On August 28, 2026, the California Legislature passed SB 690, a significant bill aimed at curbing the flood of demand letters and lawsuits asserting “pen register” claims under the California Invasion of Privacy Act (“CIPA”). If enacted, the bill would eliminate the private right of action for website-based pen register claims and could affect many pending lawsuits filed since January 1, 2025.
SB 690 was originally introduced in 2025 and passed the California Senate by a 35-0 vote on June 3, 2025. After the Assembly Committee on Privacy and Consumer Protection amended the bill on July 1, 2026, the bill proceeded through both houses without further revision before receiving final legislative approval on August 28, 2026.
As we explained in our previous post, SB 690 would narrow website-based pen register litigation by amending CIPA in several key respects:
- Eliminate private lawsuits for website-based pen register claims. Claims arising from conduct “occurring on an internet website, online application, or mobile application” could be brought “only by the Attorney General.”
- Apply to certain pending claims. The bill would apply retroactively to “any pending claim” in an action commenced on or after January 1, 2025, potentially affecting many pending lawsuits.
- Preserve Attorney General enforcement. The bill would keep enforcement authority with the Attorney General.
- Leave other CIPA claims intact. The bill would not alter private rights of action under CIPA’s wiretapping provision (Section 631) or confidential recording provision (Section 632).
The bill now heads to Governor Newsom, who has until September 30 to sign or veto it. If signed, or if the governor takes no action, the bill would become operative on January 1, 2027.