Authored by: John Rondini and Brady Cunningham (Technical Specialist)
The California legislature has curtailed one of the most aggressive theories in website tracking litigation. Newly enacted Senate Bill 690 removes the private right of action for alleged violations of the California Invasion of Privacy Act’s (“CIPA”) pen register and trap and trace provision when the challenged conduct occurs on an internet website, online application, or mobile application. Beginning January 1, 2027, only the California Attorney General may bring those covered claims against private actors. S.B. 690, ch. 976, § 1 (Cal. 2026) (amending Cal. Penal Code § 637.2).
The change is substantial, but narrow. SB 690 does not repeal the underlying prohibition, declare website tracking lawful, or eliminate private claims under CIPA’s wiretapping and eavesdropping provisions. Businesses should therefore treat the new law as a reduction in one category of litigation risk, not a general safe harbor for cookies, pixels, analytics tools, session replay software, or chat technology.
A Telephone-Era Privacy Law Became a Website-Litigation Tool
CIPA was enacted in 1967 against a communications environment dominated by telephones and other wired communications. Its provisions prohibit specified forms of wiretapping, interception, and recording. See Cal. Penal Code §§ 631–632. CIPA also authorizes substantial civil remedies: the greater of $5,000 per violation or three times actual damages, and actual damages are not a prerequisite to an action. Id., § 637.2(a), (c).
The recent controversy centered on § 638.51, which generally prohibits installing or using a pen register or trap and trace device without first obtaining a court order. A pen register traditionally records outgoing dialing, routing, addressing, or signaling information without capturing the contents of a communication. A trap and trace device performs the corresponding function for incoming information. Id. § 638.50(b), (c).
Those concepts arose from telephone surveillance. Recent plaintiffs nevertheless argued that the statutory phrase “device or process” was broad enough to reach website tracking software that collects IP addresses, device identifiers, location information, and other electronic addressing or signaling information. That interpretation placed ordinary website tools within a statutory framework written for a different technological era. It also exposed a substantial number of websites to CIPA liability.
Courts Disagree Whether CIPA Reaches Ordinary Website Tracking
Federal courts have been divided over whether § 638.51 applies to modern website tracking software. In Shah v. Fandom, Inc., 754 F. Supp. 3d 924 (N.D. Cal. 2024), plaintiffs brought a class action alleging that third-party tracking software collected and transmitted users’ IP addresses to outside companies without consent. The Northern District of California denied Fandom’s motion to dismiss, concluding that the alleged trackers plausibly could constitute pen registers because they operated as “processes” that collected addressing information, including IP addresses. In contrast, in Kishnani v. Royal Caribbean Cruises Ltd., the court dismissed a similar claim against TikTok software, because any “fingerprint” revealing biographical information “is the content of any communication between visitor and Website,” which falls outside § 638.50(c). No. 25-cv-01473-NW, 2025 WL 1745726 at *4 (N.D. Cal. June 24, 2025) (citation omitted).
California state courts have also not uniformly enforced these claims. In Licea v. Hickory Farms LLC, No. 23STCV26148, 2024 WL 1698147 at, *4 (Cal.Super. Mar. 13, 2024), the court dismissed a CIPA claim stating that interpreting “pen registers” to encompass common website trackers could “potentially disrupt a large swath of internet commerce.” Less than a month later, a different judge from the same court declined to dismiss a comparable theory in Levings v. Choice Hotels International, Inc., No. 23STCV28359, 2024 WL 1481189, at *4 (Cal. Super. Ct. L.A. County Apr. 3, 2024). As a result of these disparate decisions, thousands of CIPA class actions have been brought against websites that utilize these website trackers.
SB 690 Eliminates Any Private Right of Action and Applies Retroactively
SB 690 amends California Penal Code § 637.2 to provide that an action against a private actor for a § 638.51 violation arising from conduct on an internet website, online application, or mobile application may be brought only by the Attorney General. S.B. 690, ch. 976, § 1 (Cal. 2026). Thus, private parties such as the plaintiffs in these class action claims can no longer bring these actions.
SB 690 takes effect January 1, 2027. See Cal. Gov’t Code § 9600(a). It also retroactively applies to pending claims in actions commenced within two years before that date. 2026 Cal. Stat. ch. 976, § 1. Actions commenced on or after January 1, 2025 may therefore be covered. Defendants should confirm the commencement date, the statutory theory, the platform at issue, the defendant’s status, and the procedure for raising the amendment.
