SB 690 Is Now Law, but CIPA Lawsuit Risk Remains

Governor Newsom has signed California’s SB 690. This will limit enforcement of one CIPA theory, Section 638.51 (pen register and trap-and-trace), to the California Attorney General when the claim arises from a website, online application, or mobile application.

Section 631 and 632 exposure remains fully intact, and plaintiffs’ firms are already pivoting. Here’s what changed, what to do next, and why website consent enforcement still matters.

On June 26, 2026, a federal judge granted final approval to a USD 3.85 million settlement against the Los Angeles Times. The plaintiff alleged, under CIPA’s pen register provision, that three ad-tech trackers (TripleLift, GumGum, and Audiencerate) collected visitor information on the paper’s website and apps without consent.

The newspaper did not admit wrongdoing. Settlements like this reflect how expensive, slow, and uncertain it can be to fight a California Invasion of Privacy Act claim through to judgment.

SB 690 targets exactly this kind of claim. Governor Newsom signed it on September 30, 2026. Starting January 1, 2027, private individuals can no longer sue over Section 638.51 for tracking on a website, app, or online application, and only the California Attorney General can enforce it. The law also reaches back: pending claims in lawsuits filed within the two years before that date, starting roughly January 1, 2025, may not survive it. It applies to filed lawsuits, not to demand letters.

But that one fact doesn’t tell the whole story. SB 690 was never a repeal of CIPA. It only narrowed one theory inside it.

What Does SB 690 Change?

SB 690 amends Penal Code Section 637.2 covering Section 638.51, but the bill never touched these sections:

• Section 631, CIPA’s core wiretapping provision, covering interception of communications in transit
• Section 632, covering eavesdropping on confidential communications

Earlier drafts of SB 690 would have carved out a broader “commercial business purpose” exemption reaching Sections 631 and 632 as well. That language didn’t survive the amendment process. The version Newsom signed deals only with pen registers.

Plaintiffs’ firms know this too. Legal analysts tracking the bill through 2026 have flagged the obvious next move: businesses relieved of Section 638.51 exposure should expect claims reframed as Section 631 interception theories instead. That shift is already showing up in newer filings.

What Does SB 690 Mean for Pending CIPA Claims?

If you are facing a CIPA demand letter or lawsuit, SB 690 narrows the pen register part of your exposure, and some pending lawsuits may be dismissed once the law takes effect. Its retroactive reach covers filed lawsuits, not demand letters. Treat it as good news, not as an all-clear.

The real question was never “Will SB 690 pass?” It’s always been “Does anything on your website fire before a visitor makes a consent choice?” That question is answered by your own site’s setup, not by Sacramento, and not by the other state laws now used in similar claims.

Why CIPA Wiretapping Claims Remain

Section 631 claims work differently, and they’re arguably easier to bring. A plaintiff doesn’t have to argue that a tracking pixel acts like an old phone-tapping device. They just have to argue that a communication, such as page content, form data, or a chat transcript, was intercepted without everyone’s consent. Chat widgets, session-replay tools, and analytics scripts have all shown up in recent Section 631 lawsuits.

None of that depends on what happened to SB 690. If your business spent 2026 waiting on this bill instead of checking what fires on page load, the same trackers that drew pen register claims can still support wiretapping claims under Section 631.

CIPA statutory damages are the greater of USD 5,000 per violation or three times actual damages, and plaintiffs do not need to prove actual harm to claim them. Federal courts have, however, dismissed some web-tracking cases for lack of Article III standing, including the Ninth Circuit in Popa v. Microsoft in 2025, so outcomes depend heavily on the court and the facts.

Which Other Wiretapping Laws Target Website Tracking?

California’s law gets the headlines, but it’s one of several wiretapping-style laws now used against the same tracking behavior.

Florida Security of Communications Act (FSCA)

Florida requires consent from everyone in a conversation before it can be recorded or tracked. A March 2025 federal ruling in the Middle District of Florida (W.W. v. Orlando Health) let pixel-tracking claims move forward under this law, and plaintiffs have reportedly filed hundreds of small-claims suits since. Our FSCA and WESCA guide covers both laws in more detail.

Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA)

Pennsylvania has a similar all-party consent law. In 2022, the Third Circuit held in Popa v. Harriet Carter Gifts that WESCA can reach website tracking, ruling that a marketing vendor receiving data from a visitor’s interactions could count as an illegal interceptor. The same case later returned to state court on standing grounds, after the Third Circuit held in 2026 that the plaintiff lacked Article III standing in federal court.

Video Privacy Protection Act (VPPA) 

The VPPA was originally written to protect video rental records. Courts are now applying it to websites that share video-viewing data through pixels or trackers without proper consent. The U.S. Supreme Court agreed in January 2026 to decide who counts as a protected “consumer” under the VPPA in Salazar v. Paramount Global, with a decision expected in its 2026–27 term.

Electronic Communications Privacy Act (ECPA)

The ECPA is the federal version of these state wiretapping laws. It’s increasingly pleaded alongside state claims like CIPA, FSCA, and WESCA in the same website-tracking lawsuits.

Each law has its own rules and its own damages, but the underlying complaint is always the same: a script collected or shared visitor data before the visitor said yes.

How Can You Reduce Your CIPA Exposure?

The same step helps address exposure under all of these laws, because the underlying complaint is the same: something collected or shared visitor data before that visitor had a chance to say no.

Audit every script, pixel, and SDK that loads before a consent banner renders. A website scan lists the cookies and trackers running on your site.

Make sure your consent tool blocks non-essential trackers by default, not just after someone opts out.

Keep a record of consent for each request, not just each session, so you can show exactly what fired and when.

Check your privacy policy against what your site actually does today, not what it did at last year’s audit.

The Usercentrics CIPA Consent Template is built to address this gap. Instead of treating California visitors the same as the rest of your U.S. traffic, it applies a GDPR-style opt-in layer to visitors with California IP addresses.

Session replay tools, chatbots, and advertising pixels stay blocked until a California visitor actively says yes. Visitors outside California keep your standard U.S. experience. 

It’s pre-configured inside the Usercentrics Web CMP, so current customers don’t need custom development to turn it on. It also keeps a timestamped log of every consent interaction, which is the record that actually matters if a demand letter arrives. 

It also includes configuration designed to support VPPA compliance for businesses running embedded video or streaming features, since that risk often overlaps with CIPA risk on the same site.

None of this is a legal safe harbor, and it does not replace qualified legal counsel for your specific business operations, privacy compliance needs, or a claim that has already been made. It does address trackers firing before consent, a central issue in many CIPA filings.