California lawmakers have sent Senate Bill 690 to Governor Gavin Newsom, teeing up a narrowing of website-tracking litigation under the California Invasion of Privacy Act (CIPA), who has until September 30 to sign or veto the legislation. If signed, the bill would eliminate private lawsuits asserting website-based “pen register” and “trap and trace” claims under Section 638.51 of CIPA. For businesses that have received demand letters or are defending lawsuits premised on routine website technologies—such as cookies, pixels, analytics tools, or similar tracking technology—the bill would offer relief from certain types of claims asserted under CIPA. Additionally, the bill would apply retroactively to pending claims in actions commenced within two years before its operative date, which is expected to be January 1, 2027, if the bill becomes law.
The Impetus
The legislation responds to a surge of CIPA claims built on a statute originally designed for telephone-era wiretapping, not modern website traffic. Because CIPA carries statutory damages that can reach at least $5,000 per violation without proof of actual harm, even ordinary commercial web practices have created substantial litigation leverage for plaintiffs to demand large sums from website owners. SB 690 targets that specific theory by removing the private right of action for Section 638.51 claims.
Limitations
SB 690 is not a complete end to website privacy litigation. Notably, the bill does not eliminate the ability of the California Attorney General to bring claims under Section 638.51. Nor does the bill eliminate private right of action claims under CIPA Section 631, the provision focused on content of a communication that plaintiffs continue to invoke against session replay tools, chat features, pixels, and other third-party website technologies. Seemingly having seen the likelihood of passage, plaintiffs have increasingly asserted multiple claims under CIPA and the Electronics Communications Privacy Act (“the Federal Wiretapping Act”) in order to avoid the anticipated statutory effect of SB690 and its retroactive provisions. In practical terms, SB 690 may shrink one category of claims while leaving plaintiffs with alternative theories that can still create litigation and settlement pressure.
Key Considerations and Action Items
For companies with pending Section 638.51 claims or demand letters, the immediate priority is to assess how SB 690’s retroactivity language could affect the matter’s procedural posture if the Governor signs the bill. For companies facing Section 631 claims, the risk calculus is different: those claims remain intact and should continue to be evaluated on their own facts. More broadly, business leaders and legal teams should use this moment to inventory website tracking technologies, confirm when third-party tracking technologies fire, review cookie and consent practices, and ensure privacy disclosures align with actual data collection and sharing. If signed, SB690 will be a welcome development for many defendants, and hopefully a sign of more legislation to come, but it is not a substitute for a disciplined website privacy governance.