Major CIPA Reform Could Wipe Out Thousands Of Website Tracking Claims

Key Takeaways

• On August 28, 2026, the California Legislature unanimously passed SB 690, which would eliminate private lawsuits under the CIPA Cal. Penal Code § 638.51 for “pen register” claims arising from website and app tracking technologies.
• If SB 690 becomes law, only the California Attorney General, not private plaintiffs, could bring these claims.
• The bill is retroactive, potentially extinguishing thousands of pending lawsuits filed after approximately January 1, 2025.
• The bill has not yet been signed. Governor Newsom has until September 30, 2026, to act. If signed, or if the Governor declines to act, SB 690 takes effect January 1, 2027. If the Governor vetoes the bill, the Legislature may override the veto with a two-thirds vote.
• SB 690’s unanimous passage makes it highly likely the bill will become law.¹ 
• SB 690 arrives alongside two companion CCPA-expansion bills (SB 923 and AB 1542), which also are expected to pass, reflecting California’s broader recalibration of privacy enforcement.
• Bottom line. For organizations facing or threatened with a CIPA § 638.51 class action based on website tracking technology, this bill could drastically reduce exposure.

Introduction

With the passage of SB 690, the California Legislature is poised to significantly reshape data privacy litigation in California by eliminating the private right of action under the California Privacy Information Act (CIPA) § 638.51 for “pen register” claims based on website and app tracking technologies.

This legislation comes in response to a wave of litigation arising from the routine use of web tracking technologies. Since 2024, plaintiffs’ attorneys have filed thousands of proposed class actions under CIPA § 638.51, arguing that website technologies, such as tracking pixels (small code snippets that report user activity), cookies (data files stored on user devices), session replay tools (software that records user interactions with a webpage), chat widgets and SDKs (software development kits, i.e., third-party code embedded in websites or apps that may collect user data) function as illegal “pen registers” under the statute. Indeed, between February 2025 and the August 2026 passage of SB 690, the number of pen register lawsuits grew from approximately 600 to nearly 4,000. Targets of these suits include retailers and other commercial businesses, hospitals, nonprofits, school districts and public agencies.

The stakes are real. CIPA allows statutory damages up to $5,000 per violation, creating enormous potential exposure for organizations that use website tracking.² 

CIPA and Website Tracking Litigation

In actions alleging privacy violations based on website tracking, plaintiffs typically rely on two primary CIPA theories: wiretapping/interception of content under § 631 and pen register/metadata capture under § 638.51. A “pen register” is “a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.”³ The distinction in § 638.51 between “contents” and “metadata” is critical. Section 631 protects the “contents,” meaning the substance of communications, while § 638.51 protects against the surveillance of routing, addressing or signaling information. SB 690 addresses only § 638.51 claims.

Federal courts have dismissed § 638.51 claims on various grounds, though no district or appellate court has held that the provision is limited to telephone surveillance.⁴ 

State courts, on the other hand, have grappled with the pen register provision’s reach. Multiple California superior courts have held that § 638.51 does not apply to website tracking, concluding that the statute’s text, structure and legislative history limit its scope to telephonic surveillance.⁵ 

One particular state court case has received a lot of attention. On August 21, 2026, the California Court of Appeal, Second District, issued a tentative ruling that § 638.51 can apply to internet communications and is not limited to telephone surveillance.⁶ However, the court signaled that it would narrow what qualifies as a pen register and that a tracker which merely collects a user’s IP address and device metadata may not meet the statutory definition. A decision is expected by November.

If SB 690 becomes law, California will depart from the direction in which the California Court of Appeal appears to be steering § 638.51 pen registers claims, removing a statutory tool commonly used by plaintiffs in internet data privacy cases.