The new law does not erase § 638.51. The same conduct remains subject to potential Attorney General enforcement. SB 690 removes only the private plaintiff as an enforcer for the covered claims.
Governor Gavin Newsom’s signing message described the legislation as addressing the “vexatious use of CIPA lawsuits and demand letters to extract settlement money” from small businesses that unwittingly installed software that tracks and shares visitor information. Governor Gavin Newsom, Signing Message for S.B. 690 (Sept. 30, 2026).
Private Website Tracking Claims Remain Under Other Provisions
SB 690 leaves private enforcement of CIPA’s other provisions intact. Section 631 still supports claims that a third party intercepted, read, or learned the contents or meaning of a communication in transit. Section 632 still covers recording or monitoring of confidential communications. Section 632.7 may apply to cellular or cordless communications.
These theories have different elements and should not be conflated with the pen register theory SB 690 addresses. A § 638.51 claim generally concerns dialing, routing, addressing, or signaling information, not contents. A § 631 claim may instead turn on whether an outside company received the substance of what a visitor entered into a form, chat box, or search field.
Plaintiffs will likely emphasize contents, third-party receipt, confidentiality, and the adequacy and timing of consent. Other state privacy laws, federal electronic-communications law, consumer protection statutes, contract theories, and common law privacy claims may also apply.
SB 690 Should Change Litigation Strategy, Not Compliance Strategy
For defendants in pending lawsuits, SB 690 raises an immediate case assessment issue. Counsel should separate covered § 638.51 allegations from claims under §§ 631, 632, and 632.7; confirm when the action commenced; determine whether the conduct occurred on a covered website or application; and preserve all defenses, deadlines, and evidence. A claim covered by SB 690 may be dismissed once the amendment is operative, but the entire action may not disappear.
Businesses outside litigation should not remove consent tools or stop auditing tracking technology. They should instead: (1) identify the cookies, pixels, analytics platforms, session replay software, embedded media, software development kits, and chat functions on their websites and applications; (2) determine what each collects, which third parties receive the data, and when transmission begins; and (3) evaluate whether vendors use the data solely to provide a service or for independent advertising or analytics.
Companies should then compare privacy notices and consent interfaces against actual network activity. A disclosure that describes one practice while the code performs another creates risk whether a private § 638.51 claim remains available. Vendor agreements should likewise address data use, retention, onward disclosure, security, incident notification, audit rights, and deletion.
About the Authors
John Rondini is a Shareholder and co-chair of Brooks Kushman’s Intellectual Property Litigation practice, representing clients in patent disputes, cybersecurity and data privacy matters, and complex technology-related litigation. His practice also includes Patent Prosecution, Post-Grant Proceedings, and the negotiation of Licensing & Agreements. Drawing on his prior experience as a hardware design and software engineer, John counsels clients in the Automotive and Mobility Brands & Technology, Electrical & Computer Technology, and Information Technology Services & Software industries. He helps clients protect innovation, address data security risks, and develop intellectual property strategies aligned with their business objectives.
Brady Cunningham is a Technical Specialist at Brooks Kushman, where he supports attorneys in intellectual property litigation matters. Prior to joining the firm, Brady served as a Judicial Intern with the Washtenaw County Trial Court, where he conducted legal research, analyzed case law and legal precedent, reviewed civil and criminal matters, and gained firsthand exposure to litigation and courtroom proceedings. A graduate of Penn State University, Brady leverages his legal research and analytical skills to assist with patent-related matters and support clients in protecting and enforcing their intellectual property rights through Brooks Kushman’s patent and IP litigation practices.
About Brooks Kushman P.C.
Founded in 1983, Brooks Kushman P.C. has built a national reputation as a premier intellectual property and technology law firm. We accomplish this with the understanding that the most effective IP solutions come from putting great minds together – our clients and our own. With offices across the country, we forge strong relationships with corporations, small to medium-sized businesses, and leading universities.
Brooks Kushman counts a number of Fortune 100 Corporations across a variety of industries among its clients. Our attorneys have a deep understanding and broad range of experience in a variety of industries and technologies, including automotive, AI & data, automation, consumer electronics, manufacturing, medical device, computer technology, aerospace, chemicals, biotechnology, retail, food & beverage, green technology, fintech, and more. We are also recognized by leading legal publications and rankings, including, Best Lawyers, Law360, Intellectual Asset Management, Managing Intellectual Property, and World Trademark Review. For more information, please visit www.BrooksKushman.com.