California Curbs CIPA “Pen Register” Suits - But the Website Tracking Litigation Wave Isn’t Over

On August 28, 2026, the California Legislature unanimously passed Senate Bill 690, legislation aimed directly at the wave of California Invasion of Privacy Act (CIPA) lawsuits alleging that ordinary website and application technologies constitute unlawful “pen registers” or “trap and trace devices.” The Assembly approved SB 690 by a 66–0 vote, and the Senate unanimously concurred in the Assembly’s amendments. The bill now proceeds to Governor Gavin Newsom. Because SB 690 cleared both houses without a single “no” vote, a veto appears unlikely.

If signed, SB 690 would eliminate “pen register” and “trap and trace” private lawsuits under one section of CIPA — Cal. Penal Code § 638.51 — when the challenged conduct occurs on a website, online application, or mobile application, but it is unlikely to curb website tracking claims altogether, as many of these claims rely on other legal theories that are not addressed by SB 690. Companies have watched with growing alarm as plaintiffs’ counsel have sent demand letters to thousands of businesses whose online practices were entirely conventional, deploying the same cookies, pixels, and analytics tools used across the commercial internet, while the threat of statutory damages has driven the widespread adoption of EU-style cookie consent banners as a partial shield, much to the frustration of click-weary users navigating an ever-growing thicket of pop-ups.

Plaintiffs have argued that a wide range of ordinary website data collection practices, including use of common advertising and analytics tools, involve “pen registers” or “trap and trace devices” within the meaning of § 638.51. SB 690 would block those lawsuits and would instead shift enforcement responsibility for § 638.51 to the California Attorney General.

Critically, SB 690 leaves intact other portions of CIPA that plaintiffs have relied upon for similar claims, including §§ 631 and 632, which regulate wiretapping, recording of confidential communication, and other forms of electronic eavesdropping. SB 690 also will not affect similar claims plaintiffs have brought under other federal and state laws outside of CIPA altogether, including common law privacy claims, claims under other state laws such as the California Comprehensive Computer Data Access and Fraud Act (CDAFA) and other states’ wiretapping laws, and claims under the federal Electronic Communications Privacy Act (ECPA).

However, because those alternative theories typically require plaintiffs to show that website tracking captured the “contents” of communications or violated a “reasonable expectation of privacy” — elements the § 638.51 theory allowed plaintiffs to sidestep — SB 690 could, if signed, meaningfully reduce the volume of website tracking claims, which has exploded in recent years.

For companies already defending cases under § 638.51, the bill would also apply retroactively to certain pending claims. Although the retroactivity provision could be challenged in court, SB 690 could provide a path to dismissal in a substantial number of existing cases and materially alter defendants’ settlement posture.

What SB 690 Would Change

CIPA § 638.51 prohibits any person from installing a “pen register” or “trap and trace device” without user consent, a court order, or another exception. CIPA currently permits a person injured by a violation to seek the greater of $5,000 per violation or three times the person’s actual damages. A plaintiff need not prove actual damages.

Beginning around 2023, plaintiffs invoked § 638.51 to challenge technologies that collect IP addresses, device identifiers, routing information, and similar data from visitors to websites or applications. These cases have targeted common analytics, advertising, fraud prevention, and session monitoring tools. The legislature heard that 4,000 lawsuits alleging CIPA violations had been brought in California as of July, many of which include claims under § 638.51, though others paired a § 638.51 claim with other CIPA theories such as § 631 wiretapping.

Unlike claims under other sections of CIPA or other privacy statutes, plaintiffs alleged that § 638.51 was not limited to claims involving a disclosure of “contents” of communications, sensitive data, or any violation of a plaintiff’s reasonable expectations of privacy. Moreover, the possibility of statutory damages for each alleged violation — sometimes asserted on a per-visit or per-page-view basis — created potentially enormous exposure and substantial pressure to settle even weak claims. Plaintiffs also typically argued that consent banners could not cure a violation because trackers fired the moment a visitor loaded the page, effectively turning § 638.51 into a strict liability statute. While courts have limited such claims in some instances, courts had not yet shut down plaintiffs’ core legal theory in such cases.

As enrolled, SB 690 would amend Cal. Penal Code § 637.2 by changing the enforcement mechanism for § 638.51. SB 690 would revoke plaintiffs’ private right of action for § 638.51 arising from conduct occurring on an internet website, online application, or mobile application.