SB 690 was introduced in February 2025 in response to what the bill’s sponsor described as “a handful of trial lawyers” who “have sued over 1,500 businesses” and “sent thousands more demand letters” using CIPA, “a 1967 criminal wiretapping statute that requires consent before recording phone calls.”⁷ The bill aims to provide “a balanced solution that protects Californians’ privacy while protecting organizations from costly lawsuits over routine website technology.”⁸ 

As originally introduced, SB 690 took a broader approach. The bill would have created a “commercial business purpose” exemption from liability under multiple CIPA provisions, including the wiretapping (§ 631), confidential recording (§ 632) and pen register (§ 638.51) provisions. Although the bill passed the State Senate 35-0 on June 3, 2025, it drew opposition from privacy and consumer advocacy groups—including the American Civil Liberties Union (ACLU) California Action, the Electronic Frontier Foundation and the Privacy Rights Clearinghouse, who argued the exemption was overly broad—and the bill stalled in the Assembly. As a result, when the Assembly Committee on Privacy and Consumer Protection took up SB 690 in July 2026, the bill’s author agreed to narrow the bill to respond “directly and surgically to the most pressing problem at hand” by eliminating the private right of action for pen register claims only, rather than exempting commercial activity across all CIPA provisions.⁹The committee analysis describes the pen register litigation wave as a “poster child for abusive lawsuits.^”10 

What SB 690 Does

SB 690, as it currently stands, contains three main components:

1. SB 690 eliminates private lawsuits. The bill amends CIPA so that only the Attorney General, not private plaintiffs, can bring § 638.51 pen register claims arising from website or app tracking.
2. The law would apply retroactively. The bill covers pending § 638.51 claims filed within two years before the operative date (i.e., claims filed on or after approximately January 1, 2025).
3. The bill includes a severability provision. If the retroactivity provision is struck by a court, the elimination of the private right of action would still survive.

What SB 690 Does Not Do

SB 690 does not impact other causes of action that have been used to challenge website tracking, including CIPA § 631 wiretapping claims, common-law privacy claims, Unfair Competition Law (UCL) claims or claims under other privacy statutes such as the California Comprehensive Data Access and Fraud Act (CDAFA). This is an important consideration for organizations to keep in mind because plaintiffs typically bring multiple causes of action within a single lawsuit. It is therefore unlikely that entire cases will be dismissed as a result of SB 690. Instead, plaintiffs will have one fewer “arrow” in their litigation quiver.

Finally, SB 690 does not create a “commercial business purpose” safe harbor, a provision that had been included in earlier drafts but was subsequently eliminated. Nor does it legalize website tracking technology or grant immunity.

Companion Bills and CCPA Expansion

While SB 690 offers significant relief from § 638.51 class action exposure, businesses should be aware that the California Legislature is simultaneously seeking to expand substantive data privacy obligations through two companion bills that are also awaiting signature by the Governor:

• SB 923 (Expanding Privacy Rights Act) requires businesses to delete personal information obtained from data brokers and third parties, not just information collected directly from consumers, upon the consumer’s request.
• AB 1542 (Sensitive Data Sale Prohibition) prohibits the sale or sharing of precise geolocation, biometric, health and other sensitive personal information.

SB 923 passed the Senate 37-0 and the Assembly 49-14, making it very likely to become law. AB 1542 faced more resistance in the Assembly (44-19), suggesting some industry opposition, but it also will likely become law.¹¹ 

Bottom line. SB 690 offers meaningful litigation relief, but SB 923 and AB 1542 will impose new compliance obligations around data deletion and sensitive data practices. Companies should prepare for both developments.

What This Means for Organizations Facing CIPA Claims

For businesses and other entities facing active litigation involving § 638.51 claims, such claims filed after January 1, 2025, could be extinguished by SB 690. Organizations in this position should reassess their settlement posture and litigation strategy now. Note that claims based on § 631 (wiretapping) are not affected by this legislation; only the pen register count is impacted.

For organizations that have received a demand letter asserting a § 638.51 claim, SB 690 provides a compelling argument with which to respond.

Even if your organization is not currently facing CIPA litigation, this is an opportune moment to proactively assess website tracking technologies and mechanisms to obtain website user consent to tracking. Many common analytics tools, pixels and third-party integrations may trigger the same theories of liability that have fueled the website tracking litigation wave. A preemptive audit can identify and remediate exposure before a demand letter or complaint arrives, particularly for § 631 wiretapping claims, which are unaffected by SB 690.

