Governor Newsom signed SB 690 on September 30, 2026, which means California’s plaintiffs’ bar must find a new hobby for the pen register provision of the Invasion of Privacy Act.[i] The law adds subdivision (d) to Penal Code Section 637.2 and strips private plaintiffs of the right to sue under Section 638.51 over conduct on a website, online application, or mobile app. Only the Attorney General can bring those claims now, and the change takes effect January 1, 2027. A 1967 statute written to catch wiretaps on telephone lines spent the last few years catching analytics and pixels instead, and filings climbed from roughly 600 to nearly 4,000 along the way. The Legislature finally noticed that a telephone surveillance law had become a subscription business, which is roughly how long it takes government to notice anything.
The bill also reaches backward. It applies to pending claims in actions filed within two years before January 1, 2027, so defendants can move to dismiss the pen register counts in a large share of the current docket, while settled and dismissed cases stay closed.[ii] Do not cancel the champagne order yet, and do not open it either. Sections 631, 632, and 632.7 keep their private rights of action, and a plaintiff who loses the pen register theory can plead the same pixel as an interception claim. Expect the same complaints with new captions. The Governor saw this coming. His signing message said that CIPA contains other decades-old statutes that are also susceptible to abuse and urged the Legislature to take them up in 2027.[iii]
The practical advice is dull, which is how you know it works. Inventory every tag, pixel, and script on your consumer-facing properties. Confirm your consent tool blocks them before consent, rather than merely expressing good intentions. Compare what your vendors do with the data against what your contracts allow, and keep dated records of your site configuration, because a 2027 screenshot proves nothing about a 2025 pixel. Companies that finish that work now will enter 2027 with lower exposure, cleaner vendor relationships, and a decent answer for whichever enforcer asks first. If you would like to talk through how SB 690 and the remaining CIPA exposure affect your website, app, or vendor stack, please reach out to me. We can sort the real risk from the noise together. The Compliance Team at Troutman Amin LLP is available to assist.
Disclaimer: This article provides general informational and educational content only and does not constitute formal legal advice. The information contained herein may not reflect the most current legal developments, verdicts, or settlements. Reading this article, transmitting information through related platforms, or contacting the author does not create an attorney-client relationship. Readers should not act or refrain from acting based on any information in this article without seeking professional legal counsel tailored to their specific jurisdiction, facts, and circumstances. The author expressly disclaims all liability with respect to actions taken or not taken based on any or all contents of this publication.
[i]i. “Newsom Bans One Kind of Private Web Tracking Lawsuit as Claims Near 4,000.” PPC Land, 2026, https://ppc.land/newsom-bans-one-kind-of-private-web-tracking-lawsuit-as-claims-near-4-000.
[ii]ii. “California Legislature Passes SB 690, Creating a Major Curb on Pixel Tracking Lawsuits Under CIPA.” Duane Morris LLP, Sept. 2026, https://www.duanemorris.com/alerts/california_legislature_passes_sb690_creating_major_curb_pixel_tracking_lawsuits_under_cipa_0926.html.
[iii]iii. “Newsom Bans One Kind of Private Web Tracking Lawsuit.” PPC Land.