Privacy, Cyber & Data Strategy Advisory | California SB 690 Reform Advances As CIPA Claims Persist

Website privacy litigation remains one of the most active areas of consumer litigation in California. Businesses continue to face demand letters, class actions, and mass arbitration threats challenging the use of routine analytics and advertising tools.

Some plaintiffs’ firms continue to pursue these claims indiscriminately, despite Ninth Circuit and state court rulings holding that plaintiffs must have a protectable privacy interest to sustain a privacy claim. Simply put, routine cookie tracking, without more, does not establish a cognizable harm.

CIPA Demands Continue to Proliferate

SB 690 is legislation intended to reform the California Invasion of Privacy Act (CIPA) and provide some relief to small businesses and employers throughout the state. Reform is badly needed. In the 2025 ruling in Doe v. Eating Recovery Ctr. LLC, a Northern District of California judge described CIPA’s language as a “total mess.”

Law firms, including ours, have seen a surge in CIPA demand letters and claims since SB 690 was introduced in 2025. These demand letters have targeted nonprofits, bakeries, out-of-state banks with no California branches, B2B companies that sell niche financial software to large companies, and foreign parent companies that do little more than maintain investor websites. The situation has reached a point of absurdity: out-of-state B2B companies have received their third or fourth website privacy demand letter in a year simply for using a Meta Pixel or LinkedIn tag.

Some plaintiffs’ firms target routine analytics or security tools on websites—often the same software that government and court websites use. These suits seem divorced from considerations of consumer welfare. Consumers benefit from a security and financial protection standpoint when websites remain available, identify and block malicious traffic, and enable owners to evaluate who is using the website, what they are doing, and where traffic is originating. Yet plaintiffs have argued that those protective technologies amount to wiretapping unless users provide an explicit opt-in. In effect, plaintiffs’ firms are asking websites to choose between keeping bot protection on or paying up.

Plaintiffs in these cases include “testers” who intentionally visit websites to determine whether cookies track any of their activity, without any genuine intent to patronize the business. One of the most prolific CIPA demand letter senders is a pro se claimant and plaintiff who was previously indicted for attempted extortion. On July 20, 2026, he was declared a vexatious litigant in the Central District of California.

Plaintiffs in other states are also trying to replicate the CIPA demand playbook, often because it is cheaper for companies to settle rather than litigate. Notably, many states either do not require all-party consent for recording communications or have curtailed website privacy claims before they proliferate as they have in California.

SB 690 Would Narrow Certain CIPA Claims

The California Consumer Privacy Act (CCPA), California’s comprehensive online privacy statute, which was passed in 2018, does not expressly require users to opt in before cookies, pixels, and website trackers are deployed. Instead, website trackers can be turned on by default, so long as users are provided with an easy-to-use option to turn them off.

That approach conflicts with plaintiffs’ view of CIPA: that no website cookies can “fire” unless a user opts in.

Due to this interplay, the version of SB 690 introduced in February 2025 would have broadly aligned CIPA with the CCPA by clarifying that routine activities already regulated under the CCPA and its “commercial business purposes” exemption are not actionable under CIPA.

The proposal discussed this month by the state Legislature’s privacy subcommittee, however, takes a narrower approach. Rather than importing CCPA standards to harmonize the statutes, the current proposal would eliminate the private right of action only for claims brought under CIPA’s provision governing pen-register and trap-and-trace claims under California Penal Code Section 638.51.

These claims allege that inbound or outbound dialing, routing, or signaling information—but not the contents of communications—was captured by website technology. Typically, plaintiffs often allege that the collection of a routine IP address, coupled with device information or other data points, violates Section 638.51. Eliminating the private right of action for Section 638.51 claims would remove a major source of exposure under CIPA.

One of the most important features of the latest version of SB 690 is its retroactivity provision, intended to address the recent wave of demands. If enacted in its present form, claims filed two years or less before enactment would be barred.

Courts Are Also Considering CIPA’s Reach

At the same time the state Legislature is considering SB 690, California courts are evaluating whether portions of CIPA apply to website technologies at all. While many lawsuits assume that CIPA’s pen-register and trap-and-trace provisions extend to websites, a growing number of courts have questioned that premise. Several recent Los Angeles Superior Court decisions have held that those provisions apply only to telephone communications.

Most notably, in Variety Media LLC v. Superior Court of the State of California, the California Court of Appeal’s Second District is considering whether CIPA’s trap-and-trace provisions apply to software used on a website. The parties have submitted multiple rounds of supplemental briefing, suggesting the court may issue a reasoned opinion on CIPA’s scope.

Significant CIPA Litigation Risk Would Remain

Will businesses continue to see CIPA claims even if SB 690 passes? Probably. The current proposal is not a complete solution to website privacy litigation risk.

A significant volume of litigation continues to be brought under CIPA’s wiretapping provision in California Penal Code Section 631, the California Electronic Communications Privacy Act, and other statutes. Plaintiffs’ firms have continued to advance increasingly creative theories targeting website technologies, consent flows, cookie-banner functionality, and third-party integrations.

Nevertheless, the ultimate scope of many of these claims remains unsettled. Courts may independently narrow CIPA’s reach by clarifying whether statutory provisions enacted to regulate telephone surveillance apply to modern website technologies at all.

While broader reform is likely needed to loosen CIPA’s chokehold on website owners, SB 690 would be a meaningful step in the right direction.

What Businesses Should Do Now

• Review the tracking technologies deployed across websites, mobile applications, and customer-facing digital properties.
• Confirm that consent management platforms and cookie-banner configurations operate as intended and as represented to users.
• Assess existing website privacy litigation exposure, including unresolved demand letters, arbitrations, and lawsuits.
• Monitor SB 690 developments and evaluate how any enacted legislation may affect ongoing disputes.
• Track the Variety Media California Court of Appeal case.

Ransomware Fusion Center

Stay ahead of evolving ransomware threats with Alston & Bird's Ransomware Fusion Center. Our Privacy, Cyber & Data Strategy Team offers comprehensive resources and expert guidance to help your organization prepare for and respond to ransomware incidents. Visit Alston & Bird's Ransomware Fusion Center to learn more and access our tools.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.