- within Law Department Performance topic(s)
This is a significant development for companies facing pixel- and tracking-technology class actions, but it is not a complete solution to CIPA tracking litigation.
California has passed Senate Bill 690, a bill that would sharply limit private lawsuits over website tracking technology if signed by Governor Gavin Newsom. The bill amends the California Invasion of Privacy Act (CIPA) to restrict private plaintiffs from suing under the pen-register and trap-and-trace provision, Penal Code Section 638.51, for covered online tracking claims. If enacted, only the California attorney general would be authorized to bring those covered claims. The bill also would apply retroactively to pending claims in actions commenced within two years before the bill's operative date. The Assembly and Senate unanimously approved the final measure. Governor Newsom has until September 30, 2026, to sign it. This is a significant development for companies facing pixel- and tracking-technology class actions, but it is not a complete solution to CIPA tracking litigation.
Background
Over the past several years, plaintiffs have filed thousands of proposed class actions against businesses, hospitals, schools and public agencies. These suits allege that website tracking pixels and similar tools violate CIPA by sending visitor data to unauthorized third-party advertisers without consent.
Plaintiffs have relied on two CIPA provisions. Section 631 targets interception of communications in transit. Section 638.51 targets pen registers and trap-and-trace devices that capture noncontent routing information. Section 638.51 claims have been a major driver of the recent litigation surge.
Filings under Section 638.51 have risen from roughly 600 to nearly 4,000 since SB 690 was introduced in February 2025.
What SB 690 Does
Eliminates the Private Right of Action
If enacted, only the attorney general could bring a Section 638.51 claim arising from conduct on a website, online application or mobile application.
Applies Retroactively
The change reaches pending claims in actions commenced within two years before the bill's operative date.
Leaves Section 631 Interception Claims Untouched
CIPA tracking suits generally proceed on two separate theories: Section 631 interception claims and Section 638.51 pen-register and trap-and-trace claims. SB 690 addresses only the second theory. It does not restrict who can sue, or when, under Section 631. A plaintiff could still plead the same tracking-pixel allegations as a Section 631 interception claim instead of a Section 638.51 claim.
Does Not Include the Earlier Commercial-Business-Purpose Exemption
Earlier versions of SB 690 would have exempted commercial-business-purpose conduct from Sections 631, 632 and 632.7, and excluded commercial-business-purpose devices from the Section 638.50 definitions of "pen register" and "trap-and-trace device." The version described as passed by the Legislature appears to have been narrowed to Section 637.2 and does not include that earlier commercial-business-purpose exemption.
Includes a Severability Clause
If a court strikes one part of the bill, the rest stands.
Litigation Context
The bill arrives days after a California appellate court signaled a setback for the defense bar. In Variety Media v. Superior Court, the Second Appellate District issued a tentative ruling rejecting the argument that CIPA's pen-register definition excludes modern tracking technology. The panel indicated that it may still rule for the defendant on a narrower ground, finding that the specific trackers at issue may not identify the destination of intercepted communications.
SB 690 addresses this litigation risk directly by removing the private right of action for Section 638.51 claims, regardless of how courts resolve the underlying definitional dispute.
What This Means for Companies
If signed and once operative, SB 690 should sharply reduce new private Section 638.51 pixel-tracking claims. Companies facing pending covered Section 638.51 claims in actions commenced within two years before the bill's operative date may have a basis to seek dismissal after the bill becomes operative.
Section 631 remains a live exposure because it is a separate cause of action from Section 638.51, not a lesser version of the same claim. A plaintiff barred from suing under Section 638.51 for a given tracking pixel may still try to plead the same conduct as a Section 631 interception claim. Companies should not treat SB 690 as full relief from CIPA tracking litigation, and plaintiffs may seek to reframe existing or future Section 638.51 allegations as Section 631 claims.
Companies should not build a compliance strategy around a commercial-business-purpose defense based on SB 690. That concept appeared in an earlier version of the bill but was not included in the narrowed version described as passed by the Legislature.
SB 690 is significant but narrow. It targets private Section 638.51 pen-register and trap-and-trace claims tied to online tracking, but it does not eliminate broader CIPA theories, including Section 631 interception claims.
Two other privacy bills passed alongside SB 690 and merit attention. SB 923 expands California Consumer Privacy Act deletion rights to cover data obtained from brokers and other third parties. AB 1542 generally would bar the sale of precise geolocation, biometric, health and other sensitive personal information.
Recommended Actions
Inventory Pending CIPA Claims
Identify any covered Section 638.51 suits or claims in actions commenced within two years before the bill's operative date for potential dismissal motions after the bill becomes operative.
Review Section 631 Exposure
Confirm tracking practices do not create separate interception risk.
Do Not Rely on the Earlier Commercial-Business-Purpose Exemption
This concept appeared in an earlier draft of SB 690 but was not included in the narrowed version described as passed by the Legislature.
Track the Signing Deadline
Monitor for the governor's signature by September 30, 2026.
Prepare for SB 923 and AB 1542
Update deletion and data-sharing practices ahead of these companion bills.
Key Takeaways
- SB 690 removes the private right of action for CIPA pen-register and trap-and-trace claims tied to online tracking.
- The change would apply retroactively to pending claims in actions commenced within two years before the bill's operative date.
- Section 631 interception claims are a separate cause of action from Section 638.51 claims and would remain available to private plaintiffs, including claims based on the same tracking technology.
- The bill awaits the governor's signature, due by September 30, 2026.
For More Information
If you have any questions about this Alert, please contact Michael S. Zullo, J. Colin Knisely, Michelle Hon Donovan, any of the attorneys in our Website Accessibility and Privacy Compliance Litigation Group, any of the attorneys in our Technology, Media and Telecom Industry Group or the attorney in the firm with whom you are regularly in contact.
Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.
[View Source]
