California Senate Bill 690 is one of the most significant pending legislative efforts aimed at curbing the recent wave of California Invasion of Privacy Act (CIPA) lawsuits targeting website tracking technologies. As of late August 2026, the bill remains active but is not yet law; recent legislative tracking indicates that Assembly amendments were concurred in on August 28, 2026, meaning the measure is positioned for enrollment and presentment to Governor Gavin Newsom if no further procedural obstacle intervenes.
What is CIPA Litigation?
Lawsuits filed under the California Invasion of Privacy Act (CIPA) have expanded dramatically in recent years, transforming what a statute originally aimed at telephone wiretapping and eavesdropping into a major source of privacy class actions targeting website operators.
In CIPA litigation, plaintiffs typically allege that cookies, tracking pixels, session-replay software, chat tools, and analytics vendors unlawfully intercept website communications under California Penal Code section 631 or operate as unauthorized “pen registers” under section 638.51 by collecting visitors’ content, IP addresses, device identifiers, URLs, or interaction data without effective prior consent.
The stakes are substantial because CIPA’s private remedy permits statutory damages of $5,000 per violation without proof of actual harm, making claims involving high-traffic websites attractive for class actions and mass arbitration. Courts remain divided over whether particular web-tracking technologies fall within CIPA’s text, especially on questions of third-party interception, what constitutes communication “contents,” consent, and whether web metadata qualifies as pen-register information.
Current Status of SB 690
SB 690 began as a broader proposal to substantially reduce business exposure to CIPA litigation, but its scope narrowed materially during the 2026 legislative process. Early versions would have created a broader exemption tied to commercial business activity, but those provisions were stripped out in favor of a much narrower reform focused on CIPA’s pen register and trap-and-trace provisions.
The bill’s current posture reflects a late-session revival. It passed the Assembly Committee on Privacy and Consumer Protection on July 1, 2026, then moved through Assembly Appropriations after first being placed on suspense and later revived in August. Legislative tracking as of August 28, 2026, reports that Assembly amendments were concurred in, indicating the Senate accepted the Assembly’s revisions and the bill is now in the final stretch before possible gubernatorial action.
If signed, SB 690 would become operative on January 1, 2027, absent an urgency clause. Multiple analyses describe the bill as retroactive to qualifying pending claims filed within the prior two years, a feature that materially increases its practical importance for existing defendants, not just future litigants.
What SB 690 Would Change
The current version of SB 690 would amend CIPA’s private-enforcement structure so that claims under Penal Code section 638.51 arising from conduct on an internet website, online application, or mobile application could only be brought by the California Attorney General. In other words, private plaintiffs would no longer be able to sue businesses directly for those website- and app-based pen register or trap-and-trace theories.
The reform is narrow by design. The current bill does not eliminate private actions under other provisions that have fueled digital-tracking litigation, especially Penal Code section 631 and related wiretapping theories.
That distinction is critical because the recent plaintiffs’ bar strategy has not relied on a single CIPA theory. Website operators have frequently faced overlapping claims under section 631, section 632.7, and section 638.51, often tied to session-replay software, chat tools, pixels, cookies, and similar tracking technologies. SB 690 targets only one lane of that litigation traffic: claims brought under Section 638.51, so-called “pen register” cases.
Likely Impact on CIPA Litigation
If enacted, the bill would likely have its biggest immediate effect on the now-common website pen-register cases, many of which seek statutory damages under CIPA’s private right of action. By shifting qualifying section 638.51 claims to exclusive Attorney General enforcement, SB 690 would shut off private suits seeking CIPA statutory damages for that subset of internet-tracking claims.
The bill’s retroactivity provision could be even more consequential than its forward-looking effect. Several analyses state that the bill would apply to pending claims in actions commenced within two years before the operative date, which would give defendants in many already-filed cases a strong basis to move to dismiss or narrow section 638.51 claims once the law takes effect.
That said, SB 690 would not end the broader CIPA litigation wave. Plaintiffs would still be able to pursue claims under other CIPA provisions, and many complaints already plead multiple statutory theories precisely to avoid single-point failure. As a result, the bill would likely reduce one of the most aggressive categories of website-tracking claims without eliminating California privacy class action risk overall.
Practical Consequences for Businesses
For businesses defending CIPA suits, SB 690 would be strongest as a claim-pruning statute rather than a complete litigation shield. Defendants facing section 638.51 allegations tied to websites, apps, or mobile applications could gain a potentially case-dispositive defense to private enforcement, but they would still need to litigate surviving section 631 or other claims on the merits.
For businesses not yet sued, the bill could reduce some of the settlement leverage associated with website-tracking class actions by removing a favored pleading theory. But because SB 690 leaves much of CIPA intact, it would not justify pausing compliance work around session replay, chat interception, consent banners, vendor scripts, or data-flow mapping.
The bill may also influence forum strategy and pleading behavior. If private section 638.51 claims disappear, plaintiffs are likely to concentrate even more heavily on section 631 wiretap allegations, arguments about real-time interception, and claims involving third-party software vendors. In short, the litigation pressure would likely shift rather than disappear.
What Happens Next?
As of August 31, 2026, SB 690 appears closer to enactment than at any prior point in the legislative process, but it is still not law until signed by the governor. If Governor Newsom signs it, the most meaningful change will be the removal of private website-based pen register claims under Penal Code section 638.51, with retroactive consequences for a substantial group of pending cases filed in the previous two years.
Even then, SB 690 would be best understood as a partial reset rather than a comprehensive CIPA overhaul. It would likely blunt one of the plaintiffs’ bar’s more expansive digital-tracking theories, while leaving other high-volume CIPA claims in place and preserving California as a major privacy-litigation venue.
