Newsom Signs SB 690, Removing CIPA Pen Register Private Right of Action
California's September 30 enactment strips the private right of action under CIPA's pen register provision, materially changing exposure for communications, data broker, and subscriber-data litigation.
On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 690, amending the California Invasion of Privacy Act (CIPA) to remove the private right of action for violations of Section 638.51, CIPA's pen register provision. The available reporting does not set out the amendment's broader text, including any preservation of public enforcement or related statutory remedies, so the enrolled text should be read before reliance.
Why sophisticated counsel should care: CIPA's pen register provision has been a recurring source of class and mass-tort style filings against communications providers, data brokers, and technology companies. Removing a private remedy for one section narrows that litigation channel and can affect pleading strategy, class certification economics, settlement valuation, and the discovery posture of claims asserted on other theories. A further practical question for pending matters is whether the removal operates retroactively or only prospectively; the reporting summarized here does not address it, and it is likely to be litigated.
Concrete actions: review pending and threatened CIPA pen register cases for amendment or dismissal opportunities; audit whether other statutory or common-law hooks remain available on the same facts; and confirm the effective date and any savings language from the chaptered statute.