Hi, CIPAWorld! I told you I’d be back with updates on SB 690, and here I am!
Just weeks after Governor Gavin Newsom signed Senate Bill 690 into law, the Northern District of California has already addressed its retroactive application, dismissing a CIPA pen-register claim in a putative class action involving website-tracking technologies.
On October 20, 2026, Judge Vince Chhabria of the United States District Court for the Northern District of California granted defendant MH Sub I, LLC’s motion to dismiss in Evans v. MH Sub I, LLC, No. 26-cv-02684-VC, 2026 WL 3136788 (N.D. Cal. Oct. 20, 2026). The Court dismissed nearly all of the plaintiff’s privacy-related claims with prejudice, including claims under the California Invasion of Privacy Act (“CIPA”), the federal Electronic Communications Privacy Act (“ECPA”), the California Comprehensive Computer Data Access and Fraud Act (“CDAFA”), and California’s Unfair Competition Law (“UCL”).
And while SB 690 does not officially take effect until January 1, 2027, this decision offers a sneak peak at how courts are addressing its retroactive reach.
For some background context to this case, plaintiff Scott Evans filed a putative class action against MH Sub I, LLC, doing business as Internet Brands, alleging that third-party tracking technologies deployed on its FindLaw website unlawfully collected and disclosed visitors’ browsing information.
Evans asserted five causes of action: (1) violations of CIPA under California Penal Code Sections 631(a) and 638.51; (2) violations of the federal ECPA; (3) violations of the CDAFA; (4) invasion of privacy under the California Constitution; and (5) violations of the UCL.
According to the defendant’s motion to dismiss, Evans alleged that tracking technologies on the website collected information including users’ cursor movements, clicks, scrolling behavior, page views, IP addresses, URLs visited, and browser and device information. Evans further alleged that he visited the website to research a personal legal issue and subsequently noticed an increase in targeted advertisements for attorneys and law firms.
After removing the action to federal court under the Class Action Fairness Act, MH Sub moved to dismiss the plaintiff’s first amended complaint.
The Court granted the motion, dismissing all claims with prejudice except the plaintiff’s invasion-of-privacy claim under the California Constitution, for which the Court granted leave to amend.
SB 690
The most notable aspect of the decision, in my opinion, is the Court’s treatment of the plaintiff’s CIPA pen-register claim in light of California’s newly enacted SB 690.
As I previously reported, SB 690 eliminates the private cause of action for pen-register claims “alleged to arise from conduct occurring on an internet website, online application, or mobile application.” Check it out here: SIGNED, SEALED, REFORMED: Governor Newsom Signs SB 690 Into Law – CIPAWorld
Although the legislation becomes effective January 1, 2027, it expressly applies “retroactively to any pending claim in an action commenced within two years before” that date.
Because Plaintiff filed his action within the statutory retroactivity period, the Court concluded that the pen-register claim was barred by SB 690, and Plaintiff expressly agreed.
CIPA Wiretapping Claims Require More Than Allegations of Third-Party Tracking
Under the Plaintiff’s aiding-and-abetting theory, the Court explained that Evans was required to plausibly allege that MH Sub assisted third-party trackers in reading, attempting to read, or attempting to learn the contents of communications while those communications were “in transit.”
Relying on Doe v. Eating Recovery Center LLC, 806 F. Supp. 3d 1109 (N.D. Cal. 2025), the Court emphasized that the in-transit requirement means an intercepting party “must do something more than just intercept the communication while it is in transit.”
Because Evans failed to sufficiently allege that the tracking entities intercepted, read, or attempted to read his communications while in transit, the Court dismissed the Section 631(a) claim with prejudice.
Federal Wiretap Act Claims Meet a Similar Fate
Under 18 U.S.C. § 2511(2)(d), interception of an electronic communication is generally permissible where the intercepting person is a party to the communication or one of the parties has provided prior consent, subject to the statute’s limitations.
The Court concluded that MH Sub could not be held liable for directly intercepting communications because it was a party to those communications. Likewise, MH Sub’s installation of third-party trackers constituted consent to their interception of communications. Accordingly, the Plaintiff failed to state a claim under the federal Wiretap Act.
Data Collection Does Not Automatically Establish Economic Injury
Beyond the wiretapping allegations, the Court rejected the Plaintiff’s claims under the CDAFA and UCL for failure to adequately plead the requisite injury.
Under the CDAFA, a plaintiff must suffer “damage or loss” to establish statutory standing, while the UCL requires a plaintiff to have “lost money or property as a result of” the alleged unfair competition. The Court found that Evans failed to satisfy either requirement because the allegations did not establish that he personally suffered financial harm, resulting in both claims dismissed with prejudice.
One Claim Gets Another Chance
Although the Court dismissed the Plaintiff’s invasion-of-privacy claim under the California Constitution, it granted leave to amend. The Court found that Evans failed to sufficiently allege the nature of the browsing data collected, how it was used, with whom it was shared, and the circumstances of his legal research.
Still, the Court acknowledged that unlawful interception and dissemination of personally identifiable browsing data could potentially constitute an invasion of privacy based on these circumstances and thus granted Evans 14 days to amend his claim.
So, What?
For businesses defending website-tracking litigation, Evans offers several important takeaways, but the biggest development is undoubtedly the Court’s recognition of SB 690’s retroactive application.
SB 690 is already making its presence felt, while its effective date is January 1, 2027, we are seeing its enforcement already. But beyond SB 690, this decision reinforces that allegations of third-party tracking alone are insufficient to establish liability under Section 631(a), and that the collection or monetization of consumer data does not automatically establish the economic injury required for recovery.
However, if Evans is any indication of what’s to come, we may be hearing a lot more about SB 690’s impact on pending CIPA litigation before the law even takes effect.
Stay tuned, CIPAWorld!