California Passes Bill to Limit CIPA Website Tracking Lawsuits
A new bill awaiting the governor's signature would retroactively eliminate the private right of action for certain website privacy claims based on the use of common tracking tools.
The California Legislature has passed SB 690, a bill expected to be signed by the governor that would provide significant relief to businesses defending against a wave of privacy lawsuits under the California Invasion of Privacy Act (CIPA). The bill eliminates the private right of action for 'pen register' and 'trap-and-trace' claims based on the use of common website analytics tools, such as cookies and pixels, that track user IP addresses and other transactional data. For companies facing demand letters or active litigation, the bill is particularly significant because it applies retroactively to claims commenced within two years of its expected January 1, 2027, operative date. While plaintiffs are expected to challenge the retroactivity provision, this development could end a substantial category of class action litigation. Counsel should note, however, that the bill does not prevent the California Attorney General from bringing such claims, nor does it impact plaintiffs' ability to sue for the alleged interception of communication content under other CIPA sections or the Federal Wiretap Act.