On September 30, 2026, the last day he legally could, Governor Newsom signed SB 690 into law. In his signing message he named the target: “the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses.” He also called the fix incomplete, urging the Legislature to take up the “other decades-old statutes that are also susceptible to abuse” next year.
The bill does one thing. It takes the most common privacy lawsuit in America, the CIPA “pen register” claim over website and app tracking, away from private plaintiffs and hands it to the California Attorney General alone, starting January 1, 2027. It also reaches back: pending cases filed on or after January 1, 2025 lose that claim too.
One door closed. Two doors stay wide open: private plaintiffs suing under everything else (including the rest of CIPA and a stack of other statutes), and the regulators, who now own the pen register claim outright. The rest of this piece is about what closed, what didn’t, and the clause that decides what happens to the roughly 4,000 cases already in court, the retroactivity provision. Two weeks after the signature, I did a webinar on this bill alongside the 2026 Website & App Privacy Litigation Report we published at Privado, where I work. Matt Pearson, a privacy class-action partner at Frankfurt Kurnit, walked through what changes and what doesn’t, and his read sharpened the section below on where plaintiffs go next.
The mechanics: what the bill actually changed
CIPA is the California Invasion of Privacy Act, a 1967 wiretap statute (Cal. Penal Code §630 onwards) that courts have been stretching to fit the modern web. Three sections matter here:
Penal Code §638.51 bans installing or using a “pen register” or “trap and trace device” without a court order or consent. The 2015 definitions in §638.50 describe a “device or process” that captures dialing, routing, addressing and signaling information, “but not the contents” of a communication. That phrasing is what let web-tracking claims in: plaintiffs argued your analytics tools and ad pixels are exactly such a process, collecting the addressing data of every page load. No court order was ever obtained, hence a violation on every visit.
Two routes around the ban always existed, and they stay exactly where they were. The provider-side exceptions in §638.51(b) cover operating and testing the service, protecting the provider’s rights or property, shielding users from abuse of the service, and, at (b)(5), use with “the consent of the user of that service.” In the website-tracking suits, plaintiffs spent years arguing none of these fit: a website visitor’s analytics never obtained the kind of consent (b)(5) imagines, and the other exceptions protect the service provider, not an advertiser renting the pixels. Courts split on whether the definitions even reach the web at all (Greenley v. Kochava in 2023 let the theory through, reasoning that “pen registers [now] take the form of software”; other courts read the legislative history as telephone-era). SB 690 does not resolve that split; it takes it away from the people who were arguing it. Come January 1, 2027, only the AG gets to make these arguments in a web or app case.
Penal Code §637.2 is the money. Any “person injured” by a CIPA violation gets the greater of $5,000 per violation or three times actual damages, and actual damages are explicitly not a prerequisite. That sentence, multiplied by pages and users, is the engine that made demand letters profitable.
§631 and §632 are the wiretapping and eavesdropping prohibitions, requiring proof that the “contents” of a communication were intercepted and that privacy expectations were reasonable. Higher pleading burden. Untouched by this bill.
SB 690 adds one subdivision to §637.2:
(d)(1) An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General. (d)(2) The amendments to this section by Senate Bill No. 690 of the 2025–26 Regular Session apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation.
The bill carries no urgency clause, so under the state constitution it is operative January 1, 2027 (signed September 30, 2026; chaptered the same day as Chapter 976, Statutes of 2026). The Legislature passed it unanimously (Assembly 66–0, Senate 39–0), wrote it in two sections, and included a severability clause, which is the drafted-in tell that somebody expected a legal challenge.
Note what did not change: §638.51 itself still prohibits the conduct, and its criminal penalty (a fine up to $2,500 and up to a year in county jail) survives. SB 690 is an enforcement fix, not a legalisation. Consent banners, CCPA duties, and every other privacy obligation survive. The Digest Key records no appropriation, so the AG inherits the enforcement function with no new funding attached.
One boundary in the drafting matters more than any headline about the bill: the carve-out has three cumulative elements, and each is a wall. The defendant must be a “private actor,” a phrase the bill never defines. The claim must be “for a violation of Section 638.51,” so a §631 count survives even when the same tracker produced it. And the conduct must occur “on an internet website, online application, or mobile application,” which leaves §638.51 claims from any other setting untouched. The bar removes one count from a complaint, not the case; the complaint that also pleads §631 keeps that count.
