Will CIPA Litigation Come To A Halt? Key Takeaways From California SB-690

Over the last few years, businesses across the country have faced an influx of lawsuits brought under the California Invasion of Privacy Act (CIPA), many brought by serial plaintiffs seeking monetary damages for alleged website privacy violations. With the recent passage of California Senate Bill 690, California lawmakers are working towards addressing this troublesome litigation trend. While the bill does not eliminate all private claims under CIPA, it significantly changes how certain claims may be enforced and will have an immediate impact on pending and future litigation.

Overview of CIPA

Originally enacted in 1967 long before the internet existed, CIPA was designed to protect California residents from unauthorized wiretapping and eavesdropping. The statute contains a private right of action that allows individuals to seek statutory damages for certain alleged violations. In recent years, as technology has evolved, plaintiffs have increasingly relied on CIPA to allege privacy violations stemming from the use of website technologies, including cookies, tracking pixels, analytics tools, session replay software and other similar tools that collect information about users’ website interactions. Plaintiffs commonly argue that the use of these website technologies constitute unlawful “wiretaps” or “pen registers” in violation of CIPA. As a result, and because the use of such technologies is so common, California courts have seen a significant influx of website privacy lawsuits and demand letters directed towards businesses from virtually every industry.

Introduction of SB-690

Passed by both the Assembly and the Senate on Friday, Aug. 28, 2026, SB-690 eliminates the private right of action for claims alleging violations of CIPA’s pen register and trap and trace provision (Cal. Penal Code § 638.51) when such claims arise from conduct occurring on an internet website, online application or mobile application. Now, only the California Attorney General may bring such enforcement actions against private actors. Importantly, the bill does not eliminate the underlying prohibition; instead, it merely changes who can enforce it.

The bill applies retroactively to any pending claims commenced within two years prior to the bill’s operative date. As a result, pending lawsuits based on violations of CIPA’s pen register and tap and trace provision will be affected.

Key Takeaways

Although SB-690 eliminates the private right of action for lawsuits arising under CIPA’s pen register and tap and trace provision, importantly, it does not eliminate claims under other frequently litigated sections of CIPA, including the wiretapping and eavesdropping provisions (Cal. Penal Code § 631; Cal. Penal Code § 632). Therefore, companies that collect user information through websites, online applications or mobile applications (including through the use of website tracking technologies) should continue evaluating their privacy policies, disclosures and consent mechanisms to ensure overall compliance.

Ensuring your website includes proper CIPA risk mitigation strategies is essential. If your business uses online tracking tools and your website is accessible to California-based consumers, you could still be at risk. 

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.