California Senate Bill 690 (“SB 690”) continues to advance in the California state legislature. SB 690 seeks to limit litigation brought pursuant to the California Invasion of Privacy Act (“CIPA”) given the avalanche of website technology litigation, which continues unabashedly. While SB 690 has been scaled back since its first introducion in February 2025, it would still have a meaningful impact on businesses faced with these lawsuits.
As envisioned following debate in the state legislature’s privacy subcommittee, SB 690 would eliminate the private right of action for pen-register and trap-and-trace claims under California Penal Code Section 638.51. These claims allege that a business’ act of gathering standard IP addresses, device identifiers or similar metadata constitutes an illegal pen-register or trap-and-trace device. Of particular note, the proposal carries a retroactive component whereby any claims initiated in the two years preceding enactment would be barred outright.
SB 690 would not be a comprehensive solution for businesses facing these claims as it does not address CIPA’s wiretapping provisions or claims brought under other statutes, such as the Electronic Communications Privacy Act, or brought under common law.
For companies, prudent next steps include evaluating their website technologies, privacy policy and consent management platform (if any), and assessing ways to mitigate their exposure. Companies should also keep a close watch on both SB 690 as well as case law that continues to develop.
More sweeping reform may prove necessary down the line, but SB 690 would represent genuine and welcome progress.