We handle all your technical problems so you can focus on growing your business.
The California State Capitol in Sacramento, with its dome and columns framed by trees.
Daily NewsTechnology, in a few minutes.

California Narrows One Kind of Website-Tracking Lawsuit. Here Is What SB 690 Does and Does Not Change.

Governor Newsom signed SB 690, which will end private lawsuits under one section of California's privacy law for tracking on websites and apps. Other claims remain, so small businesses with ad pixels and analytics still have work to do.

Kevin R.

5 min read

Updated

Photo by Ben Moreland on Unsplash

The takeaway

If you hold a CIPA demand letter or lawsuit, have your attorney assess how SB 690 applies. Either way, get a list of every outside script on your website and remove the ones nobody uses.

California is set to remove one common source of website-tracking lawsuits against small businesses on January 1, 2027. On Wednesday, September 30, 2026, Governor Gavin Newsom signed Senate Bill 690, which “eliminates the private right of action” under the California Invasion of Privacy Act (CIPA) for pen register and trap-and-trace violations “arising from conduct occurring on an internet website, online application, or mobile application.”

In his signing message, Newsom said the measure addresses “the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses.” Once it takes effect, it ends that one type of private claim only — other website-privacy claims remain, and nothing about what your site’s scripts collect has changed.

What the bill changes

CIPA is a decades-old California law, written for telephone surveillance. Two terms in it come from that era. They are defined in Penal Code section 638.50 and used in section 638.51:

A pen register traditionally records the numbers dialed out from a phone line — which numbers were called. A trap-and-trace device does the reverse. It records the numbers of calls coming in to a line. Neither records the conversation itself. They capture the addressing information around a call, not its contents. Today’s definitions also cover dialing, routing, addressing and signaling information from electronic communications, not just telephone numbers.

In recent years, plaintiffs have argued that website tools work the same way. On that theory, an analytics tool or advertising pixel — such as the scripts that report a visit to Google or Meta — is a pen register or trap-and-trace device, because it collects and sends off identifying information about the visitor, such as their IP address and device or browser details.

Businesses have disputed that reading, but it has been used to support demand letters and lawsuits under section 638.51, which generally bars using a pen register or trap-and-trace device without a court order, subject to specified exceptions.

SB 690 does not settle whether a website tracker really is one of those devices. Once it takes effect, it removes the private lawsuit under section 637.2 over that question against a private actor for conduct on a website, online application, or mobile application. Only the Attorney General may bring a civil action under section 637.2 for those covered section 638.51 claims.

According to the bill text published by the Legislature:

  • For section 638.51 claims against a private actor alleged to arise from conduct on a website or app, only the Attorney General may bring a civil action under Penal Code section 637.2. Private plaintiffs can’t.
  • The change also applies to pending claims in lawsuits filed within two years before the law becomes operative.

The bill has no separate operative date or urgency clause. Under the default rule in the California Constitution, a bill enacted in a regular session generally takes effect on January 1 following a 90-day period from enactment. For SB 690, that would be January 1, 2027. How that date and the pending-claims language apply to a specific case is a question for your attorney.

What it does not change

The change is limited to section 638.51 claims. It doesn’t remove claims under CIPA’s other provisions, such as section 631 (wiretapping) or section 632 (recording confidential communications), which plaintiffs also cite against website chat and session-replay tools. The governor’s message says “additional work in this area is needed, as CIPA contains other decades-old statutes that are also susceptible to abuse,” and urges the Legislature to take that up next year.

It also isn’t a general exemption from privacy rules. Other California and federal privacy requirements still apply to the data your website collects.

Open questions

Whether a particular tracking tool violates a remaining CIPA provision, and how SB 690 affects a demand letter or lawsuit already in progress, depends on the facts and on how courts read the new language. The bill text doesn’t settle an individual dispute.

What a small business should do

If you’ve received a CIPA demand letter or lawsuit: Don’t assume SB 690 makes it go away. Have your attorney check which sections the letter cites, any response deadlines, and how the new law applies.

Either way, take inventory of your website. Ask your web developer or marketing agency for a list of every outside script on your site: analytics, advertising pixels, chat widgets, session-replay tools and embedded forms. Remove the ones nobody uses.

Then check whether your cookie banner actually holds the rest back until a visitor agrees, rather than just displaying a notice. Your attorney can tell you what notice or consent your site needs.

If you’d like help building that script inventory, NightSquawk Tech offers a free assessment.

This article is general information, not legal advice. For a specific letter or lawsuit, talk to a California attorney who handles privacy litigation.

Sources

Updated October 13, 2026: Expanded the pen-register and trap-and-trace explanation, revised paragraph flow, and clarified the January 1, 2027 effective date and the scope of the Attorney General’s civil-action authority.

Editorial note: This article was drafted with AI assistance from the Governor of California’s signing message and legislative update and the California Legislature’s bill text and constitutional provisions, linked above. It is general information, not legal advice.