Recommended Next Steps

• Monitor whether Governor Newsom signs SB 690 before September 30, 2026, noting it becomes law if he signs it or declines to act.
• Organizations with pending § 638.51 claims should evaluate whether the retroactivity window may apply.
• Audit website tracking technologies (pixels, cookies, chat tools, session replay) and consent mechanisms for continued § 631 and other exposure.
• Review data deletion and sensitive data practices in anticipation of SB 923 and AB 1542.

Footnotes

1 S.B. 690, Vote History, 2025–2026 Leg., Reg. Sess. (Cal. 2026) (Assembly Floor Vote, 66-0, Aug. 28, 2026; Senate Floor Vote, 40-0, Aug. 28, 2026), https://leginfo.legislature.ca.gov/faces/billVotesClient.xhtml?bill_id=202520260SB690.

2 See Cal. Penal Code § 637.2(a)(1).

3 Cal. Penal Code § 638.50(b).

4 See Mitchener v. CuriosityStream, Inc., 815 F. Supp. 3d 845, 851-52 (N.D. Cal. 2025) (dismissing § 638.51 claim where the alleged tracking fell outside the statutory definition of a pen register); Wright v. TrueCare Prop. Holdings, LLC, No. 3:25-cv-00786, 2025 WL 3248749, at *4-5 (S.D. Cal. Nov. 21, 2025) (allowing § 638.51 claim to proceed based on Meta Pixel tracking); Gabrielli v. Motorola Mobility LLC, No. 24-cv-09533, 2025 WL 1939957, at *11-12 (N.D. Cal. July 14, 2025) (rejecting argument that pen register provision is limited to telephones); Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024, 1050 (S.D. Cal. 2023) (holding that software identifying consumers through fingerprinting can constitute a pen register).

5 See, e.g., Blaker v. NetScout Sys., Inc., No. 25STCV31283, 2026 WL 1709143, at *4 (Cal. Super. Ct. May 27, 2026) (holding that § 638.51 “applies to telephonic communications and not to software on a commercial website”); Schallert v. Orkin LLC, No. 24STCV31244, 2025 WL 4332757, at *4 (Cal. Super. Ct. Dec. 15, 2025) (statutory reference to “telephone line” “sharply narrows” the pen register definition); Blalock v. EquipmentShare.com Inc., No. 30-2025-01508739-CU-MC-CJC, 2026 WL 330067, at *2 (Cal. Super. Ct. Jan. 27, 2026) (noting while the statute was enacted in 2015, well after the internet’s advent, it makes no reference to internet surveillance).

6 Variety Media, LLC v. Superior Court, No. B350578 (Cal. Ct. App. Aug. 21, 2026) (tentative ruling), https://cipaworld.com/wp-content/uploads/2026/08/Variety-Media-LLC-v.-Superior-Court-B350578-3.pdf.

7 Office of Senate Floor Analyses, Third Reading Analysis of S.B. 690, 2025–2026 Leg., Reg. Sess. (Cal. 2025), file:///C:/Users/cbarwick/Downloads/202520260SB690_Senate%20Floor%20Analyses%20(2).pdf.

8 Press Release, Sen. Anna Caballero, Senator Caballero’s SB 690 Passed the California Legislature With Bipartisan Support, Including A 39-0 Assembly Vote, Heads To Governor (Aug. 31, 2026), https://sd14.senate.ca.gov/news/press-release/senator-caballeros-sb-690-passed-california-legislature-bipartisan-support.

9 Assembly Committee on Privacy and Consumer Protection, Analysis of S.B. 690, 2025-2026 Leg., Reg. Sess., at 1-2 (Cal. July 1, 2026), https://apcp.assembly.ca.gov/system/files/2026-06/sb-690-caballero-apcp-analysis.pdf.

10 Id.

11 S.B. 923, Vote History, 2025–2026 Leg., Reg. Sess. (Cal. 2026) (Senate Floor Vote, 37-0; Assembly Floor Vote, 49-14), https://leginfo.legislature.ca.gov/faces/billVotesClient.xhtml?bill_id=202520260SB923; A.B. 1542, Vote History, 2025–2026 Leg., Reg. Sess. (Cal. 2026) (Assembly Floor Vote, 44-19), https://leginfo.legislature.ca.gov/faces/billVotesClient.xhtml?bill_id=202520260AB1542.