What California’s SB 690 Means for Website Tracking (and What It Doesn’t)

When Governor Newsom signed SB 690 on September 30, plenty of people read it as the official ending of the infamous CIPA demand letters plaguing privacy and legal teams. It isn’t. SB 690 takes only one type of CIPA claim, the pen-register claim, away from private plaintiffs. The California Attorney General can still pursue pen-register CIPA claims. It also leaves the wiretapping claim, which targets what visitors type and share, fully intact.

This post covers what changed, what didn’t, and what to do about your website now.

The short version

• Private pen-register suits end January 1, 2027, including many already pending. Until then, they’re still live.
• CIPA’s wiretapping provisions, other states’ wiretap laws, and the federal Wiretap Act are untouched.
• The evidence that matters shifts from which vendors fire on your site to what data those vendors receive.
• You have about nine weeks before the law takes effect. Use them to check content, consent, and inventory, in that order.

Why a 1967 law is hitting websites

The California Invasion of Privacy Act (commonly called CIPA) was written in 1967 and originally focused on telegraphs and phone tapping. Today, plaintiffs have used it to target pixels, cookies, analytics tags, chat widgets, and session replays. These plaintiffs allege that website tracking pixels and similar tools violate CIPA by sending visitor data to unauthorized third parties without their consent. Plaintiffs have brought these claims against companies outside California too, when the site had California visitors.

With statutory damages of $5,000 per violation, CIPA has become an engine for demand letters and class actions against companies of every size. Plaintiffs argue that each visitor, or even each session, counts as a separate violation, so the numbers climb fast.

The claims generally fall under two main theories:

• § 638.51: Pen register or trap and trace: A pen register was originally a device that recorded the numbers a phone dialed. Plaintiffs argue that website trackers collecting IP addresses and device identifiers work the same way. These claims have been easier to bring because plaintiffs only have to show identifiers were collected, not that anyone captured the contents of a communication.
• § 631: Wiretapping: These claims allege that a third party intercepted the contents of a communication without consent, such as form entries, chat messages, and, in some cases, detailed browsing activity.

What SB 690 actually does

What it is (a brief history)

SB 690 was first introduced in February of 2025 with the goal of slowing down the frenzied pace of CIPA lawsuits being brought forward. A broad “commercial business purpose” exemption was added in March of 2025  covering both wiretapping and pen-register claims. The Senate passed it 35-0 that June, but it then stalled in the Assembly. In July 2026, lawmakers rewrote SB 690 to cover pen-register claims only. It passed the Legislature that August, reached Governor Newsom on September 4, and he signed it on September 30 as Chapter 976, Statutes of 2026.

What the Law Does

SB 690 ends private lawsuits under § 638.51 (pen register and trap and trace) for websites and apps. Starting January 1, 2027, only the California Attorney General can bring those claims. The change also reaches back to pending pen-register claims in lawsuits filed within the two years before that date, so roughly any case filed since January 1, 2025. Courts will decide how this applies to individual cases.

What That Means Between Now and January 1

Private pen-register claims haven’t disappeared yet. Plaintiffs can still send demand letters and file suits, and a case that settles before January 1 shouldn’t be reopened by the new law. A pen-register suit that’s still open on January 1 may be subject to dismissal under the new law, so expect some plaintiffs to push for quick settlements before then.

What SB 690 doesn’t do

It doesn’t change whether tracking is lawful.

There’s no safe harbor, no credit for CCPA compliance, and it doesn’t set any new consent standard. It only takes away one way for private plaintiffs to sue.

§ 631 wiretapping is untouched.

§ 631 carries the same $5,000-per-violation damages, and it targets the contents of communications. That’s what chat widgets, session replay, and pixels on forms can capture, so claims involving these tools can still be brought.

Other claims stand and may ramp up:

§§ 632 and 632.7, federal ECPA, VPPA (which covers sharing video-viewing data), CDAFA (California’s computer data access law), and common-law privacy claims are all unaffected by SB 690. Many expect that rather than ending the CIPA craze, SB 690 will simply cause plaintiffs to pivot to other, similar privacy laws or even to states with similar regulations. As law firm Goodwin put it, “The website tracking wave will likely shrink, but it will shift rather than stop.”

Where the litigation goes next

Refiling as § 631 and § 632 claims: 

Law firms tracking these cases, including Goodwin, expect plaintiffs to shift toward CIPA’s other provisions, §§ 631 and 632, and recast pen-register allegations as wiretapping claims. Those claims take more work to plead, so there may be fewer of them, but each one carries higher stakes. Chat features are already a growing target: Jones Walker reports that chatbot wiretap filings have surged in recent years, with 2025 alone generating more new cases than the prior several years combined.

Other states: SB 690 doesn’t affect other states’ wiretap laws, and similar website-tracking suits are already being filed under them, including in Florida and Pennsylvania.

Federal: Federal Wiretap Act (ECPA) claims carry statutory damages of $10,000 or $100 per day of violation, whichever is greater.

More reform? Mixed signals. Newsom said “additional work in this area is needed” and asked the Legislature to revisit CIPA in 2027 (PPC Land). But lawmakers already dropped the broader § 631 and § 632 changes in July, so quick relief looks unlikely.

The evidence shifts, not the work. The pen-register theory mostly asked which vendors were on the site. A § 631 claim asks harder questions, and each one points to something you can check on your own site:

Your own servers receiving form data is expected. The legal risk is a third-party tool receiving it at the same time.

What to do now: a web governance checklist

SB 690 is no reason to relax your controls. Teams that ease off now could walk straight into the § 631 claim that remains. Here’s where to focus instead:

1. Know every tag on every page. Keep a full inventory of the pixels, analytics, chat, and session-replay tools on your site, and flag anything unapproved. Watch for piggybacking too, where an approved vendor loads other scripts you never approved.
2. Test your site the way plaintiffs do. Many demand letters start with a firm scanning a site for tracking tags. Test your site the same way: as a California visitor who hasn’t clicked anything on the consent banner. Run that same test on a schedule and see which risky tags fire before anyone opts in. ObservePoint’s CIPA Compliance Framework is built around this check, and around the wiretapping provisions SB 690 left in place.
3. Prove your consent setup works in practice. A consent banner isn’t a consent program (here’s why). Confirm that tags stay blocked until a visitor opts in, and check what happens when they click “Reject All” or send a Global Privacy Control (GPC) signal.  Consent validation turns that into a repeatable test instead of a one-time spot check.
4. Check what data leaves your site. An inventory answered the pen-register question, but § 631 is about content. Check whether form entries, search terms, emails, or revealing URLs reach third parties, especially on chat, search, forms, and checkout. 
5. Keep a dated evidence trail. If a demand letter arrives, counsel will want a record of what fired on your site and when. Scheduled audits with a saved history create that record, ready to share with counsel.
6. Monitor continuously. Sites change every week. A clean scan in January doesn’t tell you what’s firing in June, so set alerts that flag new or unapproved tags as soon as they appear.

What SB 690 Means for Your Website: In Short

SB 690 takes one claim out of private plaintiffs’ hands, and only in California. Everything a plaintiff would need for a wiretapping or other privacy claim still lives on your website: which tags run, what they send, and whether they wait for consent. So use the time before January 1 to check. Start with our CIPA Compliance Framework to see how your site holds up against the claims that remain.

Want to see what’s firing on your site right now? Run a free scan with ObservePoint today.