California SB 690 Limits Private Pen-Register Claims, But CIPA Litigation Is Far From Over

California has finally addressed one of the stranger developments in modern privacy litigation: the effort to treat ordinary website technology as the digital equivalent of a telephone pen register. Well, sort of.

On September 30, 2026, Governor Gavin Newsom signed Senate Bill 690, giving businesses meaningful relief from one of the theories that has fueled the recent explosion of California Invasion of Privacy Act, or CIPA, website-tracking claims. The important word, however, is “one”, as in just one.

SB 690 eliminates the private right of action for certain claims under California Penal Code § 638.51 involving alleged pen registers and trap-and-trace devices operating on websites and applications. That is significant as it removes a claim that plaintiffs have used to turn the routine deployment of analytics, advertising, attribution, and other website tools into potentially enormous statutory-damages exposure.

But SB 690 is not a general website-tracking exemption. It does not repeal CIPA, amend CIPA’s wiretapping provision in § 631, make pixels, cookies, session-replay tools, chat technologies, or advertising technologies automatically lawful, and it is most definitely not a reason for businesses to dismantle their consent-management platforms and declare victory.

For businesses facing CIPA claims, the right way to view SB 690 is as both a significant defense development and a reminder that website-tracking litigation is evolving, not disappearing.

How Did We Get Here?

CIPA has been on the books since 1967, although California did not add its current pen-register and trap-and-trace provisions until 2015.

Penal Code § 638.51 generally prohibits a person from installing or using a pen register or trap-and-trace device without a court order, subject to certain exceptions. Traditionally, those terms referred to telephone surveillance. A pen register captured outgoing dialing information; a trap-and-trace device captured information identifying the source of incoming communications.

Then website-tracking litigation arrived.

Beginning with cases such as Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024 (S.D. Cal. 2023), plaintiffs began arguing that software could qualify as a “pen register” because California’s statutory definition refers broadly to a “device or process” that records or decodes dialing, routing, addressing, or signaling information.

That opened the door to allegations involving IP addresses, device identifiers, browser information, geolocation information, URLs, advertising identifiers, and other information transmitted through websites and mobile applications.

The litigation incentives were substantial. CIPA’s civil-remedies provision, Penal Code § 637.2, generally permits recovery of the greater of $5,000 per violation or three times actual damages. Actual damages are not a prerequisite to bringing an action.

For plaintiffs’ lawyers, that statutory structure created substantial leverage. For businesses, it created a difficult litigation equation: even where the underlying theory was novel or disputed, potentially large statutory damages could make defending the claim more expensive than settling it.

SB 690 is California’s response to that problem.

What Does SB 690 Actually Do?

SB 690 is remarkably narrow. As noted above, it does not amend § 638.51, the statute prohibiting unauthorized use of pen registers and trap-and-trace devices. Instead, it amends § 637.2, which authorizes CIPA civil actions.

Under the new § 637.2(d), an action against a “private actor” for an alleged violation of § 638.51 arising from conduct occurring on an internet website, online application, or mobile application may be brought under § 637.2 only by the California Attorney General. That means a private plaintiff will no longer be able to pursue the familiar $5,000-per-violation CIPA damages claim under § 638.51 based on covered website or application activity.

This matters to business because, a plaintiff who alleges that a company’s Meta Pixel, Google Analytics implementation, advertising technology, identity-resolution technology, or similar tool constitutes a pen register cannot employ § 638.51 to pursue private statutory damages once SB 690 becomes operative, assuming the claim falls within the statute’s scope.

That is a help to businesses, but California did not declare the technology lawful. SB 690 merely changes who can being a claim under § 638.51; it does not change the underlying substantive prohibition.

The Retroactivity Provision May Be Just as Important as the Prospective Change

SB 690 takes effect January 1, 2027, but it is also retroactive. What this means is, for companies already defending CIPA litigation, the Legislature expressly made the amendment retroactive to a “pending claim in an action commenced within two years before” the law’s operative date. This means, SB 690 reaches  qualifying claims in actions commenced beginning January 2025, if the claim remains pending when the statute becomes operative.

That provision could substantially change the economics of existing litigation. For example, a company that is currently defending a lawsuit containing both a § 638.51 pen-register claim and a § 631 wiretapping claim may have a basis to eliminate the former claim while continuing to litigate the latter.

It is worth noting that SB 690 is not operative yet, and businesses should not characterize SB 690 as eliminating the private right of action as of September 30, 2026, because it did not.

Also, the retroactivity provision is new. Meaning, no court has had the opportunity to resolve potential challenges or to answer any question concerning how it applies to particular procedural circumstances.

What SB 690 Does Not Do

This is where businesses need to be particularly careful: SB 690 went through a substantial transformation before enactment. Earlier versions contemplated a much broader “commercial business purpose” exemption affecting multiple CIPA provisions.

That is not the law California enacted. The final legislation does not create a broad exemption for commercial website activity.

Most importantly, it does not amend Penal Code § 631. Section 631 remains the foundation for many website-tracking lawsuits alleging that a website operator or third-party technology provider intercepted, read, learned, used, or assisted in obtaining the contents of an electronic communication while it was in transit.

Pixels, session-replay technology, chat tools, form-tracking software, advertising technology, and analytics tools may therefore continue to generate § 631 claims depending on what information is transmitted, when it is acquired, who receives it, what role the recipient plays, and whether legally sufficient consent was obtained.

SB 690 likewise does not amend other CIPA provisions, including § 632, which addresses recording of confidential communications.

