If your business is facing a California Invasion of Privacy Act (CIPA) website tracking claim, you are probably asking three questions:
- Does SB 690 knock out my pending CIPA case?
- Should I still settle a CIPA demand letter or lawsuit now?
- If the pen register claim goes away, what claims are left?
Here is the short answer. If Governor Newsom signs SB 690, most private pen register claims based on website or app tracking should be dismissible once the law takes effect. But the bill does not wipe out every CIPA theory, and it does not make website compliance optional.
SB 690 amends CIPA’s civil remedy statute1, and going forward, a claim against a business under Cal. Penal Code § 638.51 – the pen register and trap-and-trace provision – arising from website or app activity may be brought only by the California Attorney General. And the change reaches backward; it applies to pending claims in cases filed within two years before the law’s operative date.
That matters right now for any business defending claims over analytics tools, advertising pixels, software development kits (SDKs), chat widgets, session replay tools, and similar technology.
The bill has limits, though. It does not touch private claims under section 631, the wiretap provision. It leaves common-law privacy and other statutory claims alone. And it does not change the compliance question every business still has to answer: what is your site collecting, when does collection start, and where does the data go?
Where SB 690 Stands Now
As of August 31, 2026, SB 690 cleared the California Legislature. The Senate concurred in the Assembly’s amendments on August 28, 2026, and the bill is being prepared for the Governor. It is not yet law. The next move is the Governor’s, so businesses with pending CIPA matters should watch closely. If signed, the bill should take effect on the ordinary schedule for California legislation unless the final version says otherwise.
Does SB 690 Knock Out Pending CIPA Cases?
In many cases, yes, but only a specific category.
The target is private lawsuits under section 638.51, which governs pen registers and trap-and-trace devices. In the current litigation wave, plaintiffs argue that ordinary website tools act like digital pen registers because they capture IP addresses, device identifiers, URLs, and similar metadata. SB 690 does not resolve the current court split on whether that theory works. It changes who can sue:
“An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.”
In plain terms, a private plaintiff can no longer bring a section 638.51 website or app claim under CIPA’s civil remedy statute. Only the Attorney General can. For pen-register-only lawsuits, that should be case-dispositive.
What Claims Are Covered?
SB 690 applies where all of these are true:
- The plaintiff is a private party, not the California Attorney General;
- The defendant is a private actor;
- The claim is based on Penal Code section 638.51;
- The conduct occurred on a website, online application, or mobile application;
- The claim is brought under section 637.2, CIPA’s civil remedy provision; and
- The claim is pending in an action filed within the retroactivity window.
These limits matter. SB 690 is not a wholesale repeal of CIPA’s private right of action. It targets the one claim type driving much of the recent website litigation.
How Far Back Does the Retroactivity Reach?
The section 637.2 amendment applies to “any pending claim in an action commenced within two years before the operative date.” If the bill is signed and takes effect January 1, 2027, that reaches actions filed on or after January 1, 2025, which captures much of the recent surge in pen register cases and demand campaigns. Defendants in those cases should check whether their section 638.51 claim falls inside that window.
This is narrower than earlier drafts. Prior versions of SB 690 would have created a broad “commercial business purpose” exemption and made it retroactive to any case pending as of January 1, 2026. The current version does neither. Its retroactivity is limited to the new section 637.2 limitation, and it reaches any action filed within two years before the law’s operative date. That is significant because many CIPA pen register cases and demand campaigns accelerated over the last two years.
What About Demand Letters That Have Not Become Lawsuits?
The retroactivity language applies to a “pending claim in an action” – filed litigation, not demand letters.
But once the bill is operative, private plaintiffs cannot file new covered section 638.51 website or app claims at all. Only the Attorney General can.
That reshapes the settlement math. If you receive a pen-register-only demand, do not treat the legal landscape as fixed – the private claim may disappear before the plaintiff can litigate it. That does not mean ignore every demand. Some add other theories, and some involve sensitive data. But think hard before paying for a claim that may soon lose its private enforcement mechanism.