Instead, only the California Attorney General could bring a civil action against a private actor for an alleged § 638.51 violation in the covered circumstances. The bill does not declare that the challenged technologies are lawful or amend the substantive prohibition in § 638.51. SB 690 is thus an enforcement fix rather than a substantive one: While it removes one of the tools plaintiffs have used to bring class-level claims, it does not change the legality of the underlying conduct, and the Attorney General may still assert the same theories that animated plaintiffs’ claims.

What SB 690 Doesn’t Change

CIPA § 638.51 is only one of several legal theories plaintiffs have used to bring claims relating to website tracking. Common legal theories have involved other provisions of CIPA — including §§ 631 and 632 — which prohibit “wiretapping” and “eavesdropping” without the consent of all parties to a communication. To succeed under these provisions, plaintiffs usually must allege that the relevant conduct intercepted “contents” of communications or infringed upon a “reasonable expectation of privacy.” SB 690 reaches the governor in a form far narrower than initially introduced. The original February 2025 bill would have barred claims under §§ 631, 632, and 638.51 whenever the challenged technology was deployed for a “commercial business purpose.” That version passed the Senate 35-0 in June 2025 but stalled in the Assembly over the breadth of the carve-out, and the Assembly Privacy and Consumer Protection Committee narrowed the bill in July 2026 to reach only § 638.51 claims. The measure’s laborious legislative history signals that companies should not expect further CIPA relief from Sacramento anytime soon.

Plaintiffs have also brought similar claims under other federal and state laws, including ECPA, the Video Privacy Protection Act (VPPA), CDAFA, consumer protection statutes, other state wiretapping laws (such as those in Florida, Pennsylvania, Arizona, and Washington), contract theories, and common law claims. Plaintiffs are not foreclosed from continuing to bring those claims to challenge websites’ use of cookies, pixels, SDKs, session replay software, chat tools, or other website technologies.

Accordingly, SB 690 would not:

• Eliminate claims alleging wiretapping under CIPA § 631;
• Eliminate claims alleging a recording of confidential communications under CIPA § 632;
• Create an affirmative safe harbor for website-tracking technologies;
• Supersede the California Consumer Privacy Act (CCPA) or California Privacy Rights Act (CPRA); or
• Prevent claims under other federal or state laws.

Implications for Pending Litigation

For companies already facing § 638.51 lawsuits, SB 690’s retroactivity provision may be its most consequential feature — if the provision survives any potential challenges.

The amendment would apply to any pending claim in an action commenced within the two years preceding the bill’s operative date. Because SB 690 is not urgency legislation, it is expected to become operative on January 1, 2027, if signed. On that timetable, the provision could reach pending actions commenced on or after January 1, 2025.

Potential Dismissal of Pending § 638.51 Claims

Once the legislation becomes operative, defendants in covered cases are expected to argue that private plaintiffs may no longer maintain their § 638.51 claims. Depending on the case’s procedural posture, that could support a motion to dismiss, a motion for judgment on the pleadings, summary judgment, or another request for disposition of the affected claims. The elimination of § 638.51 claims could also make class certification more challenging in website tracking cases.

The bill’s language applies to a pending “claim,” rather than only to an action asserting § 638.51 as its sole cause of action. It therefore may eliminate a § 638.51 claim even when the same lawsuit includes claims under CIPA § 631 or other laws.

Application of the amendment will nevertheless require a case-specific analysis. Relevant questions will include when the action was commenced, whether it remains pending on the operative date, whether the defendant is a “private actor,” and whether the alleged conduct occurred on a website or covered application. However, as discussed below, plaintiffs may shift or amend these claims to be brought under other theories, including other sections of CIPA.

Requests to Stay or Limit Ongoing Proceedings

Companies should evaluate whether SB 690 provides a basis to seek a stay or other case-management relief until January 1, 2027. Courts may be asked to postpone discovery, class certification proceedings, expert work, or dispositive motion deadlines that relate primarily to a § 638.51 claim that could soon become legally unavailable.

A stay will not be automatic, and courts may be reluctant to stay cases, particularly when other claims are also alleged. Defendants should therefore weigh the likelihood of relief against the cost of litigating a stay request and should continue meeting existing deadlines unless the court orders otherwise.

Changed Settlement Leverage

This legislation may materially improve defendants’ leverage in pending cases and pre-suit negotiations. Plaintiffs asserting only a § 638.51 theory may face the prospect that their claim will disappear when the law becomes operative. Companies should reassess settlement demands in light of that possibility before paying to resolve claims that may soon be subject to dismissal.

