By Matthew Eanet, Esq. | September 2026
A bill now awaiting Governor Newsom's decision would bar private lawsuits over one of the most common theories used against California businesses for their website tracking tools, while leaving other avenues for litigation — under CIPA, under federal law, and under the laws of other states — fully intact.
How a 1967 Wiretapping Law Reached the Internet
The California Invasion of Privacy Act (CIPA) was written to protect telephone conversations from interception. Over the past several years, plaintiffs’ attorneys have applied its provisions to routine website features such as cookies, pixels, analytics platforms, and chat functions.
One of the most frequently used theories relies on section 638.51, which prohibits the use of a pen register or trap-and-trace device without a court order. Those terms historically referred to equipment that logged the numbers dialed to or from a phone line. Plaintiffs argue that tracking technology collecting data about site visitors serves the same function. Because CIPA allows statutory damages of $5,000 per violation without proof of actual harm, a single website can generate significant exposure as claims multiply across visitors. The result has been thousands of lawsuits and demand letters, many of which combine a pen register claim with a separate wiretapping claim under section 631.
What the Final Version of SB 690 Changes
SB 690 looked very different when it was introduced in February 2025. That version would have exempted tracking activity conducted for a “commercial business purpose” from CIPA altogether. That version cleared the Senate unanimously in June 2025, but the author held it in the Assembly as a two-year bill after consumer privacy groups raised objections. It returned in July 2026 in a narrower form, passed the Assembly 66-0 on August 28, and the Senate concurred in the Assembly amendments the same day without a dissenting vote.
As passed, the bill amends CIPA’s private right of action in section 637.2. Pen register and trap-and-trace claims under section 638.51 that arise from conduct on a website, online application, or mobile application could be brought only by the California Attorney General. Private plaintiffs would lose the ability to file those claims.
The change would also apply retroactively. Claims in actions commenced within the two years before the bill’s January 1, 2027 operative date would be covered, which means many lawsuits currently pending could fall within its reach. Demand letters are not “actions commenced,” so the retroactivity clause does not reach them directly, but a plaintiff who has not filed by the operative date would simply have no private pen register claim to file.
Two caveats. First, SB 690 amends only the remedy provision; it does not change the definition of a pen register in section 638.50 or 638.51. The Attorney General retains full enforcement authority, and the Court of Appeal’s pending decision in Variety Media, LLC v. Superior Court (Second District), where an August 2026 tentative ruling indicated that CIPA’s pen register definition is technology-neutral and reaches internet tracking, will still matter for that enforcement. Second, retroactive elimination of a pending claim invites due process challenges. Expect plaintiffs to test the provision, and expect trial courts to reach different answers before the Court of Appeal settles it.
The Claims SB 690 Leaves in Place
The bill does not touch wiretapping claims under section 631 or eavesdropping claims under section 632, nor the section 632.7 provision covering cellular and cordless communications that plaintiffs invoke against mobile apps. Section 631 in particular accounts for a large share of current CIPA litigation, including demand letters sent by repeat plaintiffs. Companies facing those claims would see no change in their exposure. Sections 631 and 632 carry the same $5,000 per-violation statutory damages as section 638.51.
There is a reason plaintiffs preferred the pen register theory, and it explains why SB 690 still matters even though section 631 survives. A section 631 claim generally requires the plaintiff to show that the tracking tool intercepted the contents of a communication in transit, and a section 632 claim requires a reasonable expectation that the communication was confidential. The pen register theory let plaintiffs skip both showings by pointing to nothing more than collection of an IP address or device identifier. Removing that shortcut raises the pleading bar, and courts have already dismissed many section 631 claims on the contents and in-transit elements. It does not, however, remove the claim.
Where a plaintiff has asserted both a pen register claim and a wiretapping claim, the wiretapping portion would likely continue even if the pen register portion is extinguished. We also expect plaintiffs to amend pending pen-register-only complaints to add section 631 allegations before the operative date, and to reframe new demand letters around section 631 from the outset.
Claims Beyond CIPA That SB 690 Does Not Reach
SB 690 is a California statute amending one California statute. The same website conduct is routinely pleaded under other laws, and several of them are already the fallback in multi-count complaints and demand letters:
Federal Wiretap Act. The Electronic Communications Privacy Act (18 U.S.C. § 2511) prohibits intentional interception of electronic communications and provides a private right of action with statutory damages of the greater of $10,000 or $100 per day of violation, plus attorney’s fees. The federal statute has a one-party consent rule, which is why plaintiffs prefer CIPA, but the party exception is unavailable where the interception is made for the purpose of committing a tortious or criminal act, and the Ninth Circuit and district courts have allowed pixel and session-replay claims to proceed on that theory.
