Newsom Signs SB 690, Ending Private CIPA Pen-Register and Trap-and-Trace Suits
Effective January 1, 2027, SB 690 removes private rights of action for website- and app-based pen-register and trap-and-trace claims under CIPA, cutting exposure behind a wave of wiretap-style privacy class actions.
On September 30, 2026, California Governor Gavin Newsom signed SB 690. According to the firm's client alert, the law takes effect January 1, 2027 and eliminates private actions for website- and app-based "pen-register and trap-and-trace" claims under the California Invasion of Privacy Act, while leaving other CIPA provisions intact — including the more common CIPA section 631.1 wiretap claim, which requires intentional tracking of a particular consumer's movements.
For counsel defending consumer-facing platforms, ad-tech vendors, and app operators, this removes a distinct category of privacy exposure. Pen-register theories have been used to allege that a company's own analytics or advertising pixels capture and disclose granular browsing activity without adequate notice or consent; because the theory does not depend on intercepting a specific communication, it has produced high-volume, settlement-prone litigation. Removing that pathway should change the calculus on class viability, discovery burdens, and settlement valuation for pending and threatened cases.
The January 1, 2027 effective date creates a timing question: plaintiffs may seek to preserve claims based on pre-effective-date conduct, and defendants will need to assess effects on stays, class periods, and residual exposure. Watch the statute's transition and retroactivity language. The alert excerpt is limited; confirm the scope of retained claims against the enrolled text.