It’s Up to the Governor: California Legislature Passes SB 690, Which Could Curtail the Wave of Website Privacy Litigation

Key Takeaways

• California has passed SB 690, a bill that could significantly reduce a recent wave of lawsuits targeting common website technologies such as analytics tools, tracking pixels and chat features.
• Businesses across industries have faced costly class actions and settlement pressure based on theories that everyday website technologies violate decades-old privacy laws. While SB 690 could narrow one of the most frequently used litigation pathways, it would not eliminate exposure under other CIPA provisions or broader privacy laws.
• Even if SB 690 becomes law, a proactive privacy compliance strategy remains essential as regulators and plaintiffs continue to scrutinize online data collection practices. Companies should monitor the bill’s status, evaluate pending CIPA litigation and review their website tracking technologies, privacy disclosures, consent mechanisms and data-sharing practices.

On August 28, 2026, SB 690 passed both chambers of the California Legislature and now awaits action by Governor Gavin Newsom. If he signs it, the bill will shake up the litigation landscape under the California Invasion of Privacy Act (“CIPA”) by eliminating the private right of action for § 638.51 claims arising from conduct occurring on websites and applications. In plain terms, this could put the brakes on the recent flood of class actions targeting common website technologies. Even though this bill marks a potential turning point, businesses should not let their guard down—SB 690 would not eliminate potential liability under other provisions of CIPA or other privacy laws.

Background: CIPA and the Recent Litigation Wave

CIPA, codified at Cal. Penal Code § 630 et seq., is one of the nation’s oldest and most expansive privacy statutes. Originally enacted in 1967 to address electronic surveillance and wiretapping in the wake of evolving telecommunications technology, CIPA predates the federal Wiretap Act, enacted as Title III of the Omnibus Crime Control and Safe Streets Act of 1968. CIPA’s pen register and trap and trace device provisions (Cal. Penal Code §§ 638.50–638.52) came later and were originally tied to telephone surveillance—pen registers recorded outgoing call information, while trap and trace devices captured incoming call information.

In recent years, plaintiffs’ attorneys have tried to stretch these provisions to cover modern website technologies. The theory is that common tools such as analytics technologies, tracking pixels, session replay software and chat functionality may operate as pen registers or trap and trace devices because they capture information about website visitors—IP addresses, device identifiers, URLs and other browsing data. This theory has sparked a significant wave of litigation over how CIPA applies to modern website technologies.

Here’s what makes these cases so high stakes: CIPA’s civil-remedies provision allows recovery of $5,000 per violation or three times actual damages, whichever is greater, and actual damages are not a prerequisite to bringing an action under § 637.2. Courts have reached differing conclusions regarding the viability of these theories, but the sheer number of lawsuits and the availability of significant statutory damages have created serious settlement pressure, even in cases where the merits are questionable.

Industries facing these claims include retail, hospitality, healthcare, financial services and media—basically any sector with a significant consumer-facing web presence. Defendants have faced putative class actions challenging everything from analytics and advertising pixels to session replay software and chat features. The result? Substantial defense costs and significant settlement demands, often based on alleged per-violation statutory damages.

Overview of SB 690’s Key Provisions

SB 690, authored by Senator Anna M. Caballero, is a direct response to this litigation surge. If enacted, this legislation changes the enforcement mechanism for certain CIPA pen register and trap and trace claims. Here’s what it does:

Limitation on Private Right of Action

Under SB 690, only the California Attorney General can bring an action against a private actor for a violation of Penal Code § 638.51 arising from conduct on an internet website, online application or mobile application.

The practical impact is significant. If SB 690 becomes law, private plaintiffs could no longer bring § 638.51 claims against businesses based on website or app activity. This change goes straight to the heart of the private litigation driving the recent CIPA lawsuit wave.

Importantly, SB 690 does not amend § 638.51’s underlying prohibition or categorically exempt common website technologies from CIPA. Rather, for the covered claims, it changes who may bring an action under § 637.2.

Retroactive Application to Certain Pending Claims

SB 690 also has an important retroactivity provision worth noting. The amendments to § 637.2 would apply retroactively to any pending claim in an action commenced within two years before the legislation’s operative date.

What does this mean in practice? The bill could immediately affect businesses currently fighting private § 638.51 claims tied to website or app conduct. If your company is involved in pending litigation, now is the time to confirm whether your case falls within the bill’s retroactivity window.

Other CIPA Claims Remain Available

SB 690 is a targeted fix, not a complete overhaul of CIPA. Importantly, the bill does not eliminate potential private claims under other CIPA provisions, including § 631, which covers certain wiretapping and interception activity. And it does not affect claims under other privacy statutes or common law.

So even if SB 690 becomes law, plaintiffs can still pursue other website-tracking theories where they can meet the applicable statutory elements.

Recommended Next Steps

In light of SB 690’s legislative passage, businesses should consider the following:

Monitor the Governor’s Action

SB 690 has passed the California Legislature, but it’s not law yet. Keep an eye on whether Governor Newsom signs it, vetoes it or lets it become law without his signature.

Assess the Impact on Pending Litigation

If your company is currently defending CIPA pen register or trap and trace claims, talk to your attorneys about whether SB 690 might help. The key questions: Do your claims arise under § 638.51 from conduct on an internet website, online application or mobile application? And does your pending case fall within the bill’s retroactivity window?

Review Website Technologies and Privacy Practices

Even if SB 690 becomes law, businesses should continue conducting comprehensive reviews of the tracking and analytics technologies on their websites and apps. Know what information these technologies collect, when they collect it, whether it goes to third parties and whether your disclosures accurately describe what’s happening.

And of course, keep making sure company data-collection practices comply with the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), any industry-specific regulations and other privacy requirements.

Update Privacy Policies and Consent Mechanisms

Businesses should continue reviewing and updating privacy policies, cookie banners, consent mechanisms and related disclosures. Remember: SB 690 would change one specific private cause of action, not broader obligations under California and other applicable privacy laws.

Prepare for Continued CIPA Litigation

SB 690 does not eliminate all CIPA-related website litigation. Most notably, it leaves intact potential private claims under § 631 and other CIPA provisions. Companies should continue evaluating their potential exposure arising from website technologies and third-party integrations under the other parts of CIPA that remain in play.

Benesch’s Data Privacy & Cybersecurity and Retail & E-Commerce teams help businesses navigate the evolving privacy and consumer protection landscape, including website tracking technologies, CIPA litigation, digital marketing practices and regulatory compliance. If you have questions about SB 690 or your organization’s privacy risk profile, we’re here to help.