Key Takeaways
- • California Legislature unanimously passed SB 690 on August 28, 2026, eliminating private lawsuits under CIPA § 638.51 for "pen register" claims arising from website and app tracking technologies, reserving enforcement authority exclusively to the California Attorney General.
- • The bill applies retroactively to pending claims filed on or after approximately January 1, 2025, potentially extinguishing thousands of lawsuits that proliferated from approximately 600 cases in February 2025 to nearly 4,000 by August 2026.
- • CIPA permits statutory damages up to $5,000 per violation, creating substantial exposure for affected organizations including retailers, hospitals, nonprofits, and public agencies; SB 690 eliminates this private litigation channel for tracking-related claims.
- • SB 690 does not impact CIPA § 631 wiretapping claims, common-law privacy claims, unfair competition claims, or other privacy statutes, meaning plaintiffs retain multiple causes of action within single lawsuits and entire cases are unlikely to be dismissed.
- • Governor Newsom has until September 30, 2026, to act; the bill becomes law if signed or if the Governor takes no action, with unanimous legislative passage making enactment highly probable; concurrent expansion bills SB 923 and AB 1542 will impose new data deletion and sensitive data restrictions.
Summary
California's legislature has fundamentally reshaped digital privacy litigation by unanimously passing SB 690, legislation targeting what committee analyses characterized as abusive § 638.51 "pen register" class actions. The bill eliminates private rights of action for claims alleging that routine website tracking technologies—including tracking pixels, cookies, session replay tools, chat widgets, and third-party SDKs—function as illegal pen registers under California Penal Code § 638.51. The unanimous passage (Assembly 66-0, Senate 40-0) signals near-certain enactment despite pending gubernatorial review through September 30, 2026.
The legislation responds to explosive litigation growth. Since February 2025, pen register claims have multiplied from approximately 600 to nearly 4,000 pending lawsuits, with plaintiffs' counsel reportedly suing over 1,500 businesses and issuing thousands of additional demand letters. These actions invoked a 1967 criminal wiretapping statute never explicitly designed for internet surveillance, exposing defendants to statutory damages of up to $5,000 per violation. Affected defendants span retail, healthcare, nonprofits, and public sector entities. SB 690's retroactive application covers claims filed within two years before the operative date (January 1, 2027), effectively eliminating most cases in the current pipeline.
The bill's scope remains narrowly tailored. After initially proposing broader commercial business purpose exemptions across multiple CIPA provisions, the bill's author narrowed it in July 2026 to address only § 638.51 pen register claims, responding to opposition from privacy advocates including the American Civil Liberties Union and Electronic Frontier Foundation. Notably, SB 690 leaves untouched § 631 wiretapping claims, common-law privacy theories, Unfair Competition Law claims, and other privacy statutes. Consequently, plaintiffs will retain multiple avenues within single lawsuits, and few cases will face complete dismissal—defendants will merely lose one litigation tool.
Simultaneously, California is expanding substantive privacy obligations through companion legislation. SB 923 (Expanding Privacy Rights Act), which passed 37-0 in the Senate and 49-14 in the Assembly, requires businesses to delete personal information obtained from data brokers and third parties upon consumer request, not merely directly collected data. AB 1542 (Sensitive Data Sale Prohibition), which passed the Assembly 44-19, prohibits sale or sharing of precise geolocation, biometric, health, and other sensitive personal information. Both bills are highly likely to become law, creating new compliance burdens even as SB 690 reduces § 638.51 litigation exposure.
Organizations facing active CIPA litigation should immediately reassess settlement strategy and evaluate whether retroactive application affects pending claims. Those with unresolved demand letters can leverage SB 690 as a compelling response. Even organizations not currently in litigation should conduct proactive audits of website tracking technologies and consent mechanisms, particularly regarding § 631 wiretapping exposure and CCPA risks, before demand letters materialize. The legislative landscape now reflects California's recalibration: reduced private enforcement of tracking claims coupled with expanded substantive data protection and deletion obligations.
The legislation responds to explosive litigation growth. Since February 2025, pen register claims have multiplied from approximately 600 to nearly 4,000 pending lawsuits, with plaintiffs' counsel reportedly suing over 1,500 businesses and issuing thousands of additional demand letters. These actions invoked a 1967 criminal wiretapping statute never explicitly designed for internet surveillance, exposing defendants to statutory damages of up to $5,000 per violation. Affected defendants span retail, healthcare, nonprofits, and public sector entities. SB 690's retroactive application covers claims filed within two years before the operative date (January 1, 2027), effectively eliminating most cases in the current pipeline.
The bill's scope remains narrowly tailored. After initially proposing broader commercial business purpose exemptions across multiple CIPA provisions, the bill's author narrowed it in July 2026 to address only § 638.51 pen register claims, responding to opposition from privacy advocates including the American Civil Liberties Union and Electronic Frontier Foundation. Notably, SB 690 leaves untouched § 631 wiretapping claims, common-law privacy theories, Unfair Competition Law claims, and other privacy statutes. Consequently, plaintiffs will retain multiple avenues within single lawsuits, and few cases will face complete dismissal—defendants will merely lose one litigation tool.
Simultaneously, California is expanding substantive privacy obligations through companion legislation. SB 923 (Expanding Privacy Rights Act), which passed 37-0 in the Senate and 49-14 in the Assembly, requires businesses to delete personal information obtained from data brokers and third parties upon consumer request, not merely directly collected data. AB 1542 (Sensitive Data Sale Prohibition), which passed the Assembly 44-19, prohibits sale or sharing of precise geolocation, biometric, health, and other sensitive personal information. Both bills are highly likely to become law, creating new compliance burdens even as SB 690 reduces § 638.51 litigation exposure.
Organizations facing active CIPA litigation should immediately reassess settlement strategy and evaluate whether retroactive application affects pending claims. Those with unresolved demand letters can leverage SB 690 as a compelling response. Even organizations not currently in litigation should conduct proactive audits of website tracking technologies and consent mechanisms, particularly regarding § 631 wiretapping exposure and CCPA risks, before demand letters materialize. The legislative landscape now reflects California's recalibration: reduced private enforcement of tracking claims coupled with expanded substantive data protection and deletion obligations.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.