California Enacts CIPA Reform, Curtailing Some Website Tracking Claims

On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 690 (SB 690), significantly narrowing the California Invasion of Privacy Act (CIPA) claims private plaintiffs may bring based on tracking technologies used on websites and applications.

SB 690 addresses a theory that has become increasingly common in CIPA litigation: alleging website technologies such as cookies, pixels, analytics tools, and similar technologies are “pen registers” or “trap and trace devices” in violation of California Penal Code Section 638.51 when they collect or transmit information such as IP addresses and other identifying information.

The wave of CIPA litigation has been substantial. According to Reuters, more than 4,700 lawsuits involving digital wiretapping claims have been filed since 2022, with approximately two-thirds including a CIPA pen-register claim. CIPA’s statutory damages provision, which permits recovery of $5,000 per violation, has created potentially significant exposure for businesses facing these claims.

In his signing message, Governor Newsom said SB 690 addresses this “vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses.” He also urged further reform to strike “a fair balance between protecting private information and preventing rapacious litigation.”

What Changes?

Effective January 1, 2027, SB 690 eliminates the private right of action for alleged Section 638.51 violations arising from conduct on an internet website, online application, or mobile application. For covered conduct, enforcement against private parties will instead rest with the California Attorney General.

Governor’s Announcement: https://www.gov.ca.gov/wp-content/uploads/2026/09/SIGN-msg-SB-690.pdf

Importantly, the amendment is retroactive and includes pending claims in actions commenced during the two years preceding its operative date.

What Businesses Should Know

• Existing Section 638.51 claims deserve a fresh look. Businesses currently defending website or app-based pen-register claims should evaluate whether SB 690’s retroactive application provides a basis to challenge those claims.
• One significant source of settlement pressure is being removed. Private plaintiffs will no longer be able to pursue covered Section 638.51 claims.
• Expect the theories to shift, not disappear. SB 690 does not eliminate private claims under other provisions of CIPA, including Section 631 against wiretapping and other privacy laws.
• Website compliance still matters. Businesses should continue evaluating what technologies are appropriate for their business needs, and analyze their website technology, notices, and policies in line with those needs. They should determine what information is collected and transmitted, who receives it, and whether disclosures and consent mechanisms accurately reflect those practices. They should test if the technology functions properly and as expected to minimize risks from unintended misalignments.
• Further CIPA reform may be coming. In his signing message, Governor Newsom called for additional legislative action in 2027 to address other provisions of the decades-old statute.

The immediate takeaway is significant: SB 690 gives businesses a strong basis to challenge pending website-based pen-register claims and reduces a major source of statutory-damages exposure and settlement pressure. But the broader risk remains. Businesses should promptly reassess existing matters and continue evaluating exposure under Section 631 and other applicable state and federal privacy laws based on their industry.

This publication is intended for general informational purposes only and does not constitute legal advice or a solicitation to provide legal services. The information in this publication is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional legal counsel. The views and opinions expressed herein represent those of the individual author only and are not necessarily the views of Clark Hill PLC. Although we attempt to ensure that postings on our website are complete, accurate, and up to date, we assume no responsibility for their completeness, accuracy, or timeliness.