Changes
SB 690 looked very different when it was introduced in February 2025. That version would have exempted tracking activity conducted for a "commercial business purpose" from CIPA altogether. After stalling in committee, the bill was amended in July 2026 to take a narrower approach, and it passed the Assembly 66-0 and the Senate 40-0 on August 28.
As passed, the bill amends CIPA's private right of action in section 637.2. Pen register and trap-and-trace claims under section 638.51 that arise from conduct on a website, online application, or mobile application could be brought only by the California Attorney General. Private plaintiffs would lose the ability to file those claims.
The change would also apply retroactively. Claims in actions commenced within the two years before the bill's January 1, 2027 operative date would be covered, which means many lawsuits and demand letters currently pending could fall within its reach.
The Claims SB 690 Leaves in Place
The bill does not touch wiretapping claims under section 631 or eavesdropping claims under section 632. Section 631 in particular accounts for a large share of current CIPA litigation, including demand letters sent by repeat plaintiffs. Companies facing those claims would see no change in their exposure.
Where a plaintiff has asserted both a pen register claim and a wiretapping claim, the wiretapping portion would likely continue even if the pen register portion is extinguished.
Practical Steps for Businesses
Businesses with a pending pen register claim or demand letter should work with counsel to evaluate how the retroactivity provision may apply. The answer will depend on where the matter stands, whether in litigation, arbitration, or the demand-letter stage.
Businesses facing section 631 claims should continue evaluating their risk as before. That review should cover which tracking tools run on the site, how and when consent is obtained, and what data is collected, along with related obligations under the California Consumer Privacy Act (CCPA).
Every organization with a consumer-facing website or app should keep its tracking practices under review regardless of how SB 690 is resolved. Plaintiffs have increasingly focused on tools that record user sessions, capture chat conversations, or collect form entries, as well as on whether consent is secured before third-party code runs on a site.
What Comes Next
Governor Newsom has until September 30 to sign SB 690, veto it, or allow it to become law without his signature. The unanimous votes in both chambers reflect broad support, but the outcome is not final until the Governor acts, and businesses should plan accordingly.
Bottom Line
SB 690 would remove private plaintiffs' ability to pursue website-based pen register claims, one of the most common grounds for recent CIPA lawsuits. It would not reduce exposure under the wiretapping and eavesdropping provisions that continue to drive much of this litigation.
Businesses should view the bill as meaningful but limited relief. A careful review of website and app tracking practices remains the most reliable way to manage CIPA risk, whatever the Governor decides.
If you have any questions or need assistance, contact us at Eanet, PC.