California Enacts SB 690, But Website Tracking Litigation Is Far from Over

California has shut down one increasingly popular theory of website-tracking liability. With Governor Gavin Newsom’s signature, SB 690 amends the California Invasion of Privacy Act (“CIPA”) and eliminates the private right of action under Section 638.51 for pen-register and trap-and-trace claims involving websites, online applications, and mobile applications. Enforcement of Section 638.51 will now rest solely with the California Attorney General’s Office. The legislation responds to a wave of lawsuits alleging that commonplace tools – including cookies, pixels, and other tracking technologies – operate as pen registers by capturing information about users’ online activity.

Limitations on Scope

But the relief is narrower than many businesses initially anticipated. The version introduced in February 2025 would have created a “commercial business purposes” exception not only for Section 638.51 claims, but also for claims under Section 631, CIPA’s wiretapping provision, and Section 632, which governs the recording of confidential communications. That broader language did not survive. Private claims under Sections 631 and 632 therefore remain intact, as does Section 638.51’s substantive prohibition and the Attorney General’s enforcement authority.

Other Avenues for Plaintiffs 

SB 690 narrows the battlefield; it does not end the fight. Sections 631 and 632 still carry statutory-damages exposure of $5,000 per violation. Plaintiffs may also turn to the federal Electronic Communications Privacy Act, the Video Privacy Protection Act, and state wiretap laws.  Our tracking technology litigation heatmap reflects which jurisdictions are experiencing increased filings, notably including Florida and Pennsylvania. Complaints based exclusively on Section 638.51 are the clearest candidates for dismissal, but those cases represent only a subset of the broader CIPA litigation landscape.

Effective Date and Retroactivity 

The amendment takes effect January 1, 2027, and reaches back two years, potentially sweeping in claims filed since the beginning of 2025. Courts may soon have to decide how that retroactivity provision applies to pending cases. The measure’s practical effect will also turn on how quickly the plaintiffs’ bar pivots to surviving CIPA theories under Sections 631 and 632, or to alternative federal and state statutes.

Key Considerations and Action Items

For businesses, they should reassess the procedural posture of each pending matter, preserve arguments concerning SB 690’s retroactive application, and keep website-tracking compliance on the active governance agenda rather than a one-time fix. Regular audits of website technologies, consent and disclosure practices, vendor contracts, data flows, and document oversight remain essential. SB 690 removes one private enforcement route, but it does not necessarily condone the underlying conduct. Website-tracking litigation under CIPA will continue, the next round will simply be fought on a different front.

If you have questions about website tracking technology considerations or any other privacy-related matters, please contact the authors or anyone on our Tracking Technology Litigation & Counseling team.