What it means for the AG, and for individuals
For the California AG, three things are now true. First, they are the exclusive enforcer of §638.51 for website, online-app and mobile-app conduct, with access to the same civil remedies private plaintiffs had (the greater of $5,000 per violation or treble damages, plus injunctive relief). Second, nothing in the bill obliges them to use it: no enforcement mandate, no deadline. Third, they keep the rest of their normal toolkit, which was never small: CCPA civil penalties alongside CalPrivacy’s administrative track. The pen register theory did not die; it gained a monopoly plaintiff with the statute’s full remedies and no obligation to use them.
In practice, §638.51 risk now equals one agency’s risk appetite. Whether that means quiet dormancy or targeted cases against the biggest brands is the open question.
For individuals, the “private action is completely gone” line you hear on LinkedIn needs a correction. It is gone for one claim, in one context: pen register and trap-and-trace claims over web and app tracking. Individuals keep:
- §631 (contents of communications; wiretapping), §632 and §632.7 (recording confidential communications, including cell and cordless calls)
- Common-law intrusion claims, which plaintiffs have always stacked on top
- Everything outside CIPA: the federal Wiretap Act/ECPA, the VPPA, California’s CDAFA and CMIA ($1,000 statutory damages there), and wiretap acts in other states (Florida, Pennsylvania, Arizona, Washington all have active waves)
- The CCPA itself has no private right of action; it never did. Plaintiffs cite it as the baseline for expectations of privacy in roughly 70–85% of these complaints (Matt Pearson’s estimate on the webinar), then sue under the statutes that do have teeth.
So the private bar lost its cheapest claim, not its ability to sue over tracking. Which leads to the part that should worry compliance teams more than SB 690’s supporters expect.
Where the plaintiffs go next: §631 is door number one
The pen register theory needed almost no elements: “I visited your site, something fired, therefore you needed a court order.” Plaintiffs are not dismissing their existing claims; Matt Pearson said on the webinar that they are going three steps deeper now: exercising fillable forms, typing into search bars, testing consent flows, looking for a §631-style contents claim or an ECPA claim, and only then filing.
Two dynamics make §631 claims live, and they interact:
The implied-consent argument gets its day. Matt’s analogy: CIPA is the same law that made every call centre say “this call may be recorded.” Once everyone said it, phone-recording suits collapsed, because courts accepted that clear disclosure plus staying on the line is consent. The same argument now goes to websites: crystal-clear banner language, visitor proceeds, contents collection disclosed, consent implied. Banner language that was pointless under pen register theory (nothing could cure a violation that fired on page load) suddenly carries the whole defense on §631.
CCPA opt-outs override it. If the visitor opts out, or flips on a Global Privacy Control signal, and the site’s tags fire anyway, the implied-consent defense is gone for that session; the disclosure said “you can say no,” the visitor said no, and the data moved anyway. That combination (good banner, broken opt-out propagation) is precisely the failure mode our scans at Privado find most: CMPs present, consent never propagating to tags, pixels firing on the first page load regardless.
Meanwhile the market re-prices. Fewer, deeper claims: the report found 2026 class-wide web privacy settlements at $1.4 billion (about 60 times all CCPA penalty actions since 2022 combined, roughly $23 million), filings up 18x, and the average settlement up 12% to $6.7 million. Mobile app cases were only 8% of filings but settle materially higher, because persistent identifiers make classes certifiable, and certification is what takes a case from X to 10X. Expect the demand-letter economy, estimated at 50,000–100,000 letters between 2022 and 2025 (report estimate; counsel put the letter-to-suit ratio around 100:1), to re-stack on §631, ECPA, VPPA, CMIA and the other states’ wiretap acts rather than disappear.
One appellate footnote worth watching: a California appellate panel’s late-August tentative in Variety Media reportedly read the pen register definitions technology-neutrally (rejecting the “telephone-only” defense) while sustaining a demurrer on the facts, because an IP address identifies the source of a communication rather than its destination. It is a tentative, not a holding. Depending on how claims are re-pleaded, it helps and hurts both sides.
