This article is for businesses already holding a CIPA demand letter or defending a filed case. For what SB 690 changed and when, start with California SB 690 and CIPA Website Claims.
California businesses have spent the last several years receiving demand letters and lawsuits claiming that ordinary website technologies violate the California Invasion of Privacy Act, commonly called CIPA.
On September 30, 2026, Governor Gavin Newsom signed Senate Bill 690. The new law materially changes one of the theories used in those cases, but it does not eliminate CIPA website litigation.
That distinction matters.
A business that receives a CIPA demand letter should not assume that SB 690 makes the letter irrelevant. The first question is what statute the claimant is actually relying on.
The Pen Register Theory
One wave of CIPA litigation has relied on Penal Code section 638.51, California’s pen register and trap-and-trace provision.
Plaintiffs have argued that certain website technologies can function as prohibited pen registers or trap-and-trace devices because they collect information associated with internet communications. These cases have targeted technologies such as pixels, cookies, analytics tools, and other tracking mechanisms.
SB 690 changes who may bring a civil action based on that theory when the alleged conduct occurs on an internet website, online application, or mobile application.
Under the amendment to Penal Code section 637.2, an action against a private actor for a section 638.51 violation arising from that type of online conduct may be brought only by the California Attorney General.
In practical terms, private plaintiffs lose the ability to pursue that particular website or application-based section 638.51 claim once the new law is operative.
SB 690 Does Not Make Website Tracking Legal
The new law should not be read as a general approval of website tracking technology.
SB 690 does not repeal section 638.51. It does not declare cookies, pixels, analytics tools, or similar technologies lawful. Instead, it changes the private civil remedy for one category of section 638.51 claims.
A company should not remove its consent tools, privacy disclosures, or data-governance procedures simply because SB 690 was signed. Other privacy laws and other provisions of CIPA may still apply.
Section 631 Claims Remain
Many CIPA website cases do not rely only on section 638.51.
Plaintiffs also frequently invoke Penal Code section 631, which addresses wiretapping and interception of communications. A typical claim may allege that a third-party technology provider received or intercepted the contents of a visitor’s communications with a website without proper consent.
SB 690 does not eliminate the private right of action for section 631 claims.
That means two demand letters that look similar may now present very different legal problems.
If a claimant relies only on a website-based section 638.51 pen register theory, SB 690 may substantially affect the claim. If the claimant also alleges a section 631 interception theory, that part of the dispute does not disappear merely because SB 690 became law.
Businesses and counsel therefore need to read the actual allegations rather than treating every CIPA demand as the same case.
What Happens to Pending Lawsuits?
SB 690 also contains a significant retroactivity provision.
The new limitation applies retroactively to a pending section 638.51 claim in an action commenced within two years before the law’s operative date.
The law becomes operative on January 1, 2027. As written, the retroactivity provision therefore reaches qualifying pending claims in actions commenced within the two-year period before that date.
This may matter immediately to businesses already defending website-based pen register claims.
A defendant with a pending section 638.51 claim should examine when the action was commenced, whether the claim arises from conduct on a website, online application, or mobile application, and whether the new limitation applies to the particular claim.
Courts may still have to resolve disputes concerning how the retroactivity provision operates in particular pending cases. Businesses should not assume that a pending lawsuit automatically disappears without analyzing the pleadings and procedural posture.
What About a Demand Letter That Has Not Become a Lawsuit?
A demand letter is different from a pending action.
SB 690’s retroactivity language refers to a pending claim in an action. A prelitigation demand letter is not itself a filed action.
But the new law can still affect the practical value of the threatened claim.
If the demand asserts only a private website-based section 638.51 theory, the claimant’s ability to pursue that theory after the law becomes operative is materially different from what it was before SB 690.
If the letter also asserts section 631 or another surviving theory, the analysis changes.
This is one reason businesses should resist the temptation to respond to a CIPA demand based only on the amount requested or the name of the tracking technology involved. The statutory basis matters.
The Technology Still Matters Too
Even after SB 690, a business should understand what its website is actually doing.
A website may use several different third-party technologies at once. One tool may provide analytics. Another may support advertising. A chat service may process communications entered by visitors. Session-replay software may record aspects of a visitor’s interaction with a page.
The legal analysis can depend on what information is transmitted, when transmission occurs, which third party receives it, what that party does with the information, and what disclosures or consent mechanisms the website provides.
SB 690 narrows one path to private litigation. It does not eliminate the need to understand the underlying data flow.
Businesses That Already Received CIPA Claims Should Reassess Them
For businesses already facing a demand or lawsuit, SB 690 creates a reason to revisit the claim rather than simply continue evaluating it under the law as it existed when the demand arrived.
The review should begin with the causes of action actually asserted.
- Is there a section 638.51 claim?
- Is there also a section 631 claim?
- Has a lawsuit already been filed, and when was the action commenced?
- What technology is involved?
- What information was allegedly transmitted?
Those questions can now affect both litigation strategy and settlement analysis.
A demand that once relied heavily on a pen register theory may have a different posture after SB 690. A case built around a separate interception theory may remain substantially intact.
California Website Privacy Litigation Is Not Over
SB 690 is a meaningful change, particularly for businesses targeted by private pen register and trap-and-trace claims involving websites and applications.
It is not the end of California website privacy litigation.
CIPA’s other provisions remain, along with the California Consumer Privacy Act and other state and federal privacy rules that may apply depending on the business and the technology involved.
For businesses, the practical lesson is narrower.
If you receive a CIPA demand letter or are already defending a website-tracking lawsuit, identify the precise statutory theory before deciding what SB 690 means for the claim.
A law that removes one cause of action can materially change a case. It does not necessarily eliminate the case.
Legal Authorities
- SB 690 (Caballero), 2025–2026 Reg. Sess. — approved and chaptered September 30, 2026, Chapter 976, Statutes of 2026; operative January 1, 2027 — official bill text
- California Penal Code § 637.2 (as amended by SB 690) — official text
- California Penal Code § 638.51 — official text
- California Penal Code § 631 — official text
Related practice areas: Civil Litigation · Business and Commercial Litigation