SB 690 Signed: What California’s New CIPA Law Changes for Businesses

California Governor Gavin Newsom signed Senate Bill 690 on September 30, 2026. The law ends the private right of action under the California Invasion of Privacy Act’s “pen register” and “trap and trace” statute (Penal Code § 638.51) for tracking technologies on websites, online applications, and mobile apps, the theory behind thousands of cookie, pixel, and session-replay lawsuits and demand letters against California businesses. It takes effect January 1, 2027, and applies retroactively to pending claims filed on or after January 1, 2025.

Website pen-register claims become Attorney General-only. The wiretap claims (§ 631) behind headline settlements, the $5,000-per-violation penalty, and the demand-letter wave remain untouched. SB 690 narrows one lawsuit theory. It legalizes nothing and bans nothing.

This page explains what SB 690 is, what changed and what didn’t, and what businesses should do now. It is based on the chaptered bill text, vote record, Governor’s signing message, and court docket.

What is SB 690?

SB 690 is a California law that narrows who can sue over website and app tracking under one theory of the California Invasion of Privacy Act (CIPA). From its operative date, “pen register” and “trap and trace” claims arising from websites, online applications, or mobile apps may be brought only by the California Attorney General. Private plaintiffs and class actions cannot bring these claims. Everything else in CIPA remains untouched.

Identity markers, so you’re reading about the right bill:

• Which SB 690: Senator Anna Caballero’s bill in California’s 2025–2026 regular session, signed September 30, 2026, as Chapter 976, Statutes of 2026. Other states and sessions have their own “SB 690s”; this page covers California’s CIPA bill only.
• What it amends: Penal Code § 637.2, CIPA’s private-right-of-action statute, not the tracking prohibitions themselves.
• What it responds to: a litigation wave that repurposed CIPA’s telephone-era pen-register provision against website pixels, analytics scripts, and chat tools, with $5,000 per violation penalties. (Statute map and exposure math: our complete CIPA guide.)

What SB 690 does not do:

• Ban or restrict cookies, pixels, or any tracking technology. It regulates lawsuits, not the technology.
• Legalize anything. The underlying pen-register prohibition stands, unchanged.
• Touch CIPA’s wiretap claims, the theory behind the headline settlements.
• Change the $5,000-per-violation remedy, demand-letter practice, or any other privacy law.

Did SB 690 pass?

Yes. Governor Newsom signed SB 690 on September 30, 2026 (Chapter 976, Statutes of 2026). It takes effect January 1, 2027. Both chambers passed the final version without dissent on August 28, 2026: 66–0 in the Assembly, 40–0 on Senate concurrence (official vote record).

Status snapshot, as of October 5, 2026: SB 690 is signed law but not yet operative. Nothing about enforcement changes until January 1, 2027.

What is the California Invasion of Privacy Act (CIPA)?

CIPA is California’s 1967 anti-wiretapping law, Penal Code §§ 630 et seq.: a criminal statute with a private right of action and statutory damages of $5,000 per violation. Written for telephone surveillance, it became the engine of the website-tracking wave that produced SB 690.

In the phone-era analogy, a wiretap captures what you say on a call. A pen register captures the numbers dialed: metadata, not content. CIPA prohibits both. Section 631 covers intercepting the contents of communications, and Section 638.51, added in 2015, bars installing or using a pen register or trap-and-trace device without a court order.

From around 2023, plaintiffs’ firms applied that framework to websites. A pixel recording a visitor’s IP address, device identifiers, or query strings is, they argue, a “device or process” capturing “dialing, routing, addressing, or signaling information.” Enough courts have let the theory past the pleading stage that it became CIPA’s highest-volume claim type. It has led to settlements like the $3.85 million in Mirmalek v. Los Angeles Times Communications LLC (N.D. Cal., final approval June 26, 2026).

Hold the two theories apart. SB 690 treats them differently: § 638.51 (pen register) is the one it touches. § 631 (wiretap), behind the session-replay and chat-tool cases, stays fully intact. The case-by-case scoreboard lives in the pen-register litigation wave, and the full statute map in the CIPA guide.

