The new law eliminates private pen register claims against private actors involving websites and apps but does not end CIPA litigation. Plaintiffs are already pivoting to other causes of action.

On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 690, significantly narrowing one of the theories driving California website-tracking litigation. The law limits private lawsuits alleging that tracking technologies used on websites and applications violate the pen register and trap-and-trace provisions of the California Invasion of Privacy Act, commonly known as CIPA.

In his signing statement, Governor Newsom said that the measure “addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses that unwittingly install software on their websites” and is meant to protect “small businesses from overzealous lawsuits based on a statute written without today’s complex technological landscape in mind”.

What SB 690 Does

CIPA generally prohibits the installation or use of a pen register or trap-and-trace device without a court order, subject to specified exceptions. Although these terms originated in the telephone-surveillance context, plaintiffs have increasingly alleged that common website technologies qualify as pen registers or trap-and-trace devices because they collect IP addresses, URLs, device identifiers and other routing or addressing information.

SB 690 ends the private right of action against private actors for alleged Section 638.51 violations arising from conduct occurring on websites, online applications and mobile applications. It does not, however, amend the underlying prohibition in Section 638.51 or determine whether a particular technology constitutes a pen register or trap-and-trace device.

SB 690 provides that its limitation on private enforcement applies retroactively to a pending claim in an action commenced within two years before the law’s operative date. The law takes effect on January 1, 2027. Accordingly, the retroactivity provision appears to reach qualifying pending claims in actions commenced on or after January 1, 2025.

What SB 690 Does Not Do

SB 690 does not end CIPA website-tracking litigation.

Most importantly, the law does not restrict private lawsuits under CIPA Section 631. Plaintiffs have relied on Section 631 to allege that website operators and their technology providers unlawfully intercept, use or assist in intercepting communications through pixels, session-replay tools, chat technologies and analytics software. Section 631 claims remain available following the enactment of SB 690.

The law also does not eliminate potential claims under other laws, such as:

• The federal Electronic Communications Privacy Act;
• California Comprehensive Computer Data Access and Fraud Act (CDAFA);
• California’s Unfair Competition Law;
• California’s constitutional right to privacy;
• Common law privacy theories;
• Other state wiretapping and consumer-protection statutes.

In fact, we are already seeing demand letters pivot away from Section 638.51 and toward other causes of action.

SB 690 does not eliminate the risk of enforcement by the California Attorney General, other state attorneys general or regulators under applicable privacy, health privacy, children’s privacy and consumer protection laws. Obligations arising under contracts, privacy-policy representations, and consent and opt-out mechanisms also remain.

The practical result may be a change in plaintiffs’ litigation strategies rather than an end to website-tracking cases. Companies may see fewer private claims based on Section 638.51’s pen register and trap-and-trace provisions, but continued claims under Section 631 and other privacy laws.

What Companies Should Do Now

Companies should consider reviewing pending demand letters and lawsuits to determine whether SB 690 may affect any asserted Section 638.51 claims.

More broadly, the enactment of SB 690 does not eliminate the need to evaluate tracking technologies. Companies should continue to:

• Inventory analytics, advertising, session-replay, chatbot and identity-resolution technologies operating on their websites and applications;
• Identify the information transmitted to each third party, including URLs, search terms, form-field data, device identifiers and authenticated-user information;
• Determine whether recipients use the information solely to provide services or for their own advertising, profiling, product-development or other purposes;
• Test whether consent and opt-out mechanisms operate as represented;
• Review privacy notices and cookie disclosures for accuracy; and
• Apply heightened scrutiny to technologies operating on health-related pages, financial portals, educational services, children’s services and other sensitive areas.

The sensitivity of the information and the purposes for which it is used remain important under legal theories unaffected by SB 690.

Bottom Line

SB 690 removes an important weapon from the website-tracking plaintiffs’ arsenal. Once operative, the law will prevent private plaintiffs from pursuing Section 638.51 claims against private actors based on conduct occurring on websites, online applications and mobile applications. It also applies that limitation to certain pending claims.

However, SB 690 should not be described as legalizing website tracking or ending CIPA litigation. The law does not amend Section 631, eliminate other state or federal privacy claims or create a general exemption for tracking conducted for commercial purposes.

Companies should treat SB 690 as a significant litigation development, while continuing to assess their tracking technologies, vendor practices, disclosures and privacy choices to mitigate risks arising under other legal theories.