Privacy LitigationWiretapping Laws
SB 690 Is Already Ending Pen Register Claims. Why Does CIPA Risk Remain?
Pending CIPA pen register claims are already ending under California's SB 690, even though the law does not take effect until January 1, 2027. In October 2026, a federal judge in San Francisco dismissed one of these claims. In a separate state court case, a plaintiff agreed to drop another. However, SB 690 does not affect the wiretapping and privacy claims often filed alongside them, so websites still face much of the same risk.
By Alex Proctor
Published October 25, 2026
Summary
Starting January 1, 2027, SB 690 allows only the California Attorney General to bring CIPA pen register claims over website and app tracking. The change also applies to pending claims in lawsuits filed since January 1, 2025, which is why some plaintiffs are already giving them up. The law does not affect Section 631 wiretapping claims, the federal Wiretap Act, or common law and constitutional privacy claims, which often appear in the same complaints. Whether those claims succeed still depends on what websites' tracking tools send and to whom.
How Have Courts Handled Pending Claims So Far?
On October 20, 2026, Judge Vince Chhabria of the Northern District of California ruled on a motion to dismiss a proposed class action against the operator of a legal research website. The complaint alleged that trackers from Meta, Google, and Microsoft shared visitors' legal research activity without their consent. After SB 690 was signed on September 30, the plaintiff agreed that the law bars the case's CIPA pen register claim.
The court dismissed that claim, noting that the case was filed in February 2026, within the law's retroactive window. It also dismissed the other claims on grounds unrelated to SB 690, except a privacy claim under the California Constitution, which the plaintiff may refile with more facts.
In a state court case in Sonoma County, a solar energy company asked the plaintiff on October 2, 2026 to dismiss the pen register claim against it. The plaintiff agreed three days later. In Los Angeles, a consumer products company argued to the court that SB 690 ends the pen register claim against it. In a tentative ruling for an October 12 hearing, the judge did not decide the question and asked whether the plaintiff wanted to respond in writing.
| Example | Pen Register Claim | Other Claims |
|---|---|---|
| Federal (San Francisco) | Dismissed | Constitutional claim open |
| State (Sonoma County) | Plaintiff agreed to drop it | Other CIPA claims continue |
| State (Los Angeles) | Not decided at hearing | Intrusion claim pending |
A sampling of cases as of October 2026, from the federal order and state court filings.
No court in these cases has had to rule on SB 690 over a plaintiff's objection. Plaintiffs who expect to lose the claim on January 1 may see little reason to defend it until then.
Why Does Wiretapping Risk Remain After SB 690?
SB 690 does not change Section 631, the wiretapping provision behind many demand letters. The Sonoma County plaintiff, for example, gave up the pen register claim but kept the case's other CIPA claims. Some courts have allowed Section 631 claims to proceed, including claims over search terms sent to Meta through its pixel.
Common law and constitutional privacy claims also remain available. The Los Angeles lawsuit includes a common law claim for intrusion upon seclusion, which SB 690 does not affect. In the federal case, the court wrote that "it is possible that unlawful interception and dissemination of personally identifiable browsing data on a public-source legal-research website could constitute an invasion of privacy."
The federal Wiretap Act and other states' wiretapping laws are also unaffected. The federal law usually protects websites as parties to their visitors' communications, but that protection does not apply when a communication is intercepted "for the purpose of committing any criminal or tortious act." In September 2026, a federal court in Michigan allowed patients to pursue that theory against two healthcare providers, based on alleged HIPAA violations.
SB 690 also leaves the pen register prohibition in place. Private plaintiffs lose access to the claim, but the Attorney General may still bring it. Pen register claims in lawsuits filed before January 1, 2025 also continue.
What Does It Mean for Businesses?
Businesses with a pending lawsuit or demand letter should raise SB 690 with counsel, since it may end the pen register claim. I also recommend confirming which of the remaining claims rest on Section 631, the federal Wiretap Act, or privacy law, because those are the claims that will continue.
Plaintiffs bringing those claims will continue to focus on the same facts as before, such as what websites' tracking tools send to third parties and whether those tools respect visitors' privacy choices. Websites where visitors research sensitive topics, such as legal or health questions, deserve the closest review. The privacy claim left open in San Francisco and the patients' claims in Michigan both rest on the sensitivity of the data.
Questions
Does SB 690 apply to pen register claims that are already pending?+
Yes, if the lawsuit was filed on or after January 1, 2025 and the claim is still pending on January 1, 2027. On that date, the private pen register claim ends. Lawsuits filed before 2025 fall outside the law's reach.
Can plaintiffs still bring CIPA wiretapping claims after SB 690?+
Yes. SB 690 changes only who may bring pen register claims under Section 638.51. Private plaintiffs can still bring wiretapping claims under Section 631, as well as claims under the federal Wiretap Act and privacy law. Whether those claims succeed depends on the court and on how each website's tracking tools are configured.
Do defendants have to wait until January 1, 2027 to raise SB 690?+
No. Defendants began raising the law in pending cases within days of its signing on September 30, 2026. In two October 2026 cases, plaintiffs agreed to give up the claim, while a court in a third case had not ruled as of mid-October. Whether courts will dismiss the claim early over plaintiffs' objections appears to be unsettled.
Briefings are informational and do not constitute legal advice.
Received a letter?
I'll test the claims against your live site.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.