What does SB 690 change about CIPA lawsuits?

Exactly one thing: it adds subdivision (d) to Penal Code Section 637.2. Pen-register and trap-and-trace claims arising from websites and apps, and only those, can no longer be brought by private plaintiffs against private actors. Only the Attorney General may bring them. The enacted language from the chaptered bill text:

“(d)(1) An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.

(2) The amendments to this section by Senate Bill No. 690 of the 2025–26 Regular Session apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation.”

The act’s only other operative provision is a severability clause (SEC. 2). If any provision or application is held invalid, the rest survives. This matters because retroactivity is the likeliest target of a court challenge.

Every qualifier in that sentence limits the change:

One misreading to avoid. The bill also re-letters a pre-existing savings clause as subdivision (e), preserving “Title 4 (commencing with Section 3425.1) of Part 1 of Division 4 of the Civil Code“, the Uniform Single Publication Act, not the California Consumer Privacy Act (CCPA). The chaptered text never mentions the CCPA. Coverage that says otherwise is importing the earlier, broader version of the bill.

Who can bring a pen-register claim now?

For website and app tracking, once the law is operative, only the California Attorney General can sue. Private plaintiffs keep everything else: § 631 wiretap claims, § 632 recording claims, § 638.51 claims arising outside websites and apps, and every non-CIPA theory. Nothing requires the Attorney General to bring any case. What that substitution means in practice is a capacity question.

What didn’t SB 690 change?

Almost everything remains. One enforcement door narrowed. Every substantive prohibition, other claim theories, the damages formula, demand-letter practice, and every non-CIPA statute stand as they did on September 29, 2026. Nothing changes until January 1, 2027.

Which CIPA statutes are untouched?

All of them, except the enforcement route for one slice of § 638.51. The original 2025 version of SB 690 would have amended §§ 631, 632, and 632.7. Every one of those amendments was struck. As enacted, SB 690 changes no conduct rule anywhere in CIPA. It re-routes one claim type to one enforcer. The wiretap theory driving the session-replay and Meta Pixel dockets is exactly the theory left alone.

What about laws beyond CIPA?

SB 690 is a one-clause amendment to one Penal Code section. It does not preempt or interact with the CCPA/CPRA, federal wiretap and video-privacy law, computer-access statutes, other states’ wiretap acts, or unfair-competition law. All remain available against the same tracking conduct (Goodwin’s analysis catalogs the surviving theories).

The substitution that did happen (any aggrieved visitor replaced by a single public office) comes with numbers. The Assembly Appropriations Committee assumed roughly 4,000 pending CIPA actions, “the bulk of which assert pen register claims based on website tracking software.” The analysis projected the Department of Justice adding six positions and about $1.5 million starting January 1, 2027, with no enforcement mandate attached, as reported by Baker Donelson. Six new positions against a four-thousand-case backlog is the practical meaning of “AG-only.”

Plaintiffs are not waiting to find out. Defense-side trackers report firms already re-papering website-tracking complaints onto surviving theories, a pivot that began months before signing (Buchanan Ingersoll & Rooney, October 3, 2026).

What did the original SB 690 propose and what passed instead?

SB 690 began as a broad exemption taking whole categories of commercial tracking out from under five CIPA provisions. What passed is a single clause re-routing one claim type to the Attorney General. The narrowing happened in two steps, fourteen months apart.

What did the original SB 690 propose?

SB 690’s introduced version (February 21, 2025) was an unrelated spot bill. The author’s amendments of March 24, 2025 replaced it wholesale with the CIPA measure, which would have:

• Added a “commercial business purpose” exemption across five Penal Code sections (§§ 631, 632, 632.7, 637.2, and 638.50), exempting commercial-purpose processing from the wiretap, confidential-recording, and pen-register provisions alike.
• Defined that purpose through the CCPA’s own “business purpose” definition (Civil Code § 1798.140(e)) plus its opt-out rights, folding CIPA into the CCPA’s framework for online commercial activity.
• Applied retroactively “to any case pending as of January 1, 2026”, a clause struck on the Senate floor on May 29, 2025, “in response to concerns from opposition,” as Senator Caballero told the Senate.

