Proposed SB 690 eliminates pen register CIPA claims but leaves website privacy litigation intact

The California Legislature passed SB 690 on Aug. 28, 2026, to stem the tide of claims brought under the California Invasion of Privacy Act (CIPA) that target commonplace website technologies. If Gov. Newsom signs it, the measure would end the private right of action for internet-related claims under CIPA's pen register and trap-and-trace device provision, which the Assembly committee called a "poster child for abusive lawsuits." 

The change is retroactive to claims filed on or after Jan. 1, 2025. Because CIPA has a one-year statute of limitations, SB 690 could eliminate most pending pen register claims.

For now, plaintiffs retain a private right of action to bring claims under CIPA's wiretapping provision. The Assembly committee acknowledged that provision's role in the recent spike of abusive litigation and identified it as the next target for reform.

Plaintiffs will likely continue to file wiretapping claims in the meantime. But the amendment could hinder plaintiffs' attempts to stack alleged statutory damages ($5,000 per violation) under multiple CIPA provisions for the same alleged conduct.

Background

The California Legislature enacted CIPA in 1967 to criminalize wiretapping--physically tapping a telephone wire to eavesdrop--and the unauthorized use of "pen registers" or "trap and trace devices." Samuel Morse invented the "pen register" in 1840 to record telegrams: When it received an electronic signal, it registered that signal by dipping a pen onto a moving strip of paper. 

"Pen register" later came to mean a device that records electronic signals along a telephone line, such as the phone number dialed. A "trap and trace device," by contrast, records all incoming phone numbers.

In recent years, plaintiffs in California have analogized those devices to widespread website technologies called "pixels" or "tags." Pixels are pieces of code that ask website visitors to share basic, anonymized metadata about website visits, such as IP addresses, with companies that run the pixels, like Meta and Google.

SB 690 and its limits

SB 690 adds a new subdivision (d) to Cal. Penal Code § 637.2, CIPA's civil remedy provision:

(d) (1) An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the attorney general.

The amendment is limited in four ways:

·         It eliminates only one kind of private CIPA claim. Plaintiffs suing over website pixels often assert claims under multiple CIPA provisions and other laws. SB 690 would eliminate the private right of action only for violations of the pen register and trap-and-trace device provision (CIPA § 638.51).

·         The attorney general may still bring pen register claims. SB 690 eliminates only the private right of action for claims against private actors. California's attorney general retains authority to bring internet-related actions under the pen register provision. Whether that office has ever brought one, or plans to, is unclear. 

·         The amendment is retroactive to Jan. 1, 2025. It reaches CIPA § 638.51 claims filed within two years before the bill takes effect on Jan. 1, 2027. Because CIPA claims carry a one-year statute of limitations, it could defeat many pending pen register claims.

·         It eliminates over $5,000 in alleged statutory damages per violation. CIPA provides statutory damages of $5,000 per violation. Some plaintiffs argue that a single pixel during a single website visit violates both CIPA's pen register provision and its wiretapping provision. SB 690 cuts that alleged exposure by stopping plaintiffs from stacking alleged pen register damages atop those sought under other CIPA provisions. 

Why only pen register claims? 

The original version applied to both wiretapping and pen register claims. An earlier version of this bill created a "commercial business purpose" exemption covering both CIPA pen register and wiretapping claims (Assembly Committee analysis of SB 690). The Assembly Committee on Privacy and Consumer Protection worried that the earlier version could produce "unintended consequences," so the author agreed to amend it "to focus solely on the civil private right of action against private actors for violations occurring on websites." 

Legislators heard concerns about "pernicious" surveillance, not commonplace analytics pixels. Opponents argued that a broad business defense to CIPA claims could expand particularly "pernicious" forms of "surveillance" that could endanger the safety of vulnerable individuals.

Pen register claims are easier to prove and abuse. The committee focused on pen register claims because they are easier to prove than wiretapping claims, which require evidence of a communication intercepted "in transit," among other elements. Easier claims, the committee reasoned, are more susceptible to abuse.

The Assembly committee found that CIPA's wiretapping provision also needs reform but treated it as less urgent. The committee concluded that the final bill responds directly and surgically to the most pressing problem.

What comes next

If SB 690 becomes law, attention will likely shift to CIPA's wiretapping provision. Plaintiffs would lose one avenue for pursuing website-tracking claims but keep others.

Whether the bill meaningfully alters the trajectory of CIPA litigation remains to be seen. But SB 690 represents an important legislative push against abusive CIPA claims.