California Legislature Passes Bill to Curtail Website Tracking Lawsuits: What Businesses Need to Know About Website Tracking Claims
On Friday, August 28, the California Legislature passed an amended version of Senate Bill 690, which would eliminate the private right of action for claims under Section 638.51. If signed into law, SB 690 would bar plaintiffs from suing businesses for pen register and trap and trace violations based on app technologies that capture or transmit information about a user’s communications, rather than the content itself. The bill would apply retroactively to pending lawsuits commenced during the two years prior to the operative date.
Unlike the prior version of SB 690, this version of the bill would not eliminate CIPA litigation altogether. Instead, we expect a shift toward Section 631 claims, which target “wiretapping,” or the intentionally tapping, connecting to, or intercepting communications over telegraph or telephone wires, lines, cables, or instruments without the consent of all parties. Section 631 also prohibits attempting to read, learn, or use the contents of those communications, or aiding, conspiring, or employing others to do so. For businesses, the practical takeaway is that SB 690 may narrow one category of website-tracking claims without eliminating CIPA exposure.
What SB 690 does:
Eliminates the private right of action for website and app-based claims under Section 638.51 involving pen register and trap-and-trace technology.
Applies to pending lawsuits and claims commenced during the two years before the bill’s operative date.
What SB 690 does not do:
Does not eliminate Section 631 wiretapping claims.
What happens next?
Governor Newsom has until September 30, 2026, to sign the bill. He could veto it or take no action, allowing it to become law without his signature. Given that the bill passed both houses with zero “no” votes, we expect Newsom is more likely to sign than not.
If signed, the bill would take effect on January 1, 2027. For purposes of its two-year lookback, it would reach pending claims commenced on or after January 1, 2025.
What can you do?
If you have a pending claim or demand under Section 638.51, consult PierFerd promptly to assess how the bill’s retroactivity provision could affect your matter if enacted. The analysis may turn on procedural posture – including whether the matter is pre-litigation, in active litigation, or in arbitration.
If you have a pending Section 631 (wiretapping) claim or demand, SB 690 will not directly eliminate those claims. However, if the claim combines Section 638.51 and 631 claims, it may aid in reducing the overall exposure and potential statutory penalties.
Looking Ahead:
SB 690 is not the end of CIPA or wiretapping claims. Businesses should continue reviewing the tracking technologies used on consumer-facing websites and apps, and updating compliance practices as the law develops. Litigation in this area continues to expand, including claims under the Electronic Communications Privacy Act (ECPA) and the California Comprehensive Computer Data Access and Fraud Act (CDAFA).
Conclusion:
If you have questions about a CIPA demand or pending matter, or about your website’s tracking technology, please reach out to PierFerd. Our attorneys have advised businesses on evolving privacy and website-tracking risks, including counseling on existing claims and mitigating risk of future claims.
This publication and/or any linked publications herein do not constitute legal, accounting, or other professional advice or opinions on specific facts or matters and, accordingly, the author(s) and PierFerd assume no liability whatsoever in connection with its use. Pursuant to applicable rules of professional conduct, this publication may constitute Attorney Advertising. © 2026 Pierson Ferdinand LLP.
