Executive Summary
On August 28, 2026, both houses of the California Legislature passed Senate Bill 690, sending the first significant reform of the California Invasion of Privacy Act (CIPA) in decades to Governor Gavin Newsom’s desk. The bill authorizes only the California Attorney General to bring actions under CIPA’s pen-register and trap-and-trace provision when the claim arises from conduct occurring on an internet website, online application, or mobile application, and applies retroactively to pending claims in actions commenced within two years before the bill’s operative date. The bill is not yet law while it awaits the Governor’s signature or veto. If not vetoed, the measure should take effect on January 1, 2027, with the retroactivity period measured backward from that date.
Background: CIPA and the Litigation Surge
CIPA, Cal. Penal Code §§ 630–638.55, was enacted in 1967 as a Cold War-era wiretapping law designed to prevent the tapping of telephone and telegraph communications. The statute provides a private right of action with statutory damages of $5,000 or three times actual damages, whichever is greater, and a plaintiff need not have suffered actual damages to sue.
Over the last several years, plaintiffs have argued that cookies, pixels, analytics tools, and similar technologies frequently deployed on websites qualify as illegal “pen registers” or “trap and trace devices” under California Penal Code Section 638.51 because they collect IP addresses, device information, or other routing and addressing data. The volume is substantial: legislative testimony indicated that lawsuits alleging violations of California’s pen-register/trap-and-trace law constitute approximately two-thirds of active privacy litigation, and Senator Anna Caballero cited roughly 600 pending Section 638.51 cases when the bill was introduced, growing to more than 4,000 by the time of final passage.
Enactment Status
SB 690 was originally introduced in 2025 with substantially broader provisions. After being amended to a narrower scope, the bill cleared both California legislative houses on August 28, 2026. The bill will now be presented to Governor Newsom. Governor Newsom has not taken a public position on SB 690. Under the California Constitution, the governor may sign the bill, allow it to become effective without signing, or veto it. Based on SB 690 passing at the end of the legislative session, Governor Newsom will have until September 30 to act. If he does not veto the bill, it becomes law automatically.
Principal Provisions
The enrolled bill, as reflected in the official legislative text, does two things:
- Attorney General exclusivity. Where existing law authorizes a person injured by a pen-register or trap-and-trace violation to sue for injunctive relief and monetary damages, the bill instead authorizes only the Attorney General to bring that action if it is alleged to arise from conduct occurring on an internet website, online application, or mobile application.
- Two-year retroactivity. The amendments apply retroactively to any pending claim in an action commenced within two years before the operative date of the legislation. As written, the legislation would become effective January 1, 2027, and would apply to claims filed on or after January 1, 2025.
What the bill does not do. The narrowed version of the bill applies only to pen register or trap-and-trace claims under Section 638.51. It does not eliminate other CIPA theories targeting websites; in particular, it does not amend Section 631, CIPA’s traditional wiretapping provision. Section 631 remains a common basis for Meta Pixel, session-replay, and chatbot lawsuits.
Practical Effects
- Pending 638.51 litigation. For businesses currently defending Section 638.51 claims, the retroactive application appears to support dismissal of private pen-register claims filed on or after January 1, 2025 if the bill is not vetoed.
- Claim migration. Plaintiffs may attempt to reframe some tracking allegations as Section 631 interception claims rather than Section 638.51 pen-register/trap-and-trace claims. That shift may favor defendants, because website operators often have stronger defenses to Section 631(a) claims: consent, that the disclosed information is not “content,” and that communications were not intercepted “in transit.”
- Enforcement posture. The Attorney General retains authority to pursue website-based pen-register violations and seek available remedies. The recent ruling in Variety Media suggests that California courts interpret CIPA’s pen register/trap-and-trace provisions to apply to commercial websites. Businesses should monitor whether the Attorney General decides to follow this interpretation and bring enforcement actions against website operators.
Compliance Considerations and Next Steps
- Monitor gubernatorial action through September 2026. The bill remains subject to veto. Commentators had noted throughout the process that the bill required further approval and gubernatorial sign-off; that contingency persists.
- Address alternative theories. Businesses should not view the bill as a complete resolution of CIPA exposure; it is limited to Section 638.51 claims, and companies may remain exposed under other provisions, particularly Section 631(a), which continues to drive much of the current website privacy litigation. The bill also does not alter obligations under CCPA or other privacy statutes.
- Maintain consent and disclosure hygiene. Businesses should continue reviewing website tracking technologies, monitoring what data trackers transmit, ensuring privacy policies reflect actual practices, and updating cookie-banner language to obtain true consent.
- Assess pending matters now. Companies should continue defending existing claims while evaluating whether pending Section 638.51 actions may be affected by the retroactive legislation.
- Anticipate an interim filing surge. Because the retroactivity window is fixed at two years before the operative date, plaintiffs may accelerate filings under non-covered CIPA theories (e.g., § 631(a)) before year-end.
Conclusion
SB 690 is passed but not enacted. If enacted, it will channel website-based Section 638.51 enforcement exclusively to the Attorney General and retroactively extinguish a substantial docket of private claims, while leaving Section 631 wiretapping litigation, the other principal engine of CIPA suits, fully intact. Businesses should track the Governor’s action, reassess pending pen-register matters, and continue privacy compliance efforts.
