California Legislature Passes Bill to Kill Website Tracking Lawsuits
A bill awaiting the governor's signature would retroactively eliminate the private right of action for thousands of class actions under California's CIPA.
The California Legislature has unanimously passed SB 690, a bill that would eliminate the private right of action for claims that common website and app tracking technologies function as illegal "pen registers" under the California Invasion of Privacy Act (CIPA). This legislation is a direct response to a surge of nearly 4,000 proposed class actions filed since early 2025 targeting companies for using tools like tracking pixels, cookies, and session-replay software.
For corporate counsel and their outside firms, this is a critical development. With statutory damages of up to $5,000 per violation, CIPA pen-register claims created enormous potential exposure. The bill, if signed into law, would apply retroactively to cases filed on or after January 1, 2025, potentially extinguishing thousands of pending lawsuits. It is important to note, however, that the bill is narrowly tailored and does not affect other CIPA claims, such as wiretapping allegations under § 631, which are often brought in the same complaints.
Governor Newsom has until September 30, 2026, to sign or veto the bill; given the unanimous legislative support, it is expected to become law. Companies currently defending these lawsuits should immediately re-evaluate their litigation and settlement strategies.