Client Alert: Governor Newsom Signs SB 690, Eliminating Private CIPA Pen Register Claims Tied to Websites and Apps

On September 30, 2026, Governor Gavin Newsom signed Senate Bill 690 into law. We have been closely watching this bill for our clients and are very pleased that the bill has become California law. SB 690 eliminates the private right of action under the California Invasion of Privacy Act (“CIPA”) section 638.51 for alleged violations of the pen register and trap-and-trace statute when the conduct at issue arises from an internet website, online application or mobile application.

This is welcome news for the thousands of businesses across the country that have been on the receiving end of CIPA pen register lawsuits and demand letters—a wave of litigation that reportedly grew from approximately 600 cases in early 2025 to more than 4,000 cases eighteen months later, with tens of thousands of additional businesses receiving pre-suit demand letters seeking thousands of dollars in “settlement” payments. Particularly impacted have been out-of-state small businesses, non-profits, “mom-and-pops,” and healthcare providers. Pen register claims are estimated to account for roughly two-thirds of all active privacy litigation in the state.

What SB 690 Does

SB 690 amends Penal Code § 637.2—the statute that creates CIPA’s private right of action and authorizes statutory damages of $5,000 per violation without proof of actual harm. The bill adds a new subdivision (d) providing that an action against a private actor for a violation of § 638.51 (the pen register and trap-and-trace provision) that is alleged to arise from conduct occurring on an internet website, online application or mobile application may be brought only by the Attorney General.

In practical terms, private plaintiffs—including Vivek Shah and the other the serial litigants who drove the recent wave—will no longer be able to bring or maintain these claims.

What This Means for Businesses Targeted by Pen Register Claims

Retroactivity. SB 690 applies retroactively. Absent an urgency clause, the bill’s operative date is expected to be January 1, 2027. The new law reaches any pending claim in an action commenced within two years before the operative date—meaning it covers pending cases filed on or after January 1, 2025. The bill also includes a severability clause to protect the remainder of the statute if any provision is challenged.

Practical takeaways:

• Assess pending cases. If your business is a defendant in a § 51 lawsuit filed on or after January 1, 2025, evaluate whether the case is subject to dismissal once the new law takes effect.
• Reassess demand letters. For businesses that received pre-suit pen register demand letters, the settlement calculus has changed fundamentally. A demand letter does not constitute a “pending claim in an action,” so the sender cannot rely on an existing filing to preserve the claim.
• Continue compliance efforts. As discussed below, SB 690 does not address other CIPA provisions, such as section 631(a)’s wiretapping provision or other privacy statutes. Businesses should continue to review their use of tracking technologies, consent banners, privacy disclosures and vendor contracts.

What Remains: Important Limitations

SB 690 is a significant step, but it is not a comprehensive shield. Businesses should be aware of the following:

• Other CIPA provisions remain unaffected. The bill does not amend §§ 631, 632 or 632.7—the wiretapping and eavesdropping statutes that are the basis for claims involving tracking pixels, chatbot recordings, session-replay tools and similar technologies. Plaintiffs are already pivoting to  631 theories, and that trend is expected to accelerate.
• Federal and other state claims survive. The federal Electronic Communications Privacy Act (ECPA), the California Consumer Privacy Act (CCPA), the Computer Data Access and Fraud Act (CDAFA), the Unfair Competition Law (UCL), and common-law privacy claims are all unaffected by SB 690.
• Conduct is not legalized. SB 690 removes the private right of action; it does not amend the substantive prohibitions of § 51. The Attorney General retains full authority to enforce the pen register statute.
• Older pending cases may not be covered. The retroactivity provision reaches cases filed within two years before the operative date. Cases filed before January 1, 2025, are not affected by the new law.
• Retroactivity may face legal challenges. Although the Legislature’s authority to eliminate a statutory cause of action is broad, plaintiffs with pending cases may challenge the retroactivity provision on due-process or vested-rights grounds. Courts will need to evaluate those arguments as they arise.

The Governor’s Message and the Road Ahead

In his signing message to the California Senate, Governor Newsom praised the bill’s author and stated that he “align[s himself] with the goal of protecting small businesses from overzealous lawsuits based on a statute written without today’s complex technological landscape in mind.” He acknowledged the harm caused by “vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses that unwittingly install software on their websites.”

Importantly, the Governor went further to note that, “additional work in this area is needed, as CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants,” and he urged the Legislature “to take this on next year to ensure a fair balance between protecting private information and preventing rapacious litigation.”

We welcome the Governor’s call for further legislative action. It is our expectation—and hope—that the Legislature will answer that call in the coming session and broaden protections for businesses facing claims under other CIPA provisions, particularly the wiretapping and eavesdropping statutes that plaintiffs are now increasingly using. The bipartisan, unanimous passage of SB 690 suggests that there is real appetite in Sacramento for practical reform. We will continue to monitor developments closely.

Contact Us

If you have questions about how SB 690 affects your business, your pending litigation or your broader privacy compliance posture, please contact us.