On July 1, 2026, a California legislative committee advanced amendments to SB 690 that would eliminate private suits asserting website-based “pen register” claims under the California Invasion of Privacy Act (“CIPA”), leaving enforcement exclusively to the California Attorney General. The amendments come amid a surge of lawsuits and demand letters challenging the use of website technologies under the pen register provision, which the committee described as a “poster child for abusive lawsuits.” According to the committee analysis, “[b]ecause the potential liability can be staggering,” businesses often settle quickly, thereby “encouraging vexatious litigants to continue blasting out demand letters.”
SB 690 was introduced in 2025 and passed the California Senate by a 35-0 vote on June 3, 2025. As originally drafted, the bill would have exempted the processing of personal information for “commercial business purpose[s]” from liability under multiple CIPA provisions, including the wiretapping, confidential-recording, and pen register provisions. The Assembly Committee on Privacy and Consumer Protection concluded, however, that the bill was “overly broad and may entail unintended consequences.” The bill’s author therefore agreed to narrow the proposal to respond “directly and surgically to the most pressing problem at hand” by eliminating website-based pen register claims.
As amended, the bill would:
- Eliminate the private right of action for website-based pen register claims. Claims arising from conduct “occurring on an internet website, online application, or mobile application” may be brought “only by the Attorney General.”
- Preserve Attorney General enforcement authority. The California Attorney General would retain authority to pursue alleged violations and seek available remedies.
- Apply retroactively to pending claims. The bill would apply retroactively to “any pending claim in an action commenced within two years before the operative date” of the legislation.
- Leave other CIPA provisions intact. The bill would not alter private rights of action under CIPA’s wiretapping provision (Section 631) or confidential recording provision (Section 632). The committee analysis notes that the Legislature “may wish to consider a more comprehensive set of solutions” addressing those provisions in the future.
SB 690 remains subject to further amendment and must still pass the Assembly, receive Senate concurrence in any Assembly amendments, and be signed by the Governor. If enacted this session, the bill would become operative on January 1, 2027, absent an urgency clause. As currently drafted, the retroactivity provision could affect pen register claims filed during the two years preceding that date, potentially impacting a substantial number of recently filed lawsuits and demand letters.
Recent Comments