California's SB 690 Strips Private CIPA Pen Register Claims, Applies Retroactively
Signed 30 September 2026, effective 1 January 2027, SB 690 limits CIPA pen register and trap-and-trace suits over website and app tracking to the California attorney general, retroactively to claims filed on or after 1 January 2025.
California Governor Newsom signed Senate Bill 690 on 30 September 2026, amending the enforcement section of the California Invasion of Privacy Act (Section 637.2) so that claims arising from conduct on an internet website, online application or mobile app under the pen register and trap-and-trace provisions (Section 638.51) may be brought only by the state attorney general. Private plaintiffs lose standing to assert those theories against analytics tags, pixels, cookies or session-replay tools, removing the aggregated US$5,000-per-violation damages exposure that drove the recent wave of CIPA litigation.
Counsel should note the mechanics and limits. The statute takes effect 1 January 2027 but operates retroactively to any action commenced on or after 1 January 2025, with a severability clause preserving prospective-only relief if retroactivity is successfully challenged — a challenge the firm notes faces long-standing California Supreme Court precedent. The amendment leaves private enforcement of CIPA's antiwiretapping provisions (Sections 631-632) intact; plaintiffs routinely plead those alongside Section 638.51, and they remain the principal residual exposure.
Practical steps: defendants in pending or threatened Section 638.51 claims should assess the retroactivity window and whether to move for dismissal; demand-letter recipients gain negotiating leverage where parallel claims survive. Companies should also audit consent and disclosure practices against attorney general enforcement and CCPA-authorized state actors.