It also does not eliminate potential claims under the federal Electronic Communications Privacy Act, California’s Comprehensive Computer Data Access and Fraud Act, California’s Unfair Competition Law, California’s constitutional privacy protections, common-law privacy theories, or other states’ wiretap, privacy, and consumer-protection statutes.

California Consumer Privacy Act and CPRA obligations also remain. So do California Privacy Protection Agency enforcement authority, contractual restrictions, privacy-policy representations, opt-out obligations, and obligations imposed by sector-specific laws.

In other words, SB 690 removes a claim; it does not remove the underlying data flow.

Section 631 Is Not Section 638.51 With a New Caption

One predictable response from the plaintiffs’ bar will be an increased emphasis on § 631 and other surviving theories. That does not mean the same allegations automatically support those claims.

The distinction between § 638.51 and § 631 matters. A Section 638.51 pen-register theory generally focuses on dialing, routing, addressing, or signaling information rather than the contents of communications. In contrast, Section 631 expressly addresses interception or acquisition of the contents or meaning of communications.

For defense counsel, that difference matters. A complaint alleging only that a technology received an IP address, device identifier, or other routing-type information should not be accepted as a viable § 631 claim merely because the plaintiff has changed the statutory citation. Defendants should examine precisely what information the technology allegedly collected; whether it constitutes the “contents” of a communication; when the alleged acquisition occurred; whether the technology provider was a party to or service provider for the communication; what the website operator allegedly knew or intended; and what consent was obtained before the challenged transmission. Those questions already matter under § 631, and, after SB 690, they will matter more.

For Businesses Already Facing CIPA Claims, SB 690 Changes the Litigation Calculus

Companies with pending demands, lawsuits, or arbitration threats should reassess them now.

A § 638.51 claim that previously carried substantial theoretical statutory-damages exposure may be worth considerably less if the private plaintiff will no longer have authority to maintain that claim once SB 690 becomes operative.

That does not mean every case should immediately be litigated rather than settled. It means the case should be valued under the law that is about to exist rather than under the litigation environment that existed six months ago.

Pending cases also warrant procedural review. Depending on the posture of the matter, defendants may have grounds to seek a stay, modification of discovery or class-certification deadlines, judgment on the pleadings, dismissal after the effective date, or other case-management relief directed specifically to a § 638.51 claim.

Settlement documents deserve the same attention. A settlement resolving only a § 638.51 theory may accomplish very little if the claimant remains free to repackage the same facts under § 631 or another privacy statute.

What Businesses Should Do Now

Business should use SB 690 aggressively where it helps in litigation, but not relax website privacy governance simply because one cause of action has been curtailed. Specifically, business should:

• Review every pending CIPA demand, complaint, arbitration demand, or threatened claim and identify allegations under §§ 638.51, 631, 632, and non-CIPA laws. For § 638.51 claims, determine when the action was commenced and whether the retroactivity provision may apply.
• Preserve technical evidence. Maintain tag configurations, consent-management records, network logs, screenshots, vendor documentation, and historical versions of privacy notices. When a website changes after receiving a demand letter, proving how the technology operated before the change can be harder than expected.
• Inventory website and application technologies, including analytics, advertising pixels, session replay, chatbots, identity-resolution tools, personalization platforms, fraud-detection tools, SDKs, and tag-management systems.
• Determine what each technology transmits. There is a meaningful difference between transmitting an IP address and device information and transmitting search terms, chat text, form-field data, account information, health information, or the substance of a user’s interaction with the site.
• Test consent mechanisms rather than assuming they work. Determine which technologies fire before consent, after consent, after an opt-out, and in response to Global Privacy Control signals. Compare actual behavior against the company’s privacy notice and vendor representations.
• Apply additional scrutiny to sensitive environments such as health-related pages, financial services, authenticated portals, children’s services, employment platforms, educational services, and pages where users may communicate sensitive personal information.

The goal is not to have a website with no tracking technology as that is neither realistic nor required. Rather, the goal is knowing what technology is operating, what information it receives, why it receives that information, who else can use it, and whether the company’s disclosures and consent mechanisms match reality. That remains important after SB 690.

This May Not Be California’s Last Word on CIPA

Governor Newsom expressly framed SB 690 as a response to what he described as abusive CIPA lawsuits and demand letters sent to businesses that installed website software without appreciating the litigation risk.

He then urged the Legislature to return to CIPA next year and address other provisions that he believes may also be susceptible to aggressive litigation. This is noteworthy given the enacted version of SB 690 is materially narrower than earlier proposals that would have addressed § 631 and other CIPA provisions. The Governor’s message leaves open the possibility that California will revisit broader CIPA reform in 2027.

Takeaways

SB 690 is meaningful relief for businesses, but it is not the end of California website-tracking litigation, and it does not give businesses carte blanche to use website tracking technologies. What it does is remove

a private plaintiffs’ ability to use § 638.51’s pen-register and trap-and-trace theory against private actors for covered website and application conduct. It also expressly reaches certain pending claims, which may provide defendants with substantial leverage in lawsuits already underway.

What it does not do is equally important. It does not repeal § 638.51; legalize tracking technology; amend § 631; eliminate federal or other state privacy claims; or turn consent management, vendor diligence, data-flow mapping, or accurate privacy disclosures into optional exercises.

The better business response is not “we can stop worrying about website tracking.” It is that an expensive theory just became much harder for private plaintiffs to pursue.