SB 690: what California's CIPA change means for your website

SB 690 is California law now. Governor Newsom signed it on 30 September 2026 and it takes effect on 1 January 2027. It changes one part of the California Invasion of Privacy Act (CIPA): from that date, only the Attorney General can sue a website or app under CIPA’s pen register and trap and trace section. Private plaintiffs can’t. The bill leaves the wiretap section alone, and that’s the one aimed at pixels and scripts that pick up what visitors type. So the demand letters won’t all stop. What your trackers send, and who gets it, still matters.

I’ve read the bill as it was signed, not someone’s summary of it. Below: what changed and why, which CIPA claims are still open, what the text says about cases already filed, what a demand letter might look like next year, and what to look at on your own site. For the court history behind all this, the CIPA lawsuit case file goes through the rulings. And if you’re here because a letter just arrived, the demand letter section is further down.

What SB 690 changes

Senate Bill 690, from Senator Caballero, is Chapter 976, Statutes of 2026. The Governor approved it on 30 September 2026, and it was filed with the Secretary of State the same day. It amends one section, Penal Code 637.2. That’s the part of CIPA that lets an injured person sue.

The new subdivision covers a claim against a private actor under section 638.51 that’s alleged to arise from conduct occurring on an internet website, online application, or mobile application. Such a claim may be brought under this section only by the Attorney General.

The bill doesn’t print a start date. California’s constitution supplies one: a statute from a regular session goes into effect on 1 January after a 90-day period from its enactment. Signed on 30 September, that’s 1 January 2027, the date the Assembly committee’s analysis gives as well.

The rest of 637.2 stays as it was. Anyone suing under the other CIPA sections can still ask for the greater of $5,000 per violation or three times their actual damages, and they still don’t have to show any actual damage to bring the case. Section 638.51 isn’t touched either. Using a pen register without a court order is still a crime under it, and the Attorney General keeps the civil claim.

What a pen register has to do with a website

CIPA defines a pen register as a device or process that records or decodes dialing, routing, addressing, or signaling information, but not the contents of a communication. A trap and trace device does the same job for incoming signals, the ones that identify where a communication came from. California added these rules in 2015. The committee’s analysis says the legislative history was about guiding police and courts on pen register orders, and it never got to websites.

Plaintiffs’ lawyers argued that loading a web page counts as an outgoing communication, and that a script passing your visitors’ IP addresses to another company is a “process” recording “addressing” information. In Shah v. Fandom, the plaintiffs alleged that gamespot.com made browsers load trackers from three ad-tech companies, and those trackers sent visitors’ IP addresses back to them on every visit. In October 2024 a federal judge let the case go ahead. A user who shares an IP address with the site, the order says, does not necessarily consent to disclose their IP address to the third parties operating the Trackers. That was the pleading stage. The court took the allegations as true without deciding whether they were.

Why California changed it

The Governor’s signing message puts it plainly: This measure addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses. He means businesses that unwittingly install software on their websites that at times have tracked and shared the information of visitors to the site.

The Assembly Privacy and Consumer Protection Committee went further. Its analysis calls the pen register statute a poster child for abusive lawsuits and the main route for website-tracking claims under CIPA. It also found the courts split on whether the statute reaches online communications at all: Federal courts almost uniformly conclude that it does; state courts mostly conclude the opposite.

The bill’s sponsor, the Alliance for Legal Fairness, told the committee that about 600 suits had been filed against California businesses when its campaign began in early 2025, that the number had reached 4,000 eighteen months later, and that tens of thousands more businesses had received demand letters. Those are the sponsor’s figures, quoted in the analysis. Nobody independent counted them.

The Governor didn’t call the job done, either. He wrote that CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants, and he urged the Legislature to take them on next year. He didn’t say which ones.

