California SB 690 Ends Private Right Of Action For Pen Register and Trap-and-Trace Claims Under CIPA
On September 30, 2026, Governor Newsom signed SB 690, which takes away plaintiffs’ ability to commence a lawsuit alleging online “pen register” and “trap and trace” claims under the California Invasion of Privacy Act (CIPA). The change takes effect January 1, 2027, and includes a retroactivity provision that reaches back to cover qualifying cases filed in the prior two years. While SB 690 may provide significant relief for certain defendants, it does not impact CIPA’s separate wiretapping provisions or federal privacy statutes. The statute’s retroactivity provision may also face challenges. This means that the recent wave of website-tracking privacy class action litigation will likely continue, but in a different form.
The Privacy Class Action Landscape
Over the past several years, plaintiffs’ firms have filed thousands of class actions and mass-arbitration demands against companies that operate consumer-facing websites and apps. The typical complaint targets ordinary tools such as analytics scripts, advertising pixels (e.g., Meta Pixel, TikTok Pixel), session replay software, chat widgets, and mobile SDKs. Plaintiffs typically allege that these tools share visitors’ information with third parties without consent.
Website-tracking complaints in these cases are often based on several different theories of liability:
- CIPA wiretapping (Cal. Penal Code § 631). Plaintiffs allege that a third-party vendor (e.g., a pixel provider) “read or learned the contents” of a communication in transit, and that the website operator aided and abetted that interception.
- CIPA eavesdropping and recording (§§ 632, 632.7). Plaintiffs allege recording of confidential communications, often aimed at chat features and call-related technologies.
- CIPA pen register and trap and trace (§ 638.51). Plaintiffs allege that tracking tools operate as a “pen register” or a “trap and trace” device by capture IP addresses, device data, and similar addressing information.
- Federal Wiretap Act (ECPA, 18 U.S.C. § 2511). The federal analog to § 631.
- Video Privacy Protection Act (VPPA, 18 U.S.C. § 2710). Directed at sites with video content that also share users’ video viewing history with third parties.
CIPA Pen Register/Trap And Trace Claims
CIPA § 638.51 prohibits any person from installing or using a “pen register” or “trap and trace device” without a court order, the user’s consent, or another statutory exception. These terms historically described devices that record the numbers dialed from, or received by, a telephone line: the “who called whom,” not the conversation itself. CIPA § 637.2 lets any injured person sue for the greater of $5,000 per violation or three times actual damages, without proof of actual harm.
Plaintiffs have argued that common website and app tools are “pen registers” or “trap and trace” devices because they collect IP addresses, device identifiers, and similar routing data.
What SB 690 Does
SB 690 changes who may sue, not what § 638.51 prohibits. It adds a new subdivision (d) to CIPA § 637.2, the civil-remedy provision, with three key features:
- Claims May Be Brought By The Attorney General Only. An action against a private actor for a § 638.51 violation arising from conduct on an internet website, online application, or mobile application may be brought only by the California Attorney General.
- Effective Date January 1, 2027.
- Two-year Retroactivity Window. The limitation applies to qualifying claims still pending on January 1, 2027, in actions commenced during the preceding two years,e., on or after January 1, 2025.
The bill does not repeal § 638.51, does not declare any tracking technology lawful, and does not create a safe harbor.
What This Means for Businesses: Don’t Remove the Cookie Banner Yet
SB 690 is a meaningful, but narrow win for businesses operating websites incorporating third-party tracking technologies. However, companies should not take it as a signal to remove opt-in cookie consent banners or scale back tracking-technology governance. A banner that blocks non-essential cookies and trackers until the visitor consents remains the strongest defense against the CIPA and federal claims that survive after SB 690 takes effect.
Plaintiffs can still bring other CIPA privacy claims against businesses, like wiretapping claims, that are not impacted by SB 690. These surviving CIPA claims are harder to plead: most require that a tool captured the contents of a communication or invaded a reasonable expectation of privacy. Even so, it is likely that the plaintiffs’ bar will attempt to repackage CIPA pen register and trap and trace allegations as § 631 and § 632 claims.
Effect on Pending Pen Register/Trap And Trace Claims
A website or app-based CIPA § 638.51 claim in an action filed on or after January 1, 2025, that is still pending on January 1, 2027, should be barred under SB 690’s retroactivity provision. Because the statute speaks of a pending “claim,” it should reach the § 638.51 count of a complaint even where the same complaint also pleads §§ 631, 632 or other claims. Claims in these actions that are not impacted by SB 690 would continue.
The application of SB 690 will be case-specific. Key questions include when the action was commenced, whether the defendant is a “private actor,” and whether the conduct occurred on a website or covered app. Actions filed before January 1, 2025, fall outside the retroactivity window, and would not be impacted by SB 690. Plaintiffs can also be expected to challenge the retroactivity provision itself. The bill contains a severability clause for the retroactivity provision, and trial courts may diverge on how to interpret it until appellate courts weigh in.
Courts Are Already Reacting. In Variety Media, LLC v. Superior Court, a closely-watched CIPA pen register writ proceeding pending before the California Court of Appeals, the court ordered supplemental briefs to be filed in the case on October 1, 2026, the day after SB 690 was signed into law. The parties must address whether SB 690 moots the writ proceeding and, if so, whether an exception to mootness applies.
What Companies Should Do Now
- Defendants in pending § 638.51 cases: SB 690 may offer real relief, but it will not play out the same way in every case. Its effect will turn on when the pending action was filed, what claims were asserted alongside § 638.51, where the case stands procedurally, and how courts ultimately treat the retroactivity provision, which plaintiffs are likely to challenge. For some defendants, the new law may reshape litigation and settlement strategy well before January 1, 2027. Companies with pending matters that include a pen register claim should talk with experienced privacy litigation counsel about how SB 690 fits into their particular case.
- Compliance teams: Keep opt-in consent banners and tracker governance in place. Continue auditing which pixels, SDKs, and scripts are active, testing that consent and opt-out settings actually block them, and confirming that privacy disclosures match how the site works.