The regulators stay open: door number two
The pen register prohibition still exists, and the AG can still sue under it, with the same statutory-damages logic that made it so lucrative. Separately, the CCPA track that regulators were already running continues: the AG’s eight CCPA actions since 2022 (Sephora through GM’s $12.75 million) plus CalPrivacy’s three (Tractor Supply $1.35 million, Honda, Todd Snyder) form the roughly $23 million baseline, with the data-broker DROP regime forcing deletion-processing on 45-day cycles, agency audits that may be unannounced, and $200-per-day registration fines. The FTC’s tracker cases (GoodRx $1.5M, BetterHelp $7.8M) continue in parallel.
The operational checklist that post-690 §631 defense and regulatory enforcement both converge on: banner before pixels, opt-out actually suppressing every vendor, no miscategorised cookies, no zombie pixels from abandoned POCs, search terms not embedded in URLs, and form data not shipped to third parties. Two doors, one to-do list.
The retroactivity clause
This is the piece the pending defendants should read twice. Roughly 4,000 CIPA actions were pending as of July 2026 by the legislature’s own committee count, most pleading pen register claims, and most filed on or after January 1, 2025. Under §637.2(d)(2), the newest of those cases face having the pen register count stripped when the provision turns operative. Goodwin calls the retroactivity provision potentially the bill’s most consequential feature for pending cases, and the arithmetic explains why: a routine motion filed after January 1, 2027 becomes a dismissal vehicle at scale.
The clause also reads oddly, as a matter of text before anyone argues it. It bars claims in actions commenced on or after January 1, 2025, which is to say the newest filings, while any older-filed action keeps the claim. Both conditions come from the face of the statute: the claim must still be pending, and the two-year lookback runs from the January 1, 2027 operative date, not the September 30 signing date. Severability is the drafted-in safety net: if (d)(2) falls in some application, the forward-looking bar in (d)(1) stands on its own.
Demand letters sit outside the bar entirely. The statute speaks to claims “in an action,” and a threat to file is not a filed action. Defendants holding §638.51 demand letters gain leverage after the operative date, and plaintiffs’ counsel gain a to-do: actually file, or re-plead under §631. Matt Pearson reported plaintiff-side pushback against the retroactivity clause already, with constitutional challenges the expected arena; the National Law Review’s analysis notes that long-standing California Supreme Court precedent supports enforcing such express retroactivity provisions, and RecordingLaw’s walkthrough declines to predict how any single case lands. The Governor has already invited round two next year.
The whole thing on one page
Sources and caveats
- Primary: enrolled bill text via leginfo (amended §637.2, subdivision (d) verbatim); bill history (Assembly 66–0 and Senate 39–0 on August 28, 2026; presented September 4; approved and chaptered September 30, 2026 as Chapter 976); Governor’s signing message (September 30, 2026); Cal. Const. art. IV, §8(c)(1) operative-date rule; §638.50/§638.51 text.
- Enforcement arithmetic: CA AG’s CCPA enforcement ledger (eight actions, Sephora through GM) and CalPrivacy’s decision PDFs (Tractor Supply), cross-checked in an earlier fact-check memo; the “about 60:1” ratio against $1.4B in 2026 class-wide settlements per Privado’s 2026 Website & App Privacy Litigation Report.
- Litigation volume: the legislature’s committee analysis of ~4,000 CIPA actions as of July 2026 (via Goodwin); OneTrust’s count of 800+ CIPA claims in 2025; the ~600 → ~4,000 §638.51 filing rise since February 2025 (Duane Morris, Sidley and Clark Hill tallies).
- Case law named: Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024 (S.D. Cal. 2023), via RecordingLaw’s CIPA explainer with the CourtListener docket; pen-registers-as-software quote as bracketed there.
- Webinar grounding: Matt Pearson’s statements on claim re-pleading and retroactivity pushback are from the Privado webinar of October 14, 2026.
Disclosure: this article was researched and drafted with the assistance of AI; every figure and quotation was verified against primary sources, and the published review is the author’s.