California SB 690 ends private trap‑and‑trace suits over website tracking
Effective Jan 1 2027 with two‑year retroactive reach, the law shifts enforcement to the California Attorney General, limiting class‑action exposure for cookies, pixels and similar technologies.
On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 690 into law, amending Penal Code § 637.2 to eliminate the private right of action under § 638.51 for alleged violations involving website‑based pen registers or trap‑and‑trace devices such as cookies, pixels and similar tracking technologies. Effective January 1, 2027, the statute applies retroactively for two years, covering claims arising from conduct dating back to January 1, 2025. Thereafter, only the California Attorney General may bring such actions, although plaintiffs may still pursue claims under related wiretapping statutes (§§ 631(a), 632) or assert independent torts. The change curbs a wave of putative class actions that have targeted online tracking practices, reducing litigation exposure for companies that deploy analytics tools, ad tech or third‑party data sharing. Counsel should review cookie‑banner mechanisms, consent protocols, privacy policies and third‑party data‑sharing agreements to ensure compliance, monitor for constitutional challenges to the retroactive provision, and watch for any guidance from the Attorney General’s office on enforcement priorities.