SB 690 Passes The California Legislature – Potentially Limiting CIPA “Pen Register” Lawsuits Against Websites

For the past two years, plaintiffs’ lawyers have increasingly relied on an unlikely provision of the California Invasion of Privacy Act (“CIPA”) to target ordinary website technologies. Today, the Assembly and Senate passed an amended version of SB 690, which would effectively eliminate the private right of action for Section 638.51 claims based on activity occurring on websites. The bill also contains an important retroactivity provision that would apply the amendment to pending claims in actions commenced within two years before the legislation’s operative date.

As we have previously reported, plaintiffs have argued that cookies, pixels, analytics tools, and similar technologies qualify as illegal “pen registers” or “trap and trace devices” under California Penal Code Section 638.51 because they collect IP addresses, device information, or other routing and addressing data. Those theories have generated hundreds of lawsuits and demand letters, with courts reaching conflicting conclusions about whether a statute originally directed at telephone surveillance applies to modern website technology. 

What Happens Next?

SB 690 now goes to Governor Gavin Newsom, who has until September 9, 2026 to sign or veto the legislation. If signed, the measure should take effect on January 1, 2027, with the retroactivity period looking backwards from that date.

The amended bill would not eliminate other CIPA theories targeting websites. In particular, the current bill does not amend Section 631, CIPA’s traditional wiretapping provision. Plaintiffs therefore may attempt to reframe some tracking allegations as Section 631 interception claims rather than Section 638.51 pen-register claims. The practical effect of SB 690 would be to close—or at least substantially narrow—one increasingly popular avenue of private CIPA litigation, rather than website privacy litigation altogether.

Earlier versions of SB 690 took a broader approach. They proposed a “commercial business purpose” exemption that would have amended several CIPA provisions, including Sections 631, 632, and 632.7, as well as the statutory definitions of pen registers and trap-and-trace devices. The latest version abandons those changes and instead focuses exclusively on CIPA’s civil-remedies provision, Section 637.2. 

Under the amended bill, an action alleging a Section 638.51 violation arising from conduct occurring on an “internet website, online application, or mobile application” could be brought only by the California Attorney General.

That is a significant change because Section 637.2 currently allows private plaintiffs to seek $5,000 per violation without showing actual damages. If signed by the governor, private plaintiffs would no longer be able to use those remedies to pursue the website- and app-based Section 638.51 claims that have fueled the recent wave of CIPA litigation.