California’s legislature passed SB 690 on September 1, 2026, a bill that would significantly limit one category of CIPA lawsuits against businesses over website tracking. If you’ve been following the CIPA litigation wave, this sounds like good news and it partially is. But if you’re thinking compliance is no longer something to worry about, that conclusion moves too fast.
What SB 690 Actually Does
SB 690 targets a specific provision of CIPA, Section 638.51, which covers “pen register” claims. Plaintiff’s attorneys have used this section to argue that tracking tools like cookies and pixels illegally record IP addresses and routing data without consent.
If signed by Governor Newsom, the bill would eliminate the private right of action under Section 638.51 for website and app-based tracking. That means private plaintiffs could no longer file these claims. Only the California Attorney General could bring them.
The bill also includes a retroactivity provision, potentially affecting pending claims filed within two years before its effective date of January 1, 2027.
What SB 690 Does Not Do
This is the part most business owners will miss. SB 690 is narrower than it sounds:
- It does not touch Section 631, CIPA’s traditional wiretapping provision
- Section 631 claims, the ones based on intercepting communications before consent, remain fully intact
- Private plaintiffs can still sue under Section 631 for the same tracking tools that triggered Section 638.51 claims
- The $5,000 per violation statutory damages under Section 631 are unchanged
- The bill still requires the Governor’s signature before September 9, 2026
Earlier versions of the bill were broader, proposing exemptions across multiple CIPA sections. The final version was significantly scaled back before passing.
What Happens Next
Legal experts expect plaintiff attorneys to pivot quickly. Many CIPA lawsuits have already been filed under both Section 631 and Section 638.51 simultaneously. If SB 690 is signed, the Section 638.51 claims get dismissed or blocked, but the Section 631 claims continue.
For businesses that haven’t fixed their tracking setups, the exposure doesn’t disappear. It narrows on one front and continues onto another.
Why Compliance Still Matters
SB 690 is a meaningful development, but it’s not a green light to stop paying attention. The underlying issue, tracking tools firing before visitor consent, remains based on Section 631 claims, which are not going anywhere.
Businesses that use SB 690 as a reason to defer to a compliance review are making a bet that plaintiff attorneys won’t simply shift their theory of the case. Based on how CIPA litigation has evolved over the past two years, that’s not a bet worth making.
The path to actual protection is the same as it has always been. You should know what’s running on your site, confirm nothing fires before consent, and document that your setup works the way it’s supposed to.
How Social Spice Media Can Help
We’ve been tracking the CIPA litigation landscape closely, and SB 690 doesn’t change what we recommend to clients. Section 631 exposure is real, it’s ongoing, and a compliance review is still the most effective way to reduce it.
Reach out to the Social Spice Media team to schedule a compliance consultation.
