California SB 690 Ends Private CIPA Claims Over Website Tracking Tech
Effective January 1, 2027, and with a two-year look-back to suits already filed, SB 690 leaves only the California Attorney General able to sue over alleged CIPA pen-register or trap-and-trace violations arising on websites and apps.
California has enacted SB 690, amending the California Invasion of Privacy Act (Cal. Penal Code § 638.51) to remove the private right of action for the law's "pen register" and "trap and trace device" provisions where the alleged violation arises from conduct on an internet website, online application, or mobile application; only the California Attorney General may bring civil-remedy actions in that category. The statute takes effect January 1, 2027 and, per the source, applies to claims in actions commenced during the two years before that operative date.
Why it matters: CIPA's $5,000-per-violation or triple-actual-damages remedy has driven a volume of class-action and prelitigation demands against companies deploying cookies, pixels, session-replay tools, and analytics tags — technology the statute's 1967-era language never contemplated. Sophisticated counsel should read SB 690 as a targeted channel provision, not a safe harbour.
Next steps: audit pending and threatened CIPA/website-tracking matters for dismissal or stay strategies tied to the retroactivity window, while continuing consent and disclosure review of third-party site and app technologies, since wiretap-style and confidential-communication CIPA claims survive. Reported from a single law-firm alert; statutory text and retroactivity mechanics should be confirmed against the enacted law.