California businesses facing website privacy claims may soon have an important new defense.
The California Legislature has passed Senate Bill 690, which would significantly limit private lawsuits involving certain website tracking claims under the California Invasion of Privacy Act, commonly known as CIPA.
As of the publication of this article, SB 690 has been sent to Governor Gavin Newsom but has not yet become law.
What Would SB 690 Change?
One increasingly common type of CIPA lawsuit alleges that website technology functions as an unlawful “pen register” or “trap and trace device” under Penal Code section 638.51.
SB 690 directly addresses these claims.
Under the legislation, when an alleged violation of section 638.51 arises from conduct occurring on a website, online application, or mobile application, a private plaintiff would no longer be permitted to bring the claim. Enforcement would instead be left to the California Attorney General.
For businesses that have received demand letters or lawsuits based on this particular theory, that could be a significant change.
Could SB 690 Affect Cases That Are Already Pending?
Potentially, yes.
One of the most significant provisions of SB 690 is its retroactivity language. The legislation provides that the change would apply retroactively to certain pending claims in actions commenced within two years before the law becomes operative.
If SB 690 is signed, businesses already defending these claims may therefore need to evaluate whether the new law affects claims currently pending against them.
The answer will depend on the particular claims alleged and the procedural circumstances of the case.
Does SB 690 Eliminate CIPA Website Lawsuits?
No.
This is probably the most important limitation for businesses to understand.
SB 690 addresses private claims involving the pen register and trap and trace provisions of section 638.51 when the alleged conduct occurs on a website or application.
It does not eliminate CIPA itself.
Website privacy lawsuits have also been brought under other provisions of CIPA, including theories involving the alleged interception of communications under Penal Code section 631. Those claims are not eliminated simply because SB 690 becomes law.
For that reason, businesses should look carefully at the specific statutory provisions identified in a demand letter or complaint rather than assuming that SB 690 resolves every website privacy claim.
What Should Businesses Watch Next?
The immediate question is whether Governor Newsom signs SB 690.
If the bill becomes law, businesses with pending CIPA matters should determine whether any section 638.51 claims against them fall within the new limitation on private lawsuits and whether the retroactivity provision applies.
At the same time, businesses should continue to evaluate other CIPA claims separately. SB 690 may substantially change one area of California website privacy litigation, but it does not bring that litigation to an end.
For a broader discussion of CIPA demand letters and website tracking claims, see our related articles, Received a Website Privacy Demand Letter in California? and Can Cookies and Tracking Pixels Violate California or Federal Privacy Law?
Legal Authorities
- California Penal Code §§ 631, 637.2, 638.51
- SB 690 (2025–2026 Reg. Sess.)
Related practice areas: Business and Commercial Litigation · Civil Litigation