If you run a website and you’ve been nervously following the wave of privacy lawsuits over cookies and tracking pixels, you finally have some good news out of California. It comes with important fine print, but it’s real relief, and it’s worth understanding exactly what you did and didn’t just get.
On September 30, 2026, Governor Gavin Newsom signed Senate Bill 690 into law. The legislation eliminates the private right of action for “pen register” and “trap-and-trace” claims arising from conduct on websites, online applications, or mobile applications, leaving enforcement authority exclusively with the California Attorney General. It takes effect January 1, 2027.
If that sentence contains three phrases you don’t recognize, don’t worry. Let’s translate the whole thing into plain English.
The Backstory: How a 1960s Wiretap Law Became a Small-Business Nightmare
To understand why people are celebrating, you have to understand what they’re celebrating the end of.
The California Invasion of Privacy Act (CIPA) is an old anti-wiretapping law. CIPA as a whole was enacted in the 1960s, but the specific “pen register” provision was only added in 2015, intended to govern how law enforcement captures incoming and outgoing phone numbers. A pen register, historically, was a device that recorded the numbers dialed from a phone. Nothing to do with websites.
Then creative plaintiffs’ attorneys found a new use for it. Plaintiffs’ firms and serial litigants sent tens of thousands of demand letters to businesses, threatening class-action suits under CIPA’s pen-register and trap-and-trace provisions for using everyday website tools like cookies, analytics software, and pixels. The theory was that these common tracking tools were essentially modern “pen registers” capturing visitors’ data without a court order.
And the math was brutal. Plaintiffs argued that using common website analytics tools entitled them to $5,000 in statutory damages per violation. For a business with meaningful web traffic, that number scales into the stratosphere fast, which is precisely why so many companies chose to settle rather than fight. That dynamic is what the campaign behind the bill nicknamed “CIPA shakedowns.”
Even the Governor didn’t mince words about it. In his signing statement, Newsom characterized this wave of litigation as the “vexatious use of CIPA lawsuits and demand letters” to extract settlement money from small businesses.
What SB 690 Actually Changes
Here’s the elegant part of the law: it doesn’t ban anything or rewrite the technology rules. It simply changes who is allowed to sue.
The final law does one relatively simple thing: it changes who can sue. An action against a private actor for a Section 638.51 violation arising from conduct on a website, online application, or mobile application may now be brought only by the California Attorney General. In other words, the private plaintiffs and class-action firms that drove the demand-letter flood are taken out of the equation for this specific type of claim.
There’s also a lookback provision that helps businesses already caught in litigation. The law is retroactive and applies to claims filed on or after January 1, 2025. For pending litigation and arbitration, defendants facing covered Section 638.51 website or app claims should evaluate whether SB 690’s retroactivity provision provides a basis to dispose of those claims. That’s meaningful relief for companies with cases currently hanging over them, not just future protection.
It’s worth knowing this was a hard-fought, scaled-back compromise. SB 690 passed the California Legislature in August after significant amendments that narrowed it considerably from the sweeping CIPA reform originally proposed. The version that became law is targeted, not sweeping, which brings us to the fine print.
The Asterisk: Why Your Website-Tracking Risk Isn’t Gone
This is the part the celebratory headlines tend to skip, and it’s the part your business needs to hear. SB 690 closes one door. Several others remain wide open.
First, a crucial distinction: SB 690 does not make the underlying conduct legal. It changes who can sue, not whether the conduct is lawful. The Attorney General can still bring these claims. The behavior isn’t blessed; the private lawsuit pipeline for this one theory is just shut off.
Second, and more important for day-to-day risk: this law targets one legal theory out of several. Most notably, SB 690 does not eliminate private claims under CIPA Sections 631 or 632, which are the classic “wiretapping” provisions. Plaintiffs frequently paired pen register claims with CIPA wiretapping claims, so expect the litigation to simply shift toward the theories that still allow private suits. As one firm put it bluntly, while SB 690 represents significant reform, it does not eliminate the risk of website tracking litigation.
So the honest summary is this: SB 690 is a significant, but narrow, win. Real relief on one front, business as usual on others.
What You Should Actually Do Now
Given all that, here’s how to treat this news like a savvy operator rather than a relieved one.
Don’t dismantle your privacy protections. Because wiretapping-based claims survive, the fundamentals still matter. Even with the law unsettled as to whether ordinary website tracking technologies like cookies qualify as pen registers, businesses should maintain their consent and cookie-banner practices. A real consent setup that blocks trackers until a visitor opts in is still one of your best defenses.
If you’re in active litigation, call your attorney this week. The retroactivity provision reaching back to January 1, 2025 could be a basis to knock out a pending pen-register claim. That’s a time-sensitive opportunity worth evaluating now.
Keep watching California. This likely isn’t the last word. In his signing message, Newsom issued a call to action for “additional work” on broader CIPA reform, which means the rules could keep moving over the next year.
The Bottom Line
SB 690 is a genuine victory for the countless businesses that were targeted by pen-register demand letters over nothing more than running normal analytics. Taking private attorneys out of that specific game will dry up a lot of opportunistic litigation, and the retroactive relief is a lifeline for companies already in the fight.
But “a door closed” is not “the house is sealed.” The wiretapping theories that often rode alongside these claims are untouched, and the Attorney General can still enforce the pen-register rules directly. The smart response is to exhale, then keep your consent banners, privacy disclosures, and tracking practices exactly as tight as they were yesterday. One lawsuit theory just got a lot weaker. The case for good privacy hygiene did not.
This article is general information, not legal advice. For guidance on your specific situation, especially any pending CIPA matter, consult a qualified privacy attorney.
