SB 690 and CIPA: What Changed, What Didn't, and Why We're Winding Down Our CIPA Tracking
California has finally done something about the flood of website-tracking lawsuits under the California Invasion of Privacy Act (CIPA). Governor Newsom signed SB 690 at the end of September, and it takes effect January 1, 2027. It is real relief for a specific category of CIPA claim, but it is not the end of CIPA exposure, and the Governor's own signing statement says as much.
In this post we cover what SB 690 does, what it leaves untouched, what risks remain for businesses with a California web presence, and why, with this law on the books, we are winding down our CIPA tracking for several months while things sort out.
How we got here
CIPA is a 1967 statute aimed at wiretapping and eavesdropping. Over the last several years, plaintiffs' firms have used it against ordinary websites, arguing that cookies, pixels, session replay tools, and chat widgets record or intercept visitors' communications without consent. Because CIPA carries statutory damages (generally $5,000 per violation), a single website with a few thousand visitors can be framed as a seven- or eight-figure exposure.
The result was a business model more than a body of privacy law. According to the Ecommerce Innovation Alliance, more than 4,000 CIPA suits were filed in the four years before SB 690, demand letters typically sought $10,000 to $25,000, and plaintiffs' firms are estimated to have collected over $500 million in settlements. Many of those suits relied on a newer theory under Penal Code § 638.51, which treats tracking tools as unlawful "pen registers" or "trap and trace" devices. EIA says that theory accounted for roughly two-thirds of active privacy litigation.
What SB 690 does
SB 690 makes one targeted change. It ends private lawsuits for pen register and trap-and-trace claims under § 638.51 that arise from conduct on a website, online application, or mobile application. Going forward, only the California Attorney General can bring those claims. Baker Donelson describes the mechanism as an amendment to Penal Code § 637.2, and reports a signing date of September 30, 2026.
Three features matter most for practitioners and business owners:
Effective date. January 1, 2027.
Retroactivity. The bar applies to pending claims in actions commenced within the two years before the effective date. If you are already a defendant in a § 638.51 website case filed in that window, you may have grounds to seek dismissal.
Demand letters.Outstanding demand letters are not "pending claims in an action," so the retroactivity language does not technically cover them. As a practical matter, a letter threatening a private § 638.51 suit loses most of its force, and due process challenges to the retroactive piece are anticipated.
The bill had broad support from the Stop CIPA Shakedowns coalition, which included the California Chamber of Commerce, the National Federation of Independent Business, the California Retailers Association, TechNet, and the California Farm Bureau. Governor Newsom said the law "addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses."
The risks that are still out there
SB 690 is narrow, and plaintiffs have already noticed. The risks that remain include:
Wiretapping claims under § 631. The statute is untouched. Plaintiffs can re-plead pen register allegations as wiretapping claims with the same $5,000-per-violation exposure. EIA reports plaintiffs are already doing this, and the Governor encouraged the Legislature to take up § 631 next session. That is a hope, not a law.
Session replay, chat, and similar tools. These remain actionable under the wiretapping and eavesdropping provisions (§§ 631, 632, and 632.7), and statutory damages remain available.
Pending demand letters. The retroactivity provision speaks to pending actions, not letters. Expect some firms to keep sending them, repackaged under other theories.
Federal and other state laws. Baker Donelson flags the Electronic Communications Privacy Act, Pennsylvania's WESCA, Florida's FSCA, the Video Privacy Protection Act, and consumer health privacy laws such as Washington's My Health My Data Act.
Regulators. The Attorney General now holds exclusive enforcement of the pen register theory and the Department of Justice received funding for it, although the bill imposes no enforcement mandate. Scrutiny from the AG and the Privacy Protection Agency is more likely to rise than fall.
Constitutional challenge. Retroactive application invites due process arguments, so outcomes in pending cases may not be uniform.
What businesses should do now
Triage anything pending. If you have a lawsuit or open claim, sort it by statute and filing date to see whether a § 638.51 website claim falls inside the retroactivity window.
Reassess settlement posture. Pen register-only claims inside the window may be worth far less than they were a month ago.
Re-read every demand letter. Identify which theory it actually asserts. A letter built on § 638.51 alone is a different problem than one asserting § 631.
Inventory your tracking technologies across web and mobile properties, including pixels, session replay, chat, and analytics vendors.
Fix consent sequencing. Confirm your cookie banner actually gates the tools it claims to gate, and that nothing fires before consent where your policy says it won't.
Document vendor relationships. Know who receives visitor data and under what contract terms.
Don't treat January 1, 2027 as the finish line. The tools and theories that drew suits before SB 690 still exist.
Why we are winding down our CIPA tracking
We have been tracking CIPA filings and demand activity because the volume and the pen register theory made the area move quickly. With SB 690 closing the private pen register door, the part of the landscape that generated the most noise is going away, and we are winding down our CIPA tracking for several months to see how things shake out.
That is a statement about our tracking, not a statement that the risk is gone. Section 631 and the related wiretapping claims remain live, and the Legislature may take them up next session. If that happens, or if a court decision or a new filing pattern changes the picture, we will revisit. If you have a pending case, a demand letter, or questions about your website's tracking setup, contact us and we will look at it with you.
This post is general information, not legal advice, and does not create an attorney-client relationship.