Governor Newsom Signed SB 690. What Changes for CIPA Pen Register Lawsuits?

What Did the Governor Decide?

Governor Newsom signed SB 690 on September 30, 2026, the last day he had to act. The Legislature passed the bill on August 28 without a no vote. It was sent to the Governor on September 4.

In his signing message, the Governor wrote that the bill "addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses." He also wrote that "additional work in this area is needed, as CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants." He urged the Legislature to address them next year. The message does not name those statutes, but they likely include Section 631, the wiretapping provision that many demand letters cite.

The bill he signed is much narrower than the version introduced in early 2025. The original version would have exempted any tracking done for a "commercial business purpose" from CIPA, including the Section 631 wiretapping provision. After privacy and consumer groups objected, the bill was narrowed on July 2, 2026 to a single change in who may sue under the pen register provision.

What Changes on January 1, 2027?

Starting January 1, 2027, SB 690 changes who can sue under Section 638.51, CIPA's pen register provision. The new text of Section 637.2 reads, "An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General." The prohibition itself stays in place.

The change also applies "retroactively to any pending claim in an action commenced within two years before the operative date." That window covers lawsuits filed on or after January 1, 2025. Lawsuits filed earlier are not covered.

Based on the enrolled text of SB 690, as of October 1, 2026.

This removes a common claim in recent website tracking lawsuits. Plaintiffs have argued that a script which captures a visitor's IP address and device details is a pen register. The claim carries $5,000 per violation. It also does not require showing that the contents of a communication were intercepted.

What Does Not Change?

SB 690 does not change Section 631 of CIPA. That section prohibits reading the contents of a communication in transit without the consent of all parties. It is the provision behind many demand letters, including the search bar claims that have spread this year. The federal Wiretap Act, common law privacy claims, and the wiretapping laws of other states also remain unchanged.

The law also does not decide whether analytics tools and social media pixels count as pen registers. That question stays with the courts. The Attorney General may still bring the claim that private plaintiffs lose access to. It is not clear how much priority the office will give website tracking claims.

What Happens to Pending Lawsuits and Demand Letters?

For lawsuits filed since January 1, 2025, the pen register claim ends on January 1, 2027, if the case is still pending then. Defendants may ask courts to pause those claims until that date, although courts are not required to agree. Other claims in the same lawsuit continue. Many recent complaints plead a Section 631 wiretapping claim alongside the pen register claim.

A demand letter that has not become a lawsuit now has a weaker pen register claim behind it. The sender can still file the claim before January 1, but it would end on that date if the case is still pending. Some senders may push for faster settlements before then. Others are likely to rewrite their letters around Section 631.

Arbitration demands are less clear. The new text limits an "action" brought under Section 637.2. It appears to be unsettled whether an arbitrator will apply that limit the same way a court would.

What Should a Business Do?

A business with a demand letter or a pending lawsuit should raise SB 690 with its counsel. The law may reduce the value of a claim that rests only on Section 638.51. It helps much less when the letter or complaint also cites Section 631, which many do.

For everyone else, the facts that decide these claims have not changed. What matters is which tools run on the site, what data they send and to whom, whether the visitor's consent choice is honored, and whether the privacy notice describes it accurately. My advice is to plan as if the lawsuits will continue.