California Senate Bill 690 is finally moving forward. The original bill would have broadly exempted disclosures made for a “commercial business purpose,” as defined under the California Consumer Privacy Act (CCPA), potentially eliminating many California Invasion of Privacy Act (CIPA) claims involving common website technologies. The amended version is narrower but could still offer meaningful relief to businesses facing the recent wave of CIPA litigation.
Under the amended bill, private plaintiffs could no longer bring claims under California Penal Code § 638.51 alleging that conduct on websites or online or mobile applications constitutes the unlawful use of a pen register or trap and trace device. Those claims could be brought only by the California Attorney General. The change would apply retroactively to certain pending lawsuits filed within the two years prior to the bill’s operative date. Plaintiffs could still pursue claims under § 631(a), although businesses often have stronger defenses to those claims, including consent and arguments that the information collected was not communication “content” or was not intercepted “in transit.”
SB 690 was approved unanimously by both the Assembly and Senate and has been sent to the Governor’s desk for signature, which must be completed by September 30, 2026. If enacted, it would take effect January 1, 2027. While it would not end CIPA website-tracking litigation, the bill signals legislative support for curbing private lawsuits based on increasingly common pen register and trap and trace theories. Businesses should continue monitoring the bill while reviewing their online tracking technologies, consent mechanisms, disclosures, and vendor relationships.