Another CIPA Update: SB 690 Passed. An Appellate Court Finally Spoke. Neither One Settles CIPA — Yet

Anyone who has been reading this space knows the drill by now: the California Invasion of Privacy Act, a 1967 wiretap statute, is still the busiest privacy statute in the country, courts are still split on what it means for a website, and the two developments everyone has been waiting on — a legislative fix and a real appellate ruling — have both been "pending" for weeks. As of this week, neither is pending anymore. Both moved. And, true to form for this area of law, neither one gives businesses a clean answer.

This is the latest installment in our ongoing tracking of the CIPA website-tracking litigation wave. We update this coverage as the law develops — sometimes weekly, sometimes faster when something like this week happens — so treat what follows as the picture as of August 29, 2026, not a final word on anything.

SB 690 cleared the legislature. It has not become law.

On August 28, 2026, both houses of the California Legislature passed SB 690, the bill that would strip the private right of action from Penal Code §638.51 pen-register and trap-and-trace claims arising from ordinary website tracking, leaving enforcement to the Attorney General alone. The Senate concurred in the Assembly's amendments 39–0, and the bill has been ordered to engrossing and enrolling — legislative-speak for "on its way to the Governor's desk."

That is a real change from where things stood one week ago, when the bill was stuck in the Assembly with commentators openly describing it as stalled. It is not, however, the end of the story. SB 690 now sits with Governor Newsom, who has until roughly the end of September to sign it, veto it, or let it become law without his signature. Consumer privacy advocates, including Consumer Reports, have opposed the bill throughout its progress, and nothing about a 39–0 concurrence vote tells us how the Governor will act. Until he does, CIPA §638.51 exposure has not gone anywhere.

It is also worth restating what SB 690 would and would not do if signed. It targets only the pen-register/trap-and-trace theory under §§638.50–638.51, and only as applied to ordinary website and app tracking. The bill's current version would apply retroactively to claims commenced on or after January 1, 2025, which matters enormously to anyone currently defending a pending case. But Section 631 wiretap claims — the theory behind most chatbot and session-replay suits — would be entirely untouched. A signature would meaningfully change the economics of one slice of this litigation. It would not make CIPA exposure disappear.

An appellate court finally addressed the core question — and split the baby

The other headline development is the first real appellate guidance on whether CIPA's pen-register provision reaches the internet at all. On August 21, 2026, the California Court of Appeal, Second Appellate District, issued a tentative ruling in Variety Media, LLC v. Superior Court, No. B350578 — the writ proceeding we have been flagging in this space for weeks as the case most likely to move the needle. Oral argument was held August 25, 2026. As of this writing there is no final opinion, and the court is free to revise its reasoning before one issues.

The tentative ruling is genuinely a mixed bag, and early commentary has already split on how to characterize it. On the question every trial court has been wrestling with — does a 1967 telephone statute reach website analytics at all — the court tentatively sided with plaintiffs: CIPA's pen-register provision is not limited to telephones, and California's privacy protections can extend to modern tracking technology. That directly cuts against the line of state trial-court decisions we have tracked all year — Blalock, Blaker, Heiting, and others — that dismissed on the theory that §638.51 is telephone-specific.

But on the narrower question of what Variety itself was accused of doing, the court tentatively sided with the defense. A pen register, the court reasoned, must capture information identifying the destination of a communication — and a visitor's IP address identifies the source, not the destination. Under that reasoning, the specific allegations against Variety were not enough, and the court's tentative approach is to sustain the demurrer with leave to amend, letting the plaintiffs try again with more specific technical allegations — referrer headers, origin data, and similar destination-identifying metadata, rather than IP address alone.

That is why the commentary has landed on some version of "Variety wins the battle, website owners lose the war." The immediate claim may not survive as pled. But the reasoning that gets Variety there confirms, for the first time at the appellate level, that the pen-register theory is alive on the internet — it just needs to be pled around IP addresses rather than resting on them. With more than 3,000 similar cases reportedly pending and several federal cases on hold awaiting this decision, that distinction is likely to reshape how the next wave of complaints is drafted, not end the wave.

Two related appellate matters remain outstanding and unresolved by this ruling: the companion case Reuters News & Media, Inc. v. Superior Court in the Sixth Appellate District, raising the same core question, and the Ninth Circuit's pending interlocutory appeal in Drummer v. CoStar Group on whether sharing an IP address is a cognizable privacy injury for standing purposes at all. Both are still pending. Neither should be assumed to come out the same way as Variety.

What has not changed

Everything covered in our last update remains good law as of this writing: the standing defense built on data sensitivity rather than data volume (Malko v. GNC Holdings, Diaz v. Paramount Skydance), the emerging consent-timing doctrine that looks at whether a tracking script fires before or after the consent banner renders (Garcia v. Anschutz Entertainment Group, Camplisson v. Adidas America), and the lesson from Cobbs v. PetMed Express that incorporating outside California provides no protection at the pleading stage, even if a disciplined discovery strategy can still end a case at class certification. None of that is disturbed by this week's developments — if anything, the Variety tentative ruling makes the standing and consent-timing defenses more important, not less, since the pure "the statute doesn't reach the internet" argument just took a serious hit at the one appellate court to squarely address it.

What this means for e-commerce businesses right now

Do not treat SB 690 as decided. It is one signature away from becoming law and one veto away from being dead for the session, and even if signed it reaches only the pen-register theory. Build compliance around the assumption that §638.51 exposure, and certainly §631 exposure, persists regardless of what the Governor does.

Do not treat the Variety tentative ruling as a defense win, even though a defendant technically prevailed on the pleadings. The reasoning cuts the other way for the industry as a whole, and a final opinion has not issued. Expect plaintiffs' counsel to start pleading destination-identifying metadata specifically in response to this ruling.

Keep doing the things that have worked regardless of how the pen-register question shakes out: know what actually fires on your site and when, make sure consent mechanisms are in place before trackers activate rather than after, and treat any collection touching health, financial, or similarly sensitive data with real caution, since that is where the standing defense is weakest.

This is still an open, moving situation

We want to be direct about something: this update does not close the book on CIPA any more than the last one did, or the one before that. SB 690 could be signed, vetoed, or left to become law without signature within the next several weeks. The Variety Court of Appeal has not issued its final opinion, and when it does, it could refine or depart from the tentative reasoning described above. The Reuters and Drummer appeals remain pending. And the U.S. Supreme Court's argument in Salazar v. Paramount Global — the VPPA case bearing on video-pixel exposure — is still calendared for October 14, 2026, with a decision not expected until roughly mid-2027.

We track these developments continuously and will keep this space updated as each of these pieces resolves. If your business has a pending CIPA matter, a demand letter in hand, or simply wants to know how any of this affects your website's current tracking setup, that is a conversation worth having now rather than after the next ruling changes the calculus again.

This post is provided for general informational purposes and does not constitute legal advice. For guidance specific to your business's website and tracking practices, please contact us directly.