SB 690 is law: California ends private pen register suits over website trackers

What changed

On 30 September 2026, Governor Newsom signed SB 690 (Chapter 976, Statutes of 2026). From 1 January 2027, a private plaintiff can no longer sue a business under Penal Code § 638.51, the pen register and trap and trace provision of the California Invasion of Privacy Act (CIPA), for conduct on a website, online application or mobile application. Those claims now belong to the California Attorney General alone.

The bill passed the Assembly 66-0 on 28 August 2026, and the Senate concurred 40-0 the same day.

The litigation it targets

CIPA predates the commercial internet. Section 638.51 was written for devices that record the numbers a telephone dials. Over the past few years, plaintiffs’ firms have argued that ordinary website tools, such as cookies, pixels and third-party scripts that record a visitor’s device and browsing signals, are “pen registers” too. Because § 637.2 gave a private right of action with statutory damages, the theory fuelled a high volume of demand letters and suits against businesses of every size.

What the statute says

SB 690 adds a new subdivision (d) to Penal Code § 637.2. Subdivision (d)(1) provides that an action against a private actor for a violation of § 638.51 “alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.”

Subdivision (d)(2) makes this retroactive: the amendments “apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation.” With an operative date of 1 January 2027, that reaches pending § 638.51 website claims in actions filed on or after 1 January 2025. Demand letters that never became a filed action are not “actions commenced”, so the retroactivity clause does not speak to them, although the bar on new private suits applies once the law is operative.

What it does not change

SB 690 is narrow. It removes the private right of action for one section, in one setting. It does not touch CIPA § 631(a), the wiretapping provision that plaintiffs also use against session replay, chat widgets and pixels, nor § 632 or § 632.7. Private claims under those sections remain available. It does not make § 638.51 website conduct lawful, since the Attorney General can still bring those claims. And it has no effect on CCPA/CPRA obligations, including opt-out rights and the Global Privacy Control signal.

The appellate court is narrowing the theory as well

A week before the legislature acted, the Court of Appeal, Second Appellate District, Division Three, issued a tentative ruling in Variety Media, LLC v. Superior Court (No. B350578), an early appellate look at whether § 638.51 reaches website trackers. The tentative ruling went both ways.

It rejected the argument that the pen register definition is limited to telephones, reading it, like the federal definition it was modelled on, to reach devices or processes that record metadata of online communications. But it found the complaint deficient. A pen register captures information identifying the destination of an outgoing communication, while a visitor’s IP address identifies its source. Collecting the IP address alone, on that reasoning, does not plead pen register activity. The tentative disposition would sustain Variety’s demurrer with leave to amend.

A tentative ruling is not an opinion. Oral argument took place on 25 August 2026, and the panel can revise its reasoning before a final decision issues. Even so, the reasoning matters after SB 690. It is a guide to how a court may read § 638.51 in an Attorney General action and in claims outside the website context.

What this means for a site operator

For businesses facing private pen register demands over website trackers, SB 690 removes that exposure from 1 January 2027, and gives a route to dismiss qualifying pending suits filed since 1 January 2025. It is relief from one litigation channel, not a change in what the law expects of tracking.

The same tracking can still be pleaded as wiretapping under § 631(a). CCPA/CPRA opt-out duties are unchanged. Visitors from opt-in regimes such as the GDPR and the DPDPA still require consent before non-essential trackers fire. A tracker inventory, and evidence of what fired before and after each visitor’s choice, remains the defence that holds across all of these.

Sources

• California Legislature, SB 690 (2025-26), bill text, history and votes leginfo.legislature.ca.gov
• California Court of Appeal, Second Appellate District, Division Three, Variety Media, LLC v. Superior Court, No. B350578, tentative ruling (August 2026) cipaworld.com
• Jones Day, Legislature and Appellate Court Bring Clarity to California Invasion of Privacy Act jonesday.com
• Shumaker, Loop & Kendrick, California SB 690: What It Does, and Does Not, Mean for Pending CIPA Website-Tracking Claims shumaker.com
• Stinson LLP, California Bill Limiting CIPA Claims Becomes Law stinson.com