California's Senate Bill 690 shuts down most private lawsuits that treat website trackers as illegal pen registers under state privacy law. For pending cases, defendants with those claims can ask courts to dismiss them once the law takes effect. CIPA is the California Invasion of Privacy Act, the state wiretapping law at issue.
Gov. Gavin Newsom signed SB 690 on Sept. 30, 2026 to amend that law, according to Hinshaw & Culbertson in its October analysis Hinshaw & Culbertson's October analysis.
Table of Contents
- Which tracking lawsuits lose private standing?
- What happens to cases filed since January 2025?
- Which privacy claims survive?
- What should potential class members do now?
- Why must websites still ask for consent?
Which tracking lawsuits lose private standing?
SB 690 amends Penal Code section 637.2 for pen-register and trap-and-trace claims under section 638.51. For website, online, or mobile-app activity, only the Attorney General may sue a private actor, according to Shumaker, Loop & Kendrick in its August briefing Shumaker, Loop & Kendrick's August briefing. A pen register is a device that captures routing signals.
Plaintiffs applied that theory to cookies, pixels, analytics tags, SDKs, chat widgets, and session-replay tools. Businesses facing those tracker-as-pen-register suits are the main beneficiaries. Private plaintiffs and class counsel lose that CIPA vehicle. They cannot use section 638.51 alone to seek damages from a website operator.
What happens to cases filed since January 2025?
The change reaches back to pending qualifying claims in actions started within two years before Jan. 1, 2027. That covers cases filed on or after Jan. 1, 2025, according to Hinshaw & Culbertson in its October analysis Hinshaw & Culbertson's second October summary. The default operative date is Jan.
1, 2027. A dismissal request generally must wait until then. Defendants do not receive automatic dismissal. They must raise SB 690 in the pending case and seek dismissal or other disposition. Judges will decide how it applies to each complaint.
Which privacy claims survive?
SB 690 does not limit private claims under CIPA sections 631, 632, or 632.7. It also leaves common-law privacy claims, other wiretapping statutes, and Attorney General enforcement of section 638.51 intact, according to Katten Muchin Rosenman in its October alert Katten Muchin Rosenman's October alert. That distinction matters for eavesdropping theories.
A suit alleging illegal interception or recording of a communication can proceed under a different section. A suit alleging only tracker-as-pen-register use by a private company cannot. Consumers keep other paths to compensation. They lose one specific claim, not all website privacy claims.
What should potential class members do now?
Check the statute cited in your notice or complaint. SB 690 affects only private section 638.51 claims tied to websites or apps.
Sections 631, 632, and 632.7 claims continue. If you received a settlement notice, take these steps: If you hoped to join a new tracker suit, talk to a lawyer about surviving theories. A filing based only on section 638.51 against a private operator has little future value.
- File the claim by the printed deadline unless the court says otherwise.
- Keep the notice, claim ID, and proof of website or app use.
- Watch the case docket for dismissal motions tied to SB 690.
- Do not ignore a request for more information from the administrator.
Why must websites still ask for consent?
Defendants may seek dismissal of pending tracker-as-pen-register claims after the operative date. They must still maintain tracking consent and data-collection compliance.
Consent banners, opt-out links, vendor controls, and data-retention limits still reduce risk. Other CIPA sections and privacy laws still allow private suits and public enforcement. Save notices, filing deadlines, and opt-out records until a judge rules.