Businesses operating websites and mobile applications have faced a growing wave of lawsuits under the California Invasion of Privacy Act (CIPA), a 1967 statute enacted long before the modern internet. Plaintiffs increasingly argue that common website technologies—including cookies, pixels, and analytics tools—violate CIPA provisions originally aimed at wiretapping, eavesdropping, and pen registers.
That landscape changed on September 30, 2026, when Governor Gavin Newsom signed Senate Bill 690 (SB 690). The new law bars private enforcement of CIPA’s pen-register and trap-and-trace provision for conduct occurring on websites and online and mobile applications. It also applies retroactively to pending claims filed within two years.
A Brief History of CIPA: From Telephone Eavesdropping to Website Tracking
California enacted CIPA in 1967 in response to advances in electronic surveillance that made it easier to secretly monitor and record private telephone communications. The statute created criminal prohibitions and a private civil remedy, including statutory damages of the greater of $5,000 per violation or three times actual damages. A plaintiff need not prove actual damages to seek the statutory remedy.
Decades later, CIPA’s eavesdropping provisions became the basis for a new category of website litigation. Plaintiffs began alleging that technologies collecting IP addresses, device identifiers, and similar metadata qualify as a “pen register” because the statute defines the term to include a “device or process” that records or decodes routing, addressing, or signaling information. Courts have divided over those theories, but some allowed claims to proceed past the pleading stage. By 2025 and 2026, businesses across industries faced a flood lawsuits and demand letters targeting routine website technologies.
Governor Newsom Signed SB 690
SB 690 amends CIPA such that an action against a private actor for “pen register” or “trap and trace” violations arising from conduct on an internet website, online application, or mobile application may be brought only by the California Attorney General. In practical terms, plaintiffs no longer have a private cause of action to bring those website- or app-based CIPA claims.
The Governor’s signing message expressly tied the measure to what he described as the “vexatious use” of CIPA lawsuits and demand letters against small businesses that may have unknowingly installed website software that tracked and shared visitor information. At the same time, he emphasized that CIPA still contains other decades-old provisions that may be susceptible to aggressive litigation and urged the Legislature to continue working in this area next year.
The law also includes an important retroactivity provision: the amendment applies to any pending CIPA pen register or trap and trace claim commenced within two years.
This Is What It Changes for Businesses
The new law removes one increasingly prominent theory of private CIPA liability. Private plaintiffs may no longer pursue pen register or trap and trace claims based on conduct occurring on websites, online applications, or mobile applications. Businesses defending qualifying pending claims should evaluate whether the retroactivity provision provides a basis for dismissal or otherwise changes settlement and litigation strategy.
But the new law is narrow. It does not repeal CIPA, declare all website tracking lawful, or eliminate CIPA’s private right of action generally. The California Attorney General retains enforcement authority for the covered Section 638.51 claims. And private plaintiffs may still pursue other CIPA theories, including claims under Sections 631 (wiretapping) and 632 (eavesdropping), where the facts support them.
The likely result is not the end of CIPA website litigation, but a shift in theories. Plaintiffs’ counsel may focus more heavily on alleged interception of communication contents, consent timing, session-replay technologies, chat tools, and other privacy theories outside the new law’s targeted limitation of pen register and trap and trace claims.
Here’s What Businesses Should Do Next
Businesses currently facing CIPA lawsuits or demand letters should first identify the precise statutory provisions asserted and determine whether any Section 638.51 claim falls within the new law’s removal of private causes of action and retroactivity window of two years.
Companies should continue auditing technologies deployed on their websites and applications. That review should identify what each pixel, cookie, software development kit (SDK), analytics service, session-replay tool, chatbot, advertising platform, and other third-party technology collects; when collection begins; where information is transmitted; whether a third party uses the information for its own purposes; and what consent or disclosure mechanism applies before collection occurs.
Finally, businesses should review consent architecture, not just privacy-policy language. The timing and mechanics of consent can matter as much as whether a disclosure appears somewhere in a privacy policy.
The Bottom Line
The new law is a significant change for businesses facing website-based CIPA pen register or trap and trace claims. It ends private enforcement of such claims and may affect qualifying cases already pending. But it does not eliminate broader CIPA risk. Businesses should use the new law to reassess existing litigation risk with legal counsel while continuing to evaluate website tracking, disclosures, consent mechanisms, and remaining CIPA exposure.