Why was SB 690 narrowed?

The procedural record shows a bill trading scope for votes:

One version tried to decide what tracking is lawful and stalled for a year. The other, deciding only who may sue over one theory, passed every remaining vote unanimously. That exemption would have settled the argument between the business and privacy camps. The enacted bill declines to. It keeps the prohibition, keeps the damages, and changes only who carries enforcement for website pen-register claims.

Is SB 690 retroactive and does it reach demand letters?

Yes. (d)(2) applies the new rule to any pending § 638.51 website/app claim in an action commenced within two years before the operative date: filed on or after roughly January 1, 2025. And no. Demand letters are not reached, because a letter is not an “action.” None of it operates until January 1, 2027.

Does SB 690 apply to pending lawsuits?

A claim loses its private plaintiff only if all four elements are met:

• [ ] Theory: brought under § 638.51 (pen register / trap and trace), not § 631, not another statute
• [ ] Conduct: arises from an internet website, online application, or mobile app
• [ ] Defendant: a “private actor”
• [ ] Timing: action commenced within two years before January 1, 2027, and the claim still pending on that date

One textual detail matters for real cases. (d)(2) reaches any pending “claim,” not only actions built solely on § 638.51. In a suit pleading § 638.51 and § 631 together, the pen-register claim can be excised while the wiretap claim continues. Dismissal of the whole action is not the expected outcome, as Goodwin’s analysis walks through. Defendants would raise the statute by motion to dismiss, judgment on the pleadings, or summary judgment after the operative date; nothing is automatic.

The caveat, in plain terms, is that retroactive elimination of pending claims is the likeliest court challenge. The severability clause shows the Legislature anticipated it. Until appellate courts rule, expect trial courts to apply (d)(2) unevenly. No defendant should bank on automatic dismissal.

Does SB 690 apply to demand letters?

No. Coverage implying that demand letters are “filed” claims caught by retroactivity misreads the statute. (d)(2) speaks of pending claims in actions commenced. A demand letter commences nothing. The practical effect is nearly as strong: from January 1, 2027, a letter threatening a § 638.51 website claim threatens an action its sender has no power to file. Letters that survive will be re-papered onto the theories that remain privately enforceable, § 631 above all, so the demand-letter playbook, starting with verifying what your website actually transmits, still applies (the CIPA guide’s walkthrough).

What happens to CIPA wiretap claims after SB 690?

Nothing. That is the point disappointed supporters and opponents both make. Section 631’s wiretap theory is untouched, it already carries the bulk of the exposure, and plaintiffs were migrating toward it before the ink dried. The sponsor coalition’s own math says so: Reform CIPA estimates SB 690 provides relief to only 27% of businesses currently facing CIPA litigation and leaves 61% unprotected (shares of organizations facing litigation, not of claims).

The pivot runs along exactly this seam:

Will plaintiffs shift to wiretap claims?

That shift predates the law. Defense firms reported the pivot months before signing (Buchanan Ingersoll & Rooney), but it runs on real friction:

• The “contents” element is a harder bar. A § 631 claim needs interception of communication contents, by a third party, in transit, not metadata. Defendants will press complaints that re-label metadata allegations as wiretap claims, as Goodwin notes.
• Standing doctrine is tightening independently. The Ninth Circuit’s Popa v. Microsoft (2025) gave defendants a concrete-injury argument against routine-metadata claims, and district courts have applied it since.
• The frontier is vendor behavior, not vendor presence. In In re Otter.AI Privacy Litigation (N.D. Cal., No. 5:25-cv-06911-EKL), Judge Eumi K. Lee ruled on August 13, 2026, that a transcription vendor retaining conversations to train its own models is plausibly a third-party eavesdropper, not the host’s tool, letting federal wiretap and § 631 claims proceed. The theory turns on what the vendor does with the data.
• The adjacent docket is growing. Chatbot wiretap matters under ECPA and state wiretap statutes grew from 2 in 2021 to 30 in 2025, per Baker Botts’ analysis (ECPA and state matters, not CIPA alone).

