One Claim Down? California's SB 690 Would End Private Website Pen Register Suits
by: Chloé Nelson and Mark Paulding
On August 28, 2026, the California Legislature passed SB 690, which would strip private plaintiffs of the ability to sue over website and app-based "pen register" claims under the California Invasion of Privacy Act (CIPA). The bill was enrolled on August 31 and now sits with Governor Newsom. If signed, it closes one of the most heavily used avenues of website tracking litigation, and it reaches backward to pending cases. The provisions driving most website privacy claims, however, remain untouched.
How a 1960s Wiretap Statute Became a Website Litigation Engine
CIPA was enacted in 1967 to stop telephone eavesdropping. Over the last several years, plaintiffs' counsel have repurposed it against ordinary web technology under three provisions: Section 631 (wiretapping), Section 632 (recording confidential communications), and Section 638.51 (using a pen register or trap and trace device without a court order). The first two require the contents of a communication, while Section 638.51 requires only that a "device or process" records dialing, routing, addressing, or signaling information, which describes nearly every cookie, pixel, SDK, and analytics tag on the internet. That theory gained traction after Greenley v. Kochava, where the Southern District of California held that software could be a pen register because "a process can take many forms."[1]
The statutory damages did the rest. Section 637.2 allows the greater of $5,000 per violation or treble actual damages, with no requirement that a plaintiff prove any injury. The Assembly Committee on Privacy and Consumer Protection’s analysis of SB 690 called the pen register statute a "poster child for abusive lawsuits," noting that because potential liability "can be staggering, businesses generally settle this litigation hastily." Supporters told the committee that filings grew from roughly 600 in early 2025 to about 4,000 eighteen months later.
What SB 690 Does
SB 690 amends a single provision: Section 637.2, CIPA's remedies provision. It adds that an action against a private actor under Section 638.51 "alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General." It applies retroactively to "any pending claim in an action commenced within two years before the operative date."
Three features of that drafting matter:
It changes who may sue, not what is lawful. The bill leaves Section 638.51 and its definitions untouched. Conduct that may violate the statute before may still violate it, and the Attorney General retains enforcement authority.
The retroactivity clause is narrow. It reaches pending claims in filed actions. Assuming a January 1, 2027, operative date, that captures actions commenced on or after roughly January 1, 2025.
Section 631 is untouched. This is the easiest limitation to miss. Section 631 supplies the interception theory behind many session replay, chat, form-field, and third-party pixel cases. A Section 631 demand gets no relief from SB 690.
Meanwhile, in the Court of Appeal
A pending appellate case may address the underlying question SB 690 leaves open. In Variety Media, LLC v. Superior Court, No. B350578, the Second District is considering whether CIPA's pen register provisions reach website tracking technologies. The matter was argued and submitted in August 2026, and no opinion has issued. Because SB 690 does not amend Section 638.50 or Section 638.51, a published opinion construing those provisions would remain significant, including for the Attorney General's enforcement authority.
What Businesses Should Do Now
Preserve the SB 690 issue, but do not assume it is law. The bill cleared both houses without a no vote, which makes signature likely but not certain. Take stock of where Section 638.51 currently appears in your risk picture. Whether the retroactivity provision reaches a particular matter will depend on its timing and specifics, so the practical step now is to know what you are holding and to follow the bill to signature rather than assuming the outcome.
Look at what your matters actually plead. SB 690 reaches one claim, not necessarily the whole case. Pen register counts are often pleaded alongside Section 631 wiretapping, federal Wiretap Act, VPPA, or common law claims, none of which the bill touches. A complaint resting solely on Section 638.51 may go away. A complaint pleading it as one count among several will not. Before assuming the bill resolves a matter, read the operative complaint or demand letter and identify each theory asserted and the statute behind it.
Do not defer your tracking technology work. Expect plaintiffs to shift toward Section 631 theories built on search queries, chat transcripts, form entries, and health or financial inquiries. Federal ECPA claims, VPPA claims, and other states' wiretap statutes are unaffected. For example, an increasing number of tracking technology cases are being brought under the Florida Security of Communications Act. The fundamentals still decide these cases: which tags fire before consent, what each vendor receives, whether that vendor is contractually limited as a service provider, and whether any of the data captured amounts to the contents of a communication. Preserve the tag manager histories, consent records, and vendor configurations that answer those questions, because site configurations change long before a demand letter arrives.
The Bottom Line
SB 690 is real relief but deliberately partial. It retires one litigation model rather than ending website privacy litigation altogether, and the Assembly committee itself noted the Legislature "may wish to consider a more comprehensive set of solutions" for the rest of CIPA.
[1] 684 F. Supp. 3d 1024 (S.D. Cal. 2023)
Originally published by InfoLawGroup LLP. If you would like to receive regular emails from us, in which we share updates and our take on current legal news, please subscribe to InfoLawGroup’s Insights HERE. This summary does not constitute legal advice.