CIPA Reform Makes Its Way To Governor’s Desk

We have been writing about the California Invasion of Privacy Act (CIPA) for a while now. From demand letters flooding our clients’ inboxes to the wave of class action filings targeting standard website tracking tools, this 1967 wiretapping statute has proven uniquely susceptible to claims that bear little resemblance to the covert surveillance it was originally designed to prevent.

On August 28, 2026, the California Legislature unanimously passed Senate Bill 690, and for businesses that have been on the receiving end of pen register litigation, the bill represents the most significant relief to date.

Here is what you need to know.

What SB 690 Does

At its core, SB 690 eliminates the private right of action for pen register and trap and trace claims under Section 638.51 of the California Penal Code when the alleged violation arises from conduct on a website, online application, or mobile application. Going forward, only the California Attorney General can bring those claims against private businesses. Private plaintiffs are out of the enforcement equation for these specific claims.

The bill also applies retroactively. If signed into law, it would cover any pending Section 638.51 claim in an action commenced within two years before the operative date of January 1, 2027; specifically, claims filed on or after January 1, 2025. For defendants sitting on active pen register lawsuits or stacks of demand letters, the retroactivity provision is arguably the most consequential piece of the bill. It also includes a severability clause: if a court strikes the retroactivity provision, the elimination of the private right of action survives.

SB 690 does not, however, impact CIPA’s other provisions. Claims under Section 631 (wiretapping) and Section 632 (confidential recording) remain fully available to private plaintiffs.

Why It Matters

For businesses, SB 690 should meaningfully reduce exposure to one of the most aggressive categories of CIPA litigation. The pen register theory has been used to target everything from analytics pixels and cookies to session replay tools, chat widgets, and software development kits embedded in websites and mobile apps. These suits typically involve the collection of relatively benign digital information, like IP addresses, and fail to allege concrete injury. The bill removes private plaintiffs from the equation and makes the Attorney General the sole enforcer of pen register claims tied to websites and apps. Notably, although the Attorney General has technically had this authority for years, the office has never brought a tracking-technology case under Section 638.51, opting instead to address website tracking through the CCPA.

But this is not comprehensive CIPA reform. The majority of the more aggressive CIPA theories, particularly those alleging that cookies, pixels, chatbots, and session replay tools constitute illegal wiretaps under Section 631, remain fully viable. Plaintiffs’ counsel can be expected to shift emphasis from Section 638.51 to Sections 631 and 632, and complaints may become more technically detailed as a result. The two theories rest on fundamentally different allegations. A pen register claim under Section 638.51 targets the collection of metadata (routing information like IP addresses) while a wiretap claim under Section 631 requires a plaintiff to show that a third party actually intercepted the substance of a communication. The broader wave of CIPA litigation is not going away.

There is also a parallel development worth watching. On August 21, 2026, the California Court of Appeal issued a tentative ruling in Variety Media, LLC v. Superior Court that would reject the categorical argument that CIPA’s pen register provisions are limited to telephone systems, while also finding that IP-address collection alone does not state a valid pen register claim. The ruling remains tentative pending the court’s final opinion, and SB 690 does not resolve the case’s threshold question. SB 690 and Variety Media operate on different tracks. The bill changes the enforcement mechanism (in other words, who can bring a case) while the court is grappling with whether Section 638.51 reaches internet tracking at all. If the bill is signed, the private right of action disappears regardless of which way the appellate court rules..

What Happens Next

The bill now heads to Governor Newsom, who has until September 30, 2026, to sign or veto it. Given its unanimous passage through both chambers, observers generally expect the Governor to sign it. If signed, or if the Governor takes no action, SB 690 becomes operative on January 1, 2027.

SB 690 also arrives alongside two companion CCPA-expansion bills, SB 923 and AB 1542, which reflect California’s broader recalibration of privacy enforcement.

What Businesses Should Do Now

Even if SB 690 passes and is signed into law, businesses should not let their guard down. Here is what we continue to recommend:

• Audit your tracking technologies. Know what tools are deployed on your website, what data they collect, and what third parties receive that data. While engaging a company to implement and maintain your website may be efficient, it does not absolve a business of responsibility for what is happening on its site.
• Update your privacy disclosures. Ensure your privacy policy and posted terms accurately describe your data collection practices.
• Deploy consent mechanisms. Use a cookie banner or similar tool that provides meaningful notice and opt-out options, and ensure those options are presented before tracking technologies engage. Businesses should expect to continue relying on consent-management measures to mitigate litigation risk under Sections 631 and 632.
• Evaluate pending matters. If your business has a pending Section 638.51 lawsuit or demand letter, consult with counsel about how the retroactivity provision may affect your specific circumstances.
• Monitor the legislative calendar and the courts. Additional CIPA amendments could surface, and the California Court of Appeal’s forthcoming decision in Variety Media may further shape the landscape.

SB 690, if signed into law, will shut down a significant volume of no-harm litigation built on a statute designed for covert government surveillance, not analytics pixels on websites. That is a welcome development, but it is only one piece of a much larger puzzle.