SB 690 Ends Private CIPA Pen Register Lawsuits. Does It Solve CIPA Abuse?

Where Does SB 690 Stand Today?

Governor Newsom signed SB 690 on September 30, 2026, the last day he had to act. It takes effect on January 1, 2027. The bill history shows that the Assembly passed it 66 to 0 and the Senate agreed 39 to 0 on August 28.

The bill kept shrinking along the way. It was introduced in early 2025 with a broad exemption for any tracking done for a "commercial business purpose," and it passed the Senate unanimously that June. It then stalled in the Assembly after privacy and consumer groups objected. The version that passed was narrowed on July 2, 2026 to a single change in who may sue.

The case for fixing CIPA is not controversial. In October 2025, a federal judge in the Northern District of California wrote that "the language of CIPA is a total mess" and that "the mess gets bigger and bigger as the world continues to change." He asked the Legislature to step up. SB 690 is the most direct response so far.

What Does SB 690 Change?

Section 638.51 of the Penal Code prohibits installing a pen register or a trap and trace device without a court order. Plaintiffs argue that a script which captures a visitor's IP address and device details fits that definition. The pen register theory became popular because it carries $5,000 per violation and does not require showing that the contents of a communication were intercepted.

SB 690 leaves that prohibition in place and changes who can enforce it. The new text reads, "An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General."

The change also reaches backward. It applies "retroactively to any pending claim in an action commenced within two years before the operative date." The operative date is January 1, 2027, so the window covers lawsuits filed on or after January 1, 2025.

Based on the enrolled text of SB 690, as of October 1, 2026.

Does SB 690 Solve CIPA Abuse?

Not by itself. It takes one claim away from private plaintiffs, and I see four issues with what remains.

First, the law changes who can sue and not what is lawful. It does not say whether analytics tools and social media pixels are pen registers, so that question stays with the courts. The Attorney General could still bring the same claim, although nobody knows how much priority the office will give it.

Second, the wiretapping provision survives. Section 631 was part of the original bill and was dropped when the bill was narrowed. It is the core of many demand letters I see, including the letters from Vivek Shah. A sender who loses the pen register claim can make the same allegations under Section 631 or the federal Wiretap Act.

Third, the retroactive language has gaps. Lawsuits filed before January 1, 2025 fall outside the window and continue. It covers "a pending claim in an action," so a demand letter that has not been filed is not erased, although the sender can no longer file that claim after January 1. Many of these disputes are also filed as arbitration demands, and whether an arbitrator will apply the limit the same way appears to be unsettled.

Fourth, SB 690 changes California law only. Florida, Pennsylvania, and other states have their own wiretapping statutes with private rights of action, and nothing in this law affects them.

The Governor acknowledged the gap when he signed the bill. His signing message says that "additional work in this area is needed, as CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants." He urged the Legislature to take that on next year.

What Happens Before January 1, 2027?

Private plaintiffs can still file pen register claims for the rest of 2026, but those claims end on January 1 if the case is still pending at that point. I expect two things to follow. Defendants in pending lawsuits may ask courts to pause pen register claims until January 1, although courts are not required to agree. Senders of demand letters may press for quick settlements while the claim still exists and then rewrite their letters around Section 631.

What Should a Business Do Now?

A business with a letter or a lawsuit in hand should raise SB 690 with its counsel now. The law may reduce the value of a claim that rests only on Section 638.51, which could affect how counsel approaches a response or a settlement. It helps much less when the letter also cites Section 631, which many do.

For everyone else, the facts that decide these claims have not changed. What matters is which tools run on the site, what they send before a visitor makes a choice, whether that choice is honored, and whether the privacy notice describes it accurately. My advice is to plan as if the lawsuits will continue.