What Claims Survive SB 690?
The biggest survivor is Cal. Penal Code § 631, the wiretap provision. Plaintiffs use it to argue that third-party trackers intercept the “contents” of communications between a visitor and the website – a different theory from the section 638.51 focus on metadata. SB 690 leaves section 631 untouched.
The mix of claims matters. A complaint pleading only section 638.51 is exposed. A complaint pleading both may lose the pen register count but keep the wiretap count, which still has to be fought on its own terms.
Other claims may survive too, depending on the facts:
- Common-law invasion of privacy;
- California Unfair Competition Law claims;
- Claims over disclosure of sensitive health, financial, or personal information;
- Claims under other state or federal privacy laws; and
- Claims based on recording or chat technology under different theories.
The bottom line is that SB 690 is not a compliance holiday. It is a targeted fix for one kind of private CIPA suit.
Why This Matters for Settlement Strategy
For pen-register-only claims, SB 690 should shift settlement posture right away. Until now, plaintiffs leaned on CIPA’s statutory damages ($5,000 per violation or three times actual damages, whichever is greater, under Cal. Penal Code § 637.2) and argued that every visit or transmission was a separate violation. That math drove settlements even on shaky theories. Take away the private right of action, and those claims lose most of their settlement value.
Every case is different. But for pen-register-only claims, price the bill into any settlement discussion now.
How SB 690 Changed Over Time
SB 690 did not start as a privacy bill. As introduced, it was a technical measure about the Peace Officers’ Memorial. It was later amended into a broad CIPA reform that would have created a “commercial business purpose” exemption across several sections (631, 632, 632.7, 637.2, and 638.50) tied to California Consumer Privacy Act (CCPA) concepts and would have narrowed what counts as a pen register or trap-and-trace device.
That version did not survive. What passed is far narrower: a single limit on private enforcement of section 637.51 website and app claims. The Legislature did not declare that trackers are never pen registers, or create a broad commercial-business-purpose safe harbor. It went after the enforcement vehicle behind the litigation wave.
What Businesses Should Do Now
SB 690 may take one big litigation risk off the table, but it does not end the need for website privacy compliance. Continue the basics: identify tracking technology running on your sites and apps, determine when it activates and what it collects, and document where the data goes. Consent timing, accurate privacy policies, vendor oversight, and data-flow mapping still matter whether or not SB 690 becomes law.
An earlier article, CIPA Website Tracking Lawsuits: Where the Law Stands, Where It’s Going, and What Your Business Should Do Now, walked through those steps. If you have not yet reviewed your tracking practices, start there.
If you are already facing a demand letter or lawsuit, the question is narrower: does SB 690 change the claim’s value, timing, or viability? For pen-register-only claims under section 638.51, often yes. For mixed claims that also plead section 631 or other theories, it is more nuanced.
Takeaways
SB 690 would materially change the defense of many CIPA website tracking cases. If signed, private plaintiffs can no longer pursue section 638.51 pen register and trap-and-trace claims based on website or app activity; only the Attorney General can. That does not end the inquiry. Section 631, common-law privacy, and other claims may remain, so look closely at what a complaint or demand actually alleges before deciding whether to settle, move to dismiss, seek a stay, or wait for the law to take effect.
The real point is this: do not evaluate CIPA claims as you did six months ago. SB 690 could materially reduce the leverage behind a pen-register-only claim or demand, while mixed claims will require a theory-by-theory assessment. And a demand letter may carry far less punch if SB 690 becomes law.
This blog was drafted by Alexandra Samofalova, an attorney in the Spencer Fane Santa Monica, California, office and a member of the firm’s Cyber | Data | Artificial Intelligence | Emerging Technology team. For more information, visit www.spencerfane.com.
—————————————-
1 Cal. Penal Code § 637.2. See S.B. 690, 2025–2026 Reg. Sess. (Cal.)
