BREAKING NEWS CIPAWorld… we’ve been watching and waiting—and now the wait is over.
On September 30, 2026, Governor Gavin Newsom signed Senate Bill 690 (“SB 690”), officially enacting one of the most closely watched California Invasion of Privacy Act (“CIPA”) reform measures of the year.
As we previously reported, SB 690 passed the California Legislature in August after undergoing significant amendments that narrowed the bill considerably from the sweeping CIPA reform originally proposed. The final version makes one substantive change to the Penal Code: it amends Section 637.2 and limits who may bring certain claims under California’s pen register and trap and trace statute.
What Does SB 690 Change?
Sections 638.50 and 638.51 are California’s pen register and trap and trace statutes. In recent years, plaintiffs have invoked these provisions to challenge website tracking technologies, including technologies alleged to collect IP addresses and other electronic addressing information. In his signing statement, Governor Newsom characterized this wave of litigation as involving the “vexatious use of CIPA lawsuits and demand letters” to extract settlement money from small businesses.
Now, SB 690 changes who may bring certain claims under Sections 638.50 and 638.51. Under the new law, only the California Attorney General may bring an action against a private actor for an alleged Sections 638.51 violation arising from conduct occurring on an internet website, online application, or mobile application.
In other words, private plaintiffs will no longer be able to pursue website and app-based Section 638.51 claims against private actors.
What Does SB 690 Mean for Pending Cases?
SB 690 expressly provides that its limitation on private enforcement applies retroactively to pending claims in actions commenced within two years before its January 1, 2027 operative date. Accordingly, qualifying actions commenced on or after January 1, 2025 may fall within the new limitation on private enforcement.
That means businesses currently defending website or app-based Sections 638.51 claims should be paying close attention. Depending on when the action was commenced and whether the claim falls within SB 690’s scope, a private plaintiff may no longer be able to pursue that claim once the new law becomes operative.
What Comes Next?
Well, SB 690 is officially law. For businesses currently facing these claims, that is a meaningful change.
But actually… maybe the wait isn’t entirely over. While SB 690 is now law, Newsom’s signing statement signals that broader CIPA reform may be on the horizon.
…..Stay tuned CIPAWorld!