Video Privacy Protection Act. Any site that hosts video content and runs a Meta pixel or similar tool that transmits a viewer’s identity together with the video watched faces VPPA claims (18 U.S.C. § 2710), with liquidated damages of $2,500 per person and class treatment. The circuits are split on who qualifies as a “consumer” and a “video tape service provider,” and the volume of these cases has grown as CIPA relief has approached.
Other states’ wiretap statutes. Plaintiffs’ firms have been building parallel dockets under all-party consent statutes in Florida (FSIPA), Pennsylvania (WESCA), Washington, Massachusetts, Maryland, and Arizona. A California business with customers in those states can be sued there by residents of those states. SB 690 has no effect on any of them.
Confidentiality of Medical Information Act. Health-care providers, telehealth platforms, and any site collecting health-related information face CMIA claims (Cal. Civ. Code § 56 et seq.) for pixel and analytics disclosures, with $1,000 nominal damages per patient and no proof of actual harm required, alongside HIPAA regulatory exposure.
California Consumer Privacy Act. The CCPA has no private right of action for tracking-related disclosures, but the California Privacy Protection Agency and the Attorney General are actively enforcing it, with recent actions targeting failures to honor opt-out signals and undisclosed third-party data sharing. Sending 638.51 enforcement to the Attorney General adds one more tool to an office that is already looking at these practices.
Common law and UCL tag-alongs. Invasion of privacy, intrusion upon seclusion, and Unfair Competition Law claims are routinely pleaded alongside the statutory counts. They are harder to certify and carry less statutory leverage, but they survive a dismissal of the statutory claims and keep the case alive.
Practical Steps for Businesses
Businesses with a pending pen register claim or demand letter should work with counsel to evaluate how the retroactivity provision may apply. The answer will depend on where the matter stands, whether in litigation, arbitration, or the demand-letter stage. In pending litigation, counsel should be moving now to stay the pen register claim pending the January 1, 2027 operative date and to preserve the issue in the pleadings, rather than expecting dismissals this fall. Settlement value on pen-register-only matters should already reflect that the claim is likely to disappear.
Businesses facing section 631 claims, or claims under the federal and other-state statutes above, should continue evaluating their risk as before. That review should cover which tracking tools run on the site, how and when consent is obtained, and what data is collected, along with related obligations under the California Consumer Privacy Act (CCPA).
Every organization with a consumer-facing website or app should keep its tracking practices under review regardless of how SB 690 is resolved. Plaintiffs have increasingly focused on tools that record user sessions, capture chat conversations, or collect form entries, as well as on whether consent is secured before third-party code runs on a site. Those are precisely the fact patterns that support a section 631 “contents” theory and a federal Wiretap Act claim, so the tools most likely to draw a lawsuit after SB 690 are the same ones drawing lawsuits today.
What Comes Next
Governor Newsom has until September 30 to sign SB 690, veto it, or allow it to become law without his signature. The unanimous votes in both chambers reflect broad support, but the outcome is not final until the Governor acts, and businesses should plan accordingly. Separately, the Court of Appeal’s final opinion in Variety Media will determine whether the pen register definition reaches internet tracking at all, which will shape both Attorney General enforcement and any private claims that fall outside SB 690’s website-and-app carve-out.
Bottom Line
SB 690 would remove private plaintiffs’ ability to pursue website-based pen register claims, one of the most common grounds for recent CIPA lawsuits. It would not reduce exposure under the wiretapping and eavesdropping provisions that continue to drive much of this litigation, and it does nothing about the federal Wiretap Act, the VPPA, other states’ wiretap laws, or the CMIA.
Businesses should view the bill as meaningful but limited relief. A careful review of website and app tracking practices remains the most reliable way to manage website privacy risk, whatever the Governor decides.
If you have any questions or need assistance, contact us at Eanet, PC.
_____
About the Author
Matthew L. Eanet, Esq.
Matt is managing shareholder at Eanet, PC, a Los Angeles litigation boutique he founded in 2012. He's an expert in complex commercial litigation matters involving real estate, employment, trade secret, trademark and trade dress, data breach, privacy and general business disputes, served as a U.S. Army JAG prosecutor, and has been selected by Super Lawyers (California) every year from 2015-2026.