How the bill got narrower

The SB 690 that passed the Senate in June 2025 went a lot further. It exempted any “commercial business purpose”, as the CCPA defines it, from civil and criminal liability under CIPA’s wiretap, eavesdropping, phone-recording and pen register sections. The Assembly committee said it met a real problem with too blunt of a solution. At the committee hearing on 1 July 2026 the author agreed to cut the bill back to the pen register section and to websites and apps. Some search results still show the old text, so check the version date on anything you read about SB 690.

Date	Step
21 February 2025	Introduced in the Senate
3 June 2025	Passed the Senate, 35 to 0, with the broad commercial-purpose exemption
1 July 2026	Assembly Privacy committee: do pass as amended, 14 to 0, exemption replaced by the pen register change
28 August 2026	Passed the Assembly, 66 to 0; the Senate agreed to the amendments, 39 to 0
30 September 2026	Signed by the Governor, Chapter 976
1 January 2027	Takes effect

The dates and votes are from the bill history.

CIPA claims SB 690 leaves in place

Claim	Who can bring it from 1 January 2027
Pen register or trap and trace (638.51), conduct on a website, online app or mobile app	Only the Attorney General
Pen register or trap and trace, any other conduct	Anyone injured, as before
Wiretapping (631)	Anyone injured, as before
Eavesdropping on or recording a confidential communication (632)	Anyone injured, as before
Intercepting and recording mobile or cordless phone calls (632.7)	Anyone injured, as before

Section 631 is the old wiretap law. It reaches anyone who, willfully and without the consent of all parties to the communication, reads or tries to learn the contents of a message while it’s in transit, and anyone who helps them do it. Section 632 covers eavesdropping on or recording a confidential communication. Section 632.7 covers mobile and cordless phone calls.

The committee says 631 has long been understood to apply online. Its analysis sums up the arguments plaintiffs make with it: that pixels act as wiretaps, and that session replay scripts, which record scrolling and typing, intercept the conversation between a visitor and a site. Some courts have agreed that such scripts may fall under wiretap laws. In the Meta Pixel healthcare litigation, log-in buttons and page addresses containing words like “colitis” were treated as content. On 631 the committee thought reform appears warranted, albeit not as urgent. SB 690 didn’t touch it.

The money doesn’t change. Section 637.2 still offers the greater of $5,000 per violation or three times actual damages to anyone who can bring a claim, with no need to show harm.

Then there’s the CCPA, a separate law with its own duties, which SB 690 doesn’t touch. A business that sells or shares personal information has to tell people they can opt out and put a “Do Not Sell or Share My Personal Information” link on its homepage. “Sharing” means passing personal information to a third party for cross-context behavioral advertising. If an ad pixel on your site sends visitor data to an ad platform for targeting on other sites, that can be sharing. The Attorney General says the Global Privacy Control signal must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information (the AG’s CCPA page). Individuals can’t sue under the CCPA for this; the Attorney General and the Privacy Agency enforce it. The CCPA checklist has the full list.

Is SB 690 retroactive?

Yes, for some cases. The new subdivision (d)(2) of 637.2 says the SB 690 amendments apply retroactively to any pending claim in an action commenced within two years before the operative date of the legislation. With an operative date of 1 January 2027, that reaches pen register suits against websites and apps filed from the start of 2025 and still pending.

A few things the clause leaves open. It talks about pending claims in actions that have been commenced, and a demand letter isn’t an action, so letters sit outside it. A suit filed before the two-year window isn’t covered. The statute says nothing about judgments; the committee’s analysis does: The amendments would not affect any case for which a final judgment has been entered. That’s the committee’s reading, though, not the law’s own words.

And the committee added the severability clause in view of possible constitutional challenges to the retroactivity provisions. So the people who wrote it thought the retroactive part might end up in court. How it applies to any one case is for the judge hearing it.

What a CIPA demand letter looks like after 1 January 2027

The letters SB 690 was aimed at, going by the Governor and the committee, went to businesses over software on their websites that passed visitor information on to other companies. From 1 January 2027, a private letter built only on the pen register theory, about your website or app, points at a claim its sender can’t bring. A letter built on section 631, 632 or 632.7 points at claims that are still open, with the same damages.

