Governor Newsom Signs SB 690: California Eliminates Private Right of Action for Website Pen Register and Trap and Trace Claims Under CIPA

Key Takeaways

• California businesses facing website-tracking litigation gained meaningful relief with SB 690. By eliminating the private right of action for online pen register and trap and trace claims—and applying the change retroactively to many pending cases—the law may significantly alter defense and settlement strategies.
• SB 690 does not eliminate broader privacy risk. Plaintiffs are expected to continue pursuing claims under other CIPA provisions, including Section 631, as well as federal and state privacy laws, while regulators retain authority to scrutinize website-tracking practices.
• Companies should continue auditing cookies, pixels, analytics tools and related technologies, while maintaining clear disclosures and consent mechanisms. With additional CIPA reforms potentially on the horizon, organizations should monitor legislative developments and reassess compliance programs accordingly.

As Benesch previewed in September, on September 30, 2026, California Governor Gavin Newsom signed Senate Bill 690 into law, amending the California Invasion of Privacy Act (CIPA) to eliminate the private right of action under California Penal Code Section 638.51 for activity occurring on an internet website or a mobile or online application. Section 638.51, which governs pen register and trap and trace devices, has been one of the most heavily used theories in the wave of website-tracking class actions and demand letters targeting businesses that deploy cookies, pixels, and similar technologies. The amendment offers meaningful relief, but it does not end CIPA exposure.

Background

In recent years, plaintiffs have filed a large volume of putative class actions alleging that common website tracking tools, including cookies and pixels, function as “pen registers” or “trap and trace devices” under Section 638.51 because they collect information about users’ interactions with websites without consent or a court order. Courts have reached inconsistent conclusions on whether these theories are viable, leaving businesses with little predictability. Because CIPA provides statutory damages of $5,000 per violation under Penal Code Section 637.2, these claims have generated significant litigation and settlement pressure, often in the form of pre-suit demand letters.

What SB 690 Does

• Eliminates the private right of action for online pen-register/trap-and-trace claims. SB 690 eliminates the private right of action under Section 638.51 for any activity occurring on an internet website or a mobile or online application.
• Effective date. The amendments take effect January 1, 2027.
• Retroactive application. The amendments apply retroactively to Section 638.51 lawsuits filed on or after January 1, 2025, despite an earlier version removing the retroactivity provision. As a result, pending claims of this type may be subject to demurrer, a motion to dismiss or a motion for judgment on the pleadings.

What SB 690 Does Not Do

Businesses should not view SB 690 as a blanket exemption from privacy liability. The new law does not:

• Eliminate claims under CIPA Section 631, including claims alleging unlawful wiretapping, which plaintiffs frequently assert alongside or in place of Section 638.51 theories.
• Eliminate enforcement by the California Attorney General or the California Privacy Protection Agency (CPPA); it remains to be seen how aggressively these agencies will pursue website-tracking practices.
• Create a general “commercial business purpose” exemption, which many businesses had advocated for during the legislative process.
• Prevent plaintiffs’ attorneys from pursuing other theories under California or federal privacy and digital laws, including the federal Electronic Communications Privacy Act (ECPA).

The Governor’s Signing Statement

In a rare signing statement, Governor Newsom praised the bill but cautioned that “additional work in this area is needed, as CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants. I urge the Legislature to take this on next year to ensure a fair balance between protecting private information and preventing rapacious litigation.” The statement signals that further legislative relief from CIPA litigation, potentially including Section 631, may be on the horizon in the 2027 session.

Key Insights and Next Steps

• Reassess pending litigation. Companies defending Section 638.51 claims based on website or app activity filed on or after January 1, 2025 should evaluate a demurrer, motion to dismiss, or motion for judgment on the pleadings—and should factor SB 690 into settlement and resolution strategy.
• Respond to demand letters strategically. Responses to pre-suit demands premised on Section 638.51 should account for the elimination of the private right of action, while recognizing that demands are likely to shift toward Section 631 and other theories.
• Keep auditing tracking technologies. Continue to regularly review cookies, pixels, analytics tools, advertising technologies, and other tracking mechanisms, particularly as marketing and technology stacks evolve.
• Maintain disclosures and consent tools. Privacy disclosures and, where appropriate, consent mechanisms remain important components of a comprehensive compliance strategy, and remain relevant to Section 631, regulatory, and other claims.
• Monitor further reform. Given the Governor’s call for further reform, businesses should track CIPA legislation in the coming session.

Benesch’s Retail & E-Commerce team regularly defends businesses against CIPA and other website-tracking claims and advises on privacy compliance. If you have questions about SB 690 or its impact on pending matters, please contact our team.