At the same time, enactment would not automatically unwind completed settlements or final judgments. A company considering settlement should also account for the possibility of a gubernatorial veto, challenges to retroactive application, the continuing cost of defense, and any claims that fall outside SB 690.

Settlement agreements should be drafted with the bill’s limited scope in mind. Resolving a § 638.51 claim alone may not prevent a claimant from attempting to assert a claim under another theory.

Expected Shift to §§ 631 and 632 and Other Theories

SB 690 is likely to change rather than completely end website tracking litigation. Plaintiffs may respond by emphasizing CIPA’s other provisions, §§ 631 and 632 — or the other theories discussed — which remain enforceable through private actions.

That distinction will place greater importance on whether a challenged technology allegedly captured the “contents” of a communication or merely dialing, routing, addressing, or signaling information. Defendants should scrutinize complaints that repackage the same factual allegations under §§ 631 and 632 without adequately alleging interception of communication contents or the other elements required by that provision.

Possible Challenges to Retroactivity

Plaintiffs can be expected to challenge the retroactivity provision or argue that it does not apply to particular cases. SB 690 includes a severability clause, reflecting the legislature’s intent for the remainder of the law to survive if a court invalidates a particular provision or application.

Until appellate courts address these issues, trial courts may differ in how they apply the statute to pending litigation. Defendants should preserve all statutory and retroactivity arguments and avoid assuming that dismissal will occur automatically.

Notably, appellate courts are simultaneously hearing challenges to § 638.51, which may impact ongoing litigation should the retroactivity provision be challenged. In Variety Media, LLC v. The Superior Court of the County of Los Angeles, Case No. B350578, the California Court of Appeal is assessing whether § 638.51 is inapplicable to internet tracking technologies, and in Drummer v. CoStar Group, Inc., No. 26-1160 (9th Cir. 2026), the Ninth Circuit will address whether a consumer asserting a claim under § 638.51 has Article III standing based on the type of information transmitted using website tracking technologies. The California Court of Appeal heard argument in Variety Media and, unless the case is mooted by SB 690, should issue a decision in the coming weeks to months.

What Companies Should Do Now

Given SB 690’s narrow scope and the continued threat of website tracking claims, companies should continue to evaluate risks related to website tracking and employ risk-appropriate mitigation strategies, such as an opt-in cookie consent banner, consent tracking and adherence, and comprehensive privacy policies and terms. A consent banner that blocks all non-essential trackers until a website visitor consents to the tracking (or other opt-in consent for mobile apps) continues to be the strongest defense to tracking claims. Companies should additionally continue to comply with California’s and other states’ privacy laws, such as the CCPA and CPRA.

In addition, companies should continue reviewing and periodically auditing their tracking technologies, consent mechanisms, and privacy disclosures to make sure they are working as intended. SB 690 may remove a frequently asserted cause of action, but it does not eliminate the underlying compliance and litigation risks associated with website data collection.

Companies with pending demands or litigation should work with counsel to:

• Identify each § 638.51 claim and confirm when the underlying action was commenced;
• Separate § 638.51 allegations from any § 631 or other claims that would survive enactment;
• Consider whether to seek a stay or modification of case deadlines until January 1, 2027;
• Reevaluate settlement strategy and unresolved demands in light of the potential loss of private enforcement;
• Preserve arguments concerning retroactivity and the plaintiff’s authority to maintain the claim;
• Review proposed releases to ensure they address all potentially related CIPA and privacy theories; and
• Continue preserving relevant technical evidence, including information about data flows and the operation of challenged technologies.

What Comes Next

SB 690 has completed the legislative process and will be presented to the governor. Governor Newsom may sign the bill, veto it, or allow it to become law without his signature; he is expected to have until September 30, 2026, to act. If enacted, the legislation is expected to become operative on January 1, 2027.

For companies confronting relentless § 638.51 demands and lawsuits, enactment would represent substantial — and potentially dispositive — relief. The immediate task is to determine which pending claims fall within the retroactivity provision, preserve the issue procedurally, and prepare for plaintiffs to shift their allegations to CIPA provisions that SB 690 leaves intact.

* * *

Goodwin will continue to monitor developments such as those described here and their potential implications. Please contact the Goodwin team with any questions related to SB 690 or website tracking litigation and if we can assist you with counsel in responding to any inquiries or litigation.