So what will the letters point at? The court records and the committee’s analysis describe one shape: a third-party script loads with the page and sends something to another company without the visitor agreeing to it. Under the pen register theory, that something was the IP address. Under the wiretap theory, it’s content: what someone types into a form or a chat box, the words they search for, page addresses that say what they were reading.

If one lands on your desk, take it to a lawyer who handles California privacy claims before you reply. Nothing in this post is advice on a letter you’ve received.

What to check on your site now

Most of this is what the CCPA already asks.

1. List every third party your pages load: ad pixels, analytics, session replay, chat, embedded video, booking and review widgets. Next to each, write what it receives. The page address, form fields, chat messages, the IP address.
2. Mark the ones that get content. Session replay and chat see what people type, and so does a pixel set to read form fields. A 631 claim is about tools like these.
3. Name them in your privacy policy, by company or by category, with what each one gets. The privacy policy example shows the shape.
4. If you sell or share under the CCPA, put the homepage link in, make sure the opt-out works, and treat a GPC signal as a request.
5. Hold trackers until the visitor chooses, where your consent setup lets you. The US cookie consent guide covers when a banner is worth having, and the tracking pixel guide shows how to see what a pixel sends.

Check your own site from a laptop

You need a browser and ten minutes. No tools to install.

1. Open your home page in a private window. Before you touch the banner, open the browser’s developer tools, go to the Network tab and reload.
2. Look down the domain column. Write down every domain that isn’t yours. That’s your list of third parties.
3. Open a page with a form. Type a test name into one field without sending it. Watch whether new requests go out while you type, and where to.
4. If you have a chat window, open it and note which domain it’s served from.
5. Open your privacy policy and search it for each company on your list.
6. On your phone, scroll to the footer of your home page and look for the “Do Not Sell or Share” link. Tap it and see where it takes you.

Peeky reads your public pages for three of the US checks and writes down what he saw. US-04 is about whether your privacy policy owns up to the selling and sharing your pages do. US-03 is about honouring Global Privacy Control. US-12 is about ad trackers on pages about health. They’re three of the more than ten checks Peeky reads for each jurisdiction, such as the EU, UK and US.

Questions people ask

What is SB 690 in California?

It's a California law signed on 30 September 2026, Chapter 976 of that year. From 1 January 2027, only the Attorney General can sue a website, online app or mobile app under the pen register and trap and trace section of the California Invasion of Privacy Act. The chaptered text amends one section, Penal Code 637.2, and leaves CIPA's wiretap and eavesdropping sections as they were.

Is SB 690 retroactive?

Partly. The chaptered text applies the change to any pending claim in a case filed within two years before the law's operative date, 1 January 2027. So pen register suits against websites and apps filed since the start of 2025, and still open, are covered. The text says nothing about demand letters, and the Assembly committee says cases that already have a final judgment aren't affected.

Does SB 690 stop CIPA lawsuits over tracking pixels?

Not all of them. It ends private suits under the pen register section for websites and apps. Wiretap claims under Penal Code 631, the theory used against pixels and scripts that capture what people type, stay open to private plaintiffs. The damages stay too: $5,000 per violation or three times actual damages, whichever is greater. The Governor has asked the Legislature to look at CIPA's other old sections next year.

What is the California Invasion of Privacy Act?

CIPA is a 1967 California law against wiretapping, eavesdropping and recording communications without consent. It sits in the Penal Code from section 630. It's a criminal law, but section 637.2 also lets an injured person sue. Courts have applied parts of it to websites, which is how pixels and session replay ended up in CIPA suits. The Assembly committee's analysis of SB 690 walks through the history.

What bill just passed in California about website tracking?

SB 690, signed on 30 September 2026 and in force from 1 January 2027. It takes away private plaintiffs' right to sue websites and apps under CIPA's pen register section and leaves those claims to the Attorney General. The Governor's signing message says it's aimed at lawsuits and demand letters against small businesses. It doesn't change CIPA's wiretap section or the CCPA's opt-out rules.