Website Tracking Litigation Update: Variety Media And California SB 690

On August 21, 2026, the California Court of Appeal issued a tentative ruling in Variety Media, LLC v. Superior Court (Case No. B350578), tackling a question businesses have been asking for years: does the California Invasion of Privacy Act’s (CIPA) pen register provision reach everyday website tracking tools like cookies and pixels?

At nearly the same moment, the California Legislature was finalizing Senate Bill 690, which would eliminate the private right of action under that same provision. Together, these developments might look like relief for businesses. They aren’t—at least not fully.

The Status of Senate Bill 690

The most significant of the two developments is the unexpected rise of amended SB 690. A broader bill was sidelined last year, but after a wave of demand letters—often from self-represented (pro se) claimants—threatening businesses with lawsuits over alleged pen register violations, the Legislature introduced an amended bill that would eliminate private lawsuits under CIPA’s pen register/trap-and-trace provision, leaving enforcement solely to the California Attorney General. The bill also includes a retroactivity provision reaching claims filed within two years before it takes effect.

SB 690 passed the Assembly Appropriations Committee 15-0 on August 13, cleared the Assembly on August 28, and was approved by the Senate that same day. It’s now undergoing final administrative review before heading to the Governor’s desk.

The Tentative Ruling in Variety Media

Just a week before amended SB 690 reached the Assembly floor, the California Court of Appeal issued a tentative ruling in Variety Media, holding that CIPA’s “pen register” definition is technology-neutral, meaning it can extend beyond telephone equipment to internet communications—a setback for businesses that have argued CIPA was never meant to reach cookies or analytics tools.

The ruling was not entirely unfavorable to businesses: the plaintiff still lost on the specific claim. The court held that a pen register must capture information about where a communication is headed, not where it originated. Because an IP address identifies the visitor’s device—the source, not the destination—the claim failed as pleaded.

That doesn’t end the case. Assuming the Court of Appeal finalizes its tentative ruling without material changes, which seems likely based on the bench’s commentary at the August 25 oral argument, the plaintiff will still have an opportunity to amend the complaint.

A Paradigm Shift for CIPA Litigation? Not Really

Businesses have been eager for clarity on how CIPA applies to common website tracking practices. If SB 690 passes, plaintiffs will lose the ability to bring pen register or trap-and-trace claims. But does that end the wiretap litigation wave? Unfortunately, no.

Before pen register theories became popular, plaintiffs pursued website tracking claims under a different CIPA provision, Section 631(a). Expect a quick pivot back to that theory if SB 690 becomes law. Businesses should also watch for new claims under other privacy statutes and common-law theories. The legal label may change, but the underlying exposure won’t disappear.

If SB 690 doesn’t pass, attention shifts to the final ruling in Variety Media. Either way, the impact on the overall litigation landscape will likely be marginal—trial courts will still have to work out, case by case, whether a company’s tracking tools meet the technical definition of a pen register or trap-and-trace device.

Bottom line: litigation risk tied to web tracking technologies is evolving, not disappearing. Businesses that wait for a final court opinion or the Governor’s signature before assessing their exposure are already behind. They should take stock of their tracking practices now, understand where their specific risk lies, and be ready to act—regardless of which legal theory plaintiffs pursue next.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.