On August 31, 2026, the California Legislature passed SB 690, a bill that would narrow the private right of action available under the California Invasion of Privacy Act (CIPA) for certain website-tracking claims. The bill now awaits Governor Newsom's signature. While SB 690 is a significant development for businesses facing CIPA litigation related to website analytics and tracking technologies, it is not the sweeping shield that some early commentary has suggested. Businesses and their counsel should understand exactly what SB 690 does—and what it leaves unchanged—before concluding that existing claims or demand letters have been resolved.
What SB 690 Does
If signed in its present form, SB 690 amends California Penal Code § 637.2 so that an action against a private actor alleging a violation of § 638.51—the CIPA pen-register and trap-and-trace provision—arising from conduct on a website, online application, or mobile application may be brought only by the California Attorney General. In practical terms, the bill eliminates the private cause of action for that specific category of CIPA claim. Private plaintiffs would no longer be able to sue businesses directly under § 638.51 for deploying tracking pixels, analytics tags, or similar technologies on their websites and apps.
Because the bill contains no urgency provision, if signed this year, California's standard rule would make it effective January 1, 2027.
Retroactivity and Pending Litigation
Importantly, the Legislature expressly addressed pending litigation. The enrolled language provides that the amendments "apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation." This means that qualifying § 638.51 claims already pending in lawsuits are not preserved merely because they were filed before SB 690 became effective. To the contrary, the bill was drafted specifically to reach certain pending claims retroactively, potentially providing defendants with a significant basis for seeking dismissal or other disposition of those claims once the legislation becomes operative.
What SB 690 Does Not Do
The final version of SB 690 is dramatically narrower than the original proposal. It does not eliminate private claims under CIPA § 631 (wiretapping), § 632, § 632.7, or other potential statutory and common-law theories. The earlier proposed "commercial business purpose" exemption for those provisions was removed from the final bill. Plaintiffs may continue to pursue website-tracking allegations under these surviving provisions, and businesses should expect that some plaintiffs' counsel will pivot to alternative CIPA theories in response to SB 690.
Critically, SB 690 does not make the underlying website-tracking conduct lawful. Rather, it removes the private plaintiff's ability to bring a § 638.51 action for specified website and application conduct and reserves that enforcement authority to the Attorney General. The distinction matters: characterizing the bill as having "legalized" tracking technologies could create problems for businesses, particularly where a demand or complaint also alleges § 631 interception or another theory that SB 690 does not address.
Demand Letters vs. Pending Lawsuits: An Important Distinction
There is an important distinction between a lawsuit that has already been filed and a pre-suit demand letter. The statutory retroactivity language specifically refers to a "pending claim in an action commenced" within the two-year period. A demand letter is not itself an "action commenced." Businesses that have received demand letters should not treat an outstanding demand as automatically extinguished. However, SB 690 materially changes the leverage associated with a demand based solely on a § 638.51 website or application theory, because the claimant would no longer be able to privately prosecute that theory once the new limitation is operative. Each demand should be reviewed individually to determine whether it asserts § 631 or another theory that survives SB 690.
Practical Recommendations
For businesses with an existing CIPA demand or pending lawsuit, we recommend the following:
- Do not settle prematurely. Do not pay or settle a CIPA claim solely because a response deadline is approaching without first reassessing it in light of SB 690.
- Identify the specific theories alleged. Determine whether the claimant is asserting only a § 638.51 pen-register/trap-and-trace theory or also asserting § 631, another CIPA provision, or another cause of action.
- Preserve the issue in pending litigation. If litigation is already pending, determine whether the claim falls within SB 690's retroactivity provision and preserve the issue for dismissal once the legislation becomes operative.
- Reassess demand-letter leverage. If the matter remains at the demand stage, reassess the claimant's litigation leverage in light of the anticipated elimination of the private § 638.51 cause of action.
- Continue website remediation efforts. SB 690 does not eliminate the broader CIPA website-tracking risk. The website remediation and consent work previously recommended remains important regardless of SB 690's passage.
Looking Ahead
SB 690 now sits with Governor Newsom. We are monitoring the bill and will provide an update once it is signed or vetoed, including the precise effective date and implications for pending matters. In the meantime, businesses that have received CIPA demands or are facing pending CIPA litigation should consult with counsel before responding to or resolving any claim based on assumptions about the bill's impact.