California Legislature Passes SB 690, Narrowing Private Rights of Action Under CIPA for Website Pen Register Claims

Background on CIPA Website Tracking Claims

The California Legislature enacted CIPA in 1967 to address growing concerns about surveillance technologies. In its original form, the law both criminalized the interception of telephone communications without the consent of all parties and created a private, civil right of action. Over the years, the law was amended to apply to the interception of electronic communications. In 2015, seeking to harmonize state law with federal law, the Legislature added a prohibition on the use of a “pen register” or “trap and trace” device, i.e., technology that captures dialing, routing, addressing, or signaling information about, respectively, outbound or inbound electronic or wire communications, without a court order. These pen register and trap and trace (PRTT) provisions, located in Penal Code §§ 638.50 and 638.51, saw no civil use until recently, when plaintiffs began arguing that routine marketing and analytics website and mobile app technologies, such as beacons, cookies, pixels, and software development kits (SDKs), amount to wiretapping or eavesdropping under §§ 631 and 632, or function as pen register or trap and trace devices under § 638.51.

Because CIPA permits statutory damages starting at $5,000 per violation without any requirement to show actual harm, and because plaintiffs have argued that violations can be counted on a per-visitor or per-session basis, ordinary website activity has exposed businesses to substantial potential liability. According to SB 690’s sponsors, the number of CIPA website tracking lawsuits grew from roughly 600 to nearly 4,000 since the bill was first introduced in 2025. That figure does not capture the broader universe of pre-suit demand letters that companies of all sizes have received asserting the pen register theory. Nor does that figure appear to capture the many thousands of individual and mass arbitrations that plaintiffs’ firms have filed.

From Broad Reform to a Narrow Fix

When it was originally introduced in March 2025, SB 690 was far more sweeping than the amended version the Legislature passed. The original bill would have created a “commercial business purpose” exemption eliminating private lawsuits under CIPA’s wiretapping and eavesdropping provisions (§§ 631, 632, and 632.7) as well as its PRTT provisions (§§ 638.50 and 638.51). That broader version stalled in the Assembly and did not advance.

The bill was revived this legislative session in a substantially narrowed form. As passed, SB 690 amends only § 637.2, CIPA’s private right of action provision, to provide that solely the California attorney general may bring an action against a private business for an alleged § 638.51 violation arising from conduct on a website, online application, or mobile application. It does not clarify the substantive reach of the trap and trace theory as applied to tracking technologies, leaving that question for the courts. Instead, the Legislature removed private plaintiffs from the enforcement mechanism for this specific theory and vested enforcement exclusively with the attorney general, which has held this authority for over a decade without using this law against tracking technology claims. Instead, the attorney general has addressed the use of tracking technologies in enforcement actions it has brought under the California Consumer Privacy Act.

Claims under §§ 631 and 632 are unaffected and remain available to private plaintiffs. Businesses should expect to continue relying on cookie banners and other consent-management measures to help mitigate litigation risk arising from the expansive reading of CIPA advanced by the plaintiffs’ bar, at least until appellate courts weigh in on the scope of those provisions.

A Parallel Development: The Variety Media Appeal

SB 690 does not resolve the threshold question that has divided trial courts for years: whether CIPA’s PRTT provisions apply to internet communications at all, as opposed to traditional telephone surveillance. That question is now before the California Court of Appeal in Variety Media, LLC v. Superior Court. The underlying lawsuit alleges that tracking technology on Variety’s website collected visitors’ IP addresses and device information and shared that data with third parties, violating the PRTT provisions of CIPA.

On August 21, 2026, the Court of Appeal issued a tentative ruling ahead of oral argument held on August 25, 2026. If adopted as a final ruling, the court would reject Variety’s argument that CIPA’s PRTT provisions are confined to telephonic surveillance, concluding instead that the statute’s definition of a pen register can reach internet communications. At the same time, the tentative ruling would hold that the plaintiff’s specific allegations do not state a valid claim, reasoning that a pen register captures information identifying the destination of an outgoing communication (i.e., who you are contacting), whereas an IP address identifies the source of a communication (i.e., who is visiting your website). On that basis, the tentative ruling would direct the trial court to dismiss the complaint against Variety but allow the plaintiff an opportunity to amend and refile the complaint with stronger allegations.

The ruling remains tentative and could change before the court issues its final opinion, which is due within 90 days of submission following oral argument. If the tentative reasoning holds, it would hand plaintiffs a favorable ruling on the broader question of CIPA’s reach while simultaneously narrowing the specific factual showing needed to plead a viable pen register claim based on IP address collection alone. Notably, even a plaintiff-favorable final opinion on the threshold question would not disturb SB 690’s separate effect. Because SB 690 addresses who may sue under § 638.51 rather than the statute’s substantive scope, its removal of the private right of action and its retroactive reach to qualifying pending claims would still apply regardless of how the Variety Media appeal is ultimately resolved.

Implications and Practical Takeaways for Businesses if the Amendment Takes Effect

For businesses facing a pending § 638.51 lawsuit or demand letter, the retroactivity provision is arguably the most consequential aspect of SB 690. The bill is drafted to reach claims already pending, provided the underlying action commenced within two years of the operative date of January 1, 2027. This would give defendants in pending PRTT matters a basis to seek dismissal once the law takes effect. It would also weaken pending demand letters, since they would be swept into the retroactivity provision if filed before January 1, 2027.

The plaintiffs’ bar may pursue alternative theories. SB 690 eliminates only private § 638.51 claims tied to website and app conduct; it leaves § 631 (wiretapping) and § 632 (recording) untouched. Because PRTT claims are often pleaded alongside wiretapping claims, businesses should expect some plaintiffs’ firms to shift emphasis to §§ 631 and 632 rather than abandon website-tracking theories altogether. That shift may lead to complaints becoming more technically detailed, since § 638.51 claims generally rest on metadata (information about a communication, such as an IP address or device identifier) while § 631 claims require an allegation that a third party received the contents or meaning of a communication, such as the text of a chat message or the substance of a form submission. Plaintiffs’ counsel may also increasingly invoke the federal analog to CIPA, the Electronic Communications Privacy Act (Title I, the Federal Wiretap Act), as well as the Video Privacy Protection Act where tracking technology allegedly ties an identifiable user to video-viewing activity. Both contain provisions that have been pleaded alongside CIPA claims addressing similar underlying conduct.

The broader wave of §§ 631 and 632 litigation may continue. SB 690, while meaningful, may not affect the overall volume of CIPA website-tracking litigation, which has expanded beyond pixels and session replay tools to cover analytics tags, mobile applications, form-data collection, software development kits, chatbots, chat widgets, and third-party scripts. Businesses should continue evaluating their website and app tracking practices, consent management processes, and broader privacy compliance, independent of SB 690’s fate.

What’s Next

SB 690 now sits with Newsom. Given its passage without a single dissenting vote in either chamber, observers generally expect the governor to sign it, though he could also veto it or allow it to become law without his signature. If SB 690 becomes law, the bill would become operative on January 1, 2027. In the meantime, businesses with pending CIPA matters, whether at the demand-letter stage or in active litigation, should consider consulting with counsel regarding how the retroactivity provision may affect their specific circumstances, and should bear in mind that SB 690 would not alter claims arising under § 631 or § 632.