Major Development for CIPA Complaints: California Legislature Passes SB 690, Eliminating Private Pen Register Claims Under CIPA

On August 28, 2026, both chambers of the California Legislature passed SB 690 and transmitted it to Governor Newsom, who has now signed the bill. The bill eliminates the private right of action for pen register and trap and trace claims brought under Penal Code Section 638.51, which is part of the California Invasion of Privacy Act (“CIPA”), in connection with an internet website, online application, or mobile application, and vests enforcement of that provision exclusively in the California Attorney General.

CIPA enacted in 1967, was originally directed at telephone line wiretapping. Over the past several years, plaintiffs have applied its pen register and trap and trace provisions to ordinary website technology, including cookies, pixels, analytics tools, and chat widgets, on the theory that those tools capture information about a visitor's online activity in the manner of a pen register. Because CIPA provides statutory damages of at least $5,000 per violation without any requirement to demonstrate actual harm, the theory has supported more than 4,000 filings and demand letters against businesses across sectors, according to some litigation tracking efforts. Businesses and website operators have struggled with these complaints, as complaints alleged these ordinary website tools arose to “wiretapping” activities.

Provisions Removed During the Legislative Process

The narrowing of the bill during the legislative process is itself notable. The original text of the bill, as introduced in February 2025, was considerably broader and would have reached a wider set of CIPA claims. The provisions addressing Section 631, which governs wiretapping, and Section 632, which governs the recording of confidential communications, were removed during the legislative process, and the version that passed targets a single provision of the statute. The Legislature ultimately adopted a more targeted approach, focusing on the provision that has generated a substantial volume of website-tracking litigation while leaving traditional wiretapping and recording claims under Sections 631 and 632 intact. That outcome may reflect an effort to address concerns arising from the application of decades-old surveillance statutes to commonplace website technologies without broadly limiting private enforcement under CIPA.

Challenges and Areas of Uncertainty

Both Section 631 and Section 632 remain in force and carry the same statutory damages exposure. The federal Electronic Communications Privacy Act, the Video Privacy Protection Act, and the analogous state wiretap statutes in Florida, Pennsylvania, Arizona, and Washington, which plaintiffs' firms have increasingly turned to as alternative theories in website-tracking litigation, are likewise unaffected. Of the CIPA matters filed to date, roughly one third rest on a pen register or trap and trace theory alone, and roughly another third pair that theory with a second CIPA count. Matters in the second category can be expected to proceed on the surviving count.

Separately, the California Court of Appeal is expected to issue a decision addressing the scope of the pen register provisions. Because SB 690 removes only the private right of action and leaves the substantive prohibition and the Attorney General's enforcement authority in place, that decision will remain relevant to the contours of the provision and to matters outside the retroactive window.

Retroactive Application to Pending Claims

Rather than limiting the bill's effect to future claims, SB 690 would take effect on January 1, 2027, and reaches back two years from that operative date, which covers claims filed since approximately the start of 2025, and therefore may affect a meaningful number of pending cases. The provision arguably reflects a legislative judgment that private enforcement of Section 638.51 claims arising from website-tracking technologies warrants different treatment than has developed through recent litigation. At the same time, the retroactive application of the statute may itself become the subject of litigation as courts consider its effect on pending claims. 

Key Considerations for Companies

More broadly, the bill does not eliminate the underlying prohibition. SB 690 narrows one high volume category of CIPA claim and transfer enforcement authority from private litigants to the California Attorney General. In that sense, SB 690 represents less a determination that the conduct should be permissible and more a policy judgment regarding who should enforce the statute and under what circumstances.

The practical effect will depend on how the retroactivity provision fares in court and on how quickly plaintiffs' firms reconfigure their filings around other laws or the provisions that remain. Companies should evaluate the retroactivity provision against their specific procedural posture and treat website tracking governance as a continuing obligation. On a more high-level note, website tracking governance requires ongoing review rather than a single audit, because tag inventories and vendor configurations change frequently. 

To receive the latest insights on US legal developments, subscribe to the Freshfields A Fresh Take Blog.