SB 690 is Signed Into Law, Providing Relief to California Businesses from CIPA Claims

SB 690 is Signed Into Law, Providing Relief to California Businesses from CIPA Claims

On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 690 (“SB 690”) into law, providing some welcome relief to California businesses. This law will eliminate the private right of action to the most commonly abused provisions of the California Invasion of Privacy Act (“CIPA”). Specifically, it eliminates the private right of action to claims under California Penal Code Section 638.51 (pen-register and trap-and-trace rules) as applied to company websites and apps. Such claims usually allege that website tracking tools, including cookies and pixels, constitute third-party surveillance under CIPA because they collect information about a user’s interaction with websites without their consent. These claims assert that ordinary website and application technologies operate as unlawful “pen registers” or “trap-and-trace” devices under Section 638.51 of the California Penal Code. Their theory is that the technologies collect information identifying the source or destination of electronic communications and therefore qualify as pen registers or trap-and-trace devices.

When SB 690 goes into effect on January 1, 2027, it will amend Penal Code Section 637.2 to provide that only the California Attorney General may bring an action under that section against a company for a Section 638.1 violation alleging conduct occurring on websites, online applications or mobile applications. In other words, only the California Attorney General may bring an action for “pen register” and “trap-and-trace” claims against businesses for the conduct occurring on their websites and online or mobile applications.

SB 690 also includes an important two-year retroactivity provision, which means that its effects will apply to CIPA claims dating back to January 1, 2025. This retroactivity provision is intended to prevent a last-minute rush of CIPA claims being made before the bill goes into effect next year. As such, business that are facing current CIPA claims should consider the impact of this bill before making further decisions on those matters, and in fact they may argue for dismissal of such claims based on the forthcoming retroactive effect of the law.

Although the passage of SB 690 is significant for California businesses seeking to assert defenses against CIPA claims, it does not establish a general safe harbor for cookies, pixels, session-replay tools, chat technologies or other online tracking tools. It does not repeal CIPA’s wiretapping and confidential-communication provisions under CIPA Sections 631 and 632, which remain available to private plaintiffs. Businesses should therefore continue to assess their online data flows, consent mechanisms, opt-in and opt-out configurations, and vendor relationships. Website tracking activity can still be cited by private plaintiffs to support claims under other provisions of CIPA, the federal Electronic Communications Privacy Act, state wiretapping and consumer-protection statutes, and common-law theories.

Businesses involved in pending litigation should analyze each complaint claim by claim. Dismissal of a Section 638.51 count may materially reduce a case’s value, but it may not dispose of wiretapping, recording, contract, consumer-protection or common-law claims arising from the same technology. Businesses facing Section 638.51 claims should evaluate whether SB 690’s provisions may apply, while preserving defenses to any remaining CIPA or non-CIPA claims.