SB 690 may be a dam against the flood of CIPA “pen register” suits but not the end of litigation

On August 28, 2026, California Senate Bill 690 (SB 690) unanimously passed the California Assembly and Senate and is currently being presented to Governor Newsom. The Governor will likely have an outcome on the bill by September 30, 2026. SB 690 aims to cut down on the number of lawsuits targeting website and application technologies through the California Invasion of Privacy Act (CIPA).

If passed, SB 690 will remove the private rights to action “pen register” and “trap and trace” private lawsuits rely on under Cal. Penal Code § 638.51. Business have faced a number of lawsuits from plaintiffs stating their website data collection practices involve “pen registers” or “trap and trace devices” within the meaning of § 638.51 as many of these analytic tools that trace website history for user experience collect IP addresses or other similar device identifiers. SB 690 would block those lawsuits and would instead shift enforcement responsibility for § 638.51 to the California Attorney General.

What would change if SB 690 is signed

Not much would change as companies still would have to comply with the CIPA and other federal and state privacy laws. SB 690 would not change CIPA § 631 or § 632, which regulate electronic eavesdropping including wiretapping and recording of confidential communication.

SB 690 would however impact the amount of lawsuits California courts would be seeing surrounding the CIPA as many of the current cases’ theories have been relying on § 638.51 to state that damages would not be limited to disclosure of contents of the data or expectation of privacy but collection itself. Businesses have tried to comply with this standard by adding disclosure on their website to the collection of analytics tracking but plaintiffs have argued that their information was already captured as they clicked on the website. This has placed a burden on businesses in California and outside California who have California customers.

Instead, of dealing with hundreds of class actions only the California Attorney General will be able to bring a civil action against a private actor for a potential § 638.51 violation. SB 690 does not state that tracking technologies are lawful and does not change the legality of the underlying actions, but rather just updates enforcement mechanism.

Looking ahead

Companies Already Facing CIPA Litigation

Contact counsel as soon as possible to discuss how the potential changes can impact your case. SB 690 has a retroactivity provision that would apply to pending claims commenced within the two years preceding its operative date. If signed, SB 690 is expected to be operative on January 1,2027, making this relevant to actions commenced on or after January 1, 2025. Some items impacted companies should consider:

• Evaluate with counsel whether SB 690 would allow a means to seek a stay or other case-management relief until the effective date in 2027;
• New settlement offers given the change in leverage given the potential loss of private enforcement;
• The applicability of other privacy laws, specifically separate § 638.51 claims from any that may survive.

Companies Not Currently Facing CIPA Litigation

Just because the private right to action under § 638.51 may be removed, does not mean companies should let their guard down when it comes to website privacy controls. Companies should maintain compliance with California’s and other states’ privacy laws. To avoid being the target of a “pen register” and “trap and trace” lawsuit companies should consider the following:

• Implementing a banner that blocks all non-essential trackers until consents to the tracking is given;
• Conduct audits to ensure your website is working as intended;
• Have a clear and accessible privacy policy on your website.

If you have any questions about your company’s compliance with cyber regulations, concerns about vulnerability to attacks or other breaches, or if you want to learn more about proactive cybersecurity defense, contact a member of McDonald Hopkins’ national data privacy and cybersecurity team.