SB 690 closed a door the plaintiffs’ bar was already walking out of. The Governor’s signing message explicitly invites a follow-up round aimed at CIPA’s other statutes. That 2027 thread is in the final section.

Who supported SB 690, and who fought it?

Two large registered coalitions fought over this bill for nineteen months. A business coalition argued CIPA had become a shakedown instrument, and a privacy-and-civil-rights coalition called the bill a Trojan horse for surveillance. The July 1, 2026 committee analysis records roughly 280 supporters against roughly 75 opponents, and both sides’ arguments in their own words.

These numbers circulate detached from their sources. 600-to-4,000 is the bill sponsor’s figure, quoted in the committee’s own analysis. 3,400/2,800/72% is CalChamber’s. “four firms” is Caballero’s from the floor. They are advocacy numbers, and independent tallies differ. The serial-plaintiff campaign behind part of the wave is documented in our Vivek Shah profile. 

Why did privacy groups oppose SB 690?

The opposition’s core claim was never that every pen-register suit was meritorious. It was that the exemption’s breadth would swallow the protection. The EFF-led seven-organization coalition said SB 690 “gives the green-light to dystopian big tech surveillance practices”. In the coalition’s telling, the bill lets businesses share sensitive information “with data brokers, immigration officials, or law enforcement officials in states that restrict reproductive or gender-affirming care.” The Dolores Huerta Foundation and Consumer Federation of California warned of “an assault of surreptitious recording and surveillance that will be almost without limit”.

The debate’s strangest turn was immigration, which Capitol Weekly documented becoming the flashpoint. Both sides argued through immigrant entrepreneurs. The National Latino Restaurant Association’s CEO wrote that Latino-owned restaurants are “under attack from predatory lawsuits,” while an opponent answered that SB 690 exposes immigrant communities to “digital manipulation and exploitation.” Fisher Phillips’ Usama Kahf (whose firm has defended more than 300 CIPA cases and who testified for the bill) called the immigration argument “a false flag… Not a single lawsuit related to CIPA involved immigration”.

Consumer Federation of California’s Robert Herrell, who calls SB 690 “the ultimate Trojan horse proposal,” countered that immigration and reproductive rights “are intrinsic to the SB 690 debate if you zoom out a bit more.” He pointed to the data flows litigated in Frasco v. Flo Health.

Two postscripts measure how little the narrowing settled. The defense side’s own witness warned that a pen-register-only fix “could backfire… It could make it worse” by concentrating filings on the surviving theories. And the consumer-side platform Chariot Claims wrote that “filing volume was treated as proof of abuse rather than as evidence of how widespread the underlying practice is”, and that a revenue threshold shielding small businesses while preserving claims against large corporations “didn’t make it into the final bill, and it’s worth asking why.”

Between the camps sits the judiciary’s own summary of the dilemma: courts are “trying to find a happy medium where individual harms can be recognized without floodgates of litigation,” UC Irvine law professor Ari E. Waldman told the Daily Journal.

What should businesses do now that SB 690 is law?

Find your bucket. The law means different things for a defendant in a pending case, a company holding a demand letter, and everyone else. Until January 1, 2027, it is signed but inert.

Bucket 1: you’re a defendant in a pending case with a § 638.51 website/app claim.

• Check the four coverage elements in the retroactivity section against your case, with counsel.
• Preserve the statutory and retroactivity arguments now. The expected vehicles are motions to dismiss, for judgment on the pleadings, or for summary judgment after the operative date (Goodwin).
• Assume nothing automatic. Retroactivity challenges are expected, and mixed complaints keep their § 631 claims regardless.

