This article covers what SB 690 changed and when. If you are already holding a demand letter or defending a filed case, see After SB 690: Reassessing a CIPA Demand or Lawsuit.
California businesses facing website privacy claims will have an important new defense when SB 690 becomes operative on January 1, 2027.
Senate Bill 690 significantly limits private lawsuits involving certain website tracking claims under the California Invasion of Privacy Act, commonly known as CIPA.
Governor Gavin Newsom approved SB 690 on September 30, 2026, and the Secretary of State chaptered it the same day as Chapter 976, Statutes of 2026. The enrolled text contains no urgency clause, and the change becomes operative on January 1, 2027.
What SB 690 Changes
One increasingly common type of CIPA lawsuit alleges that website technology functions as an unlawful “pen register” or “trap and trace device” under Penal Code section 638.51.
SB 690 directly addresses these claims.
Under the legislation, when an alleged violation of section 638.51 arises from conduct occurring on a website, online application, or mobile application, a private plaintiff will no longer be permitted to bring the claim. Enforcement will instead be left to the California Attorney General.
For businesses that have received demand letters or lawsuits based on this particular theory, that could be a significant change.
Could SB 690 Affect Cases That Are Already Pending?
Potentially, yes.
One of the most significant provisions of SB 690 is its retroactivity language. The legislation provides that the change applies retroactively to certain pending claims in actions commenced within two years before the operative date, meaning actions commenced on or after January 1, 2025.
Businesses already defending these claims may therefore need to evaluate whether the new law affects claims currently pending against them.
The answer will depend on the particular claims alleged and the procedural circumstances of the case.
Does SB 690 Eliminate CIPA Website Lawsuits?
No.
This is probably the most important limitation for businesses to understand.
SB 690 addresses private claims involving the pen register and trap and trace provisions of section 638.51 when the alleged conduct occurs on a website or application.
It does not eliminate CIPA itself.
Website privacy lawsuits have also been brought under other provisions of CIPA, including theories involving the alleged interception of communications under Penal Code section 631. Those claims are not eliminated by SB 690.
For that reason, businesses should look carefully at the specific statutory provisions identified in a demand letter or complaint rather than assuming that SB 690 resolves every website privacy claim.
What Should Businesses Do Next?
SB 690 is now law. Businesses with pending CIPA matters should determine whether any section 638.51 claims against them fall within the new limitation on private lawsuits, which becomes operative on January 1, 2027, and whether the retroactivity provision applies to their case.
At the same time, businesses should continue to evaluate other CIPA claims separately. SB 690 substantially changes one area of California website privacy litigation, but it does not bring that litigation to an end.
For a broader discussion of CIPA demand letters and website tracking claims, see our related articles, Received a Website Privacy Demand Letter in California? and Can Cookies and Tracking Pixels Violate California or Federal Privacy Law?
Legal Authorities
- California Penal Code §§ 631, 637.2, 638.51
- SB 690 (Caballero), 2025–2026 Reg. Sess. — approved and chaptered September 30, 2026, Chapter 976, Statutes of 2026; operative January 1, 2027 — official bill text
Related practice areas: Business and Commercial Litigation · Civil Litigation