California businesses facing a wave of litigation under the California Invasion of Privacy Act (CIPA) received a significant legislative development this week. On July 1, the California Assembly Committee on Privacy and Consumer Protection approved an amended version of Senate Bill 690 (SB 690), advancing legislation that would substantially limit one of the most frequently asserted causes of action in website tracking lawsuits.
While the bill has not yet become law, it represents the strongest legislative effort to date to address the explosion of CIPA litigation involving website analytics, chat tools, pixels, session replay technologies, and other online tracking technologies.
What SB 690 Would Do
As drafted, SB 690 would eliminate the private right of action for claims arising under California Penal Code § 638.51, the CIPA provision addressing the use of pen register and trap-and-trace technologies.
Instead of allowing private plaintiffs to file lawsuits, enforcement of Section 638.51 would rest exclusively with the California Attorney General.
Perhaps even more significant, the bill would apply retroactively to pending Section 638.51 claims filed during the two years preceding its effective date. If enacted as currently written, the legislation would become effective January 1, 2027, and would apply to claims filed on or after January 1, 2025.
For businesses currently defending Section 638.51 claims, the retroactive provision could materially affect pending litigation.
Important Limitations
Businesses should avoid viewing SB 690 as a complete resolution of CIPA exposure.
The current version of the legislation is limited solely to claims brought under Section 638.51. It does not eliminate or modify the private right of action for other CIPA provisions that plaintiffs routinely assert, including:
- California Penal Code § 631(a) (wiretapping)
- California Penal Code § 632 (confidential communications)
- Other CIPA theories that continue to appear in website tracking litigation
Accordingly, website operators should continue to evaluate their use of:
- Session replay technologies
- Chatbots and live chat platforms
- Analytics platforms
- Advertising pixels
- Customer data platforms
- Tag management systems
- Other third-party website tracking technologies
More Reform May Be Coming
One of the most notable developments from the committee hearing was the indication from legislators that additional amendments may be considered before final passage.
Committee discussions suggested lawmakers are evaluating whether the legislation should also address claims under Section 631(a)—the wiretapping provision that currently forms the basis for many of today's website tracking lawsuits.
While an amendment has not yet been adopted, the comments signal growing legislative recognition that CIPA litigation has expanded well beyond the statute's original purpose.
A broad coalition reportedly appeared in support of SB 690 during the committee hearing, suggesting meaningful momentum behind additional reforms.
What Happens Next?
SB 690 has cleared its assembly policy committee, but must complete several additional legislative steps before becoming law.
The expected process is:
- Assembly Appropriations Committee (if required): fiscal review of the amended bill
- Assembly Floor Vote: approval by the full California Assembly
- Senate Concurrence: because the assembly amended the bill, the California Senate must vote to concur with the amendments
- Governor's Signature or Veto: the bill is then presented to Governor Gavin Newsom
- Effective Date: if signed (or allowed to become law), the legislation is currently drafted to take effect January 1, 2027, with retroactive application to Section 638.51 claims filed on or after January 1, 2025
The California Legislature generally must complete action on the bill before the close of the current legislative session at the end of August, after which it would proceed to the Governor for consideration.
Practical Takeaways for Businesses
Although SB 690 represents encouraging news for organizations facing CIPA litigation, businesses should not delay compliance efforts.
Until the legislation is enacted, and unless additional amendments expand its scope, businesses remain exposed to claims under other CIPA provisions, particularly Section 631(a), which continues to drive much of the current website privacy litigation.
Organizations should continue to:
- Review website tracking technologies and third-party scripts
- Validate consent management platform (CMP) implementation and functionality
- Ensure tracking technologies are consistently deployed with applicable consent requirements
- Review vendor contracts and data-sharing practices involving website technologies
- Monitor legislative developments as SB 690 progresses through the California Legislature
- Continue defending existing claims while evaluating whether pending Section 638.51 actions may ultimately be impacted by any retroactive legislation.
Looking Ahead
SB 690 represents the clearest indication yet that California lawmakers recognize the rapid expansion of website privacy litigation and are considering legislative solutions. Whether the bill remains limited to Section 638.51 or expands to address additional CIPA provisions, particularly Section 631, it will be one of the year's most closely watched privacy developments.
For now, businesses should continue treating CIPA compliance as a high priority while closely monitoring the bill's progress through the legislature. If enacted in its current form, SB 690 could significantly reshape the litigation landscape for website tracking claims beginning in 2027 and potentially affect many cases already pending today.
Contact Shumaker’s Technology, Data Privacy, Cybersecurity & AI Service Line with any questions or for more information.