California SB 690 Ends Private CIPA Pen Register Lawsuits
California just put a stop to one of the most common CIPA claims against businesses.
On September 30, 2026 (the deadline to act on the bill), Gov. Newsom signed SB 690, amending the California Invasion of Privacy Act (CIPA). CIPA has a "pen register" section, written for devices that record the numbers dialed from a telephone. Plaintiffs' lawyers have argued that ordinary website tracking tools do the same thing. SB 690 takes away the right of private individuals to sue under that section over website or app tracking, and instead puts enforcement in the hands of the state's Attorney General.
It's about time; I've seen clients and their customers threatened because they used standard website analytics (Google Analytics, LinkedIn, etc.) and I know of businesses that paid $10,000 or more to avoid the threatened litigation.
CIPA damages are expensive (potentially $5,000 per violation), and defending a lawsuit can cost over $100,000, so it's a rare business or insurer that's willing to fight just to prove that they're right. Starting January 1, 2027, that changes for these pen register claims. The law also applies to pending lawsuits filed since January 1, 2025.
What I found interesting is that the governor included a signing message praising the legislation and urging the legislature to fix other sections of CIPA: "However, additional work in this area is needed, as CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants." So this isn't the end of CIPA claims. Expect plaintiffs to pivot to CIPA's wiretapping section (Penal Code § 631), which could potentially apply to session reply and interactive chat tools, rather than to general analytics tools. While an early draft of the bill would have exempted uses for "a commercial business purpose," the final version did not. Also, this law doesn't undo past payments, and a business that truly violates CIPA remains subject to enforcement.
If you've received a CIPA demand letter, contact me before making any decisions on whether to pay. I can provide you with cost-effective guidance in collaboration with California litigation counsel. The demand letters are scary, especially if you're not a lawyer who understands the legal and technical issues involved. And if your website's consent practices and Privacy Policy haven't been reviewed recently, you're still vulnerable under other parts of CIPA and other privacy laws.
This is brand new, so I'm interested to know how others have dealt with these issues, and whether you think SB 690 will be effective.
See below for Gov. Newsom's signing statement.