Bucket 2: you’re holding a demand letter.

• Don’t ignore it, and don’t pay it reflexively. A letter is not an action, and from January 1, 2027, a § 638.51 website-claim letter threatens a suit its sender cannot file, but a letter re-papered on § 631 is a different object.
• Establish what your website actually transmits before responding. The demand-letter playbook in the CIPA guide starts there for a reason.

Bucket 3: neither. You’re watching exposure, not holding paper.

• Keep the standing disciplines (tracker inventory, consent sequencing, honoring opt-out and Global Privacy Control (GPC) signals) because they address the theories that survived. The full program is the CIPA guide’s checklist. The mechanics of where data goes are in our web-tracking pillar.
• Treat 2027 as a design constraint, not a reprieve. The Governor has publicly invited a broader CIPA bill next session.

Every claim type that survived SB 690 (§ 631 wiretap claims, pre-consent firing patterns, reject-signal failures, the pen-register claims outside the web/app carve-out, and the Attorney General’s own future enforcement) turns on the same question: what does your website actually send, to whom, and when? 

That is the layer MELURNA is built to observe. We observe browser and application traffic, identify linkable values, resolve every recipient, and preserve the evidence chain from collection to decision without relying on self-attestation. Your CMP records the choice. MELURNA verifies the outcome. Observed data movement is compared after accept, reject, no-action, and Global Privacy Control signals to test whether consent choices actually change recipient behavior.

None of this settles the legal questions SB 690 leaves open, nor does it predict how a court will read your tags. It shows what your site sends. Every claim that survived SB 690 turns on exactly that.

See how Melurna works →

What happens next with SB 690?

Three anchors. The law goes operative January 1, 2027. Its first test may come from the case that was supposed to settle the pen-register question. And the Governor has formally requested a broader round of CIPA reform in 2027.

The case that may answer first is the one SB 690 may have swallowed. In Sean Rose v. Variety Media, LLC (L.A. Super. Ct. No. 25STCV01865, filed January 23, 2025, inside the retroactivity window), the trial court held last year that § 638.51 reaches online trackers. Variety’s writ petition (Variety Media, LLC v. Superior Court, No. B350578) became the appeal the whole space watched, argued and submitted August 25, 2026. The day after the signing, the Court of Appeal withdrew the submission on its own motion and ordered both sides to brief whether SB 690 makes the proceeding moot. 

The court also ordered briefing on whether an exception to mootness applies, citing Cucamongans United for Reasonable Expansion v. City of Rancho Cucamonga, 82 Cal.App.4th 473, 479–80 (2000). As of October 5, 2026, both branches are live: if the case is moot, the law eliminated its own test case with the pen-register question formally unanswered. If the court keeps it, the first appellate word on § 638.51 and websites arrives anyway.

Also pending as of October 5, 2026: Drummer v. CoStar Group, Inc. (9th Cir. No. 26-1160), on whether routine IP-address transmission is an Article III injury at all. Reuters News & Media, Inc. v. Superior Court (Sixth Appellate District) poses the same pen-register question as Variety Media.

The Governor has already written next session’s agenda into this bill’s record. His signing message calls SB 690 a response to the “vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses”, and then says, verbatim:

“However, additional work in this area is needed as CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants. I urge the Legislature to take this on next year to ensure a fair balance between protecting private information and preventing rapacious litigation.”

Context for that promise. SB 690 was the session’s only enacted CIPA change. The same end-of-session batch saw other privacy measures vetoed (SB 1130 on wearable recording devices among them), and none of AB 1542, AB 883, or AB 2561 touches CIPA. Whatever the “other decades-old statutes” round becomes, it starts in January. We’ll track it here and in a dedicated 2027-reform article once a bill exists.

FAQs

DISCLAIMER: This article is for general informational purposes only and does not constitute legal advice. While we strive for accuracy, we make no warranties about the completeness or reliability of this information, and are not liable for any errors, omissions, or actions taken based on its contents. Consult a licensed attorney for guidance specific to your business.