On 28 August 2026, the California Assembly and Senate passed an amended Senate Bill 690, beating the 31 August floor deadline. The bill now sits with Governor Newsom, who has until 9 September to sign or veto it. If signed, it takes effect 1 January 2027.
Almost nobody outside privacy litigation is watching this one. They should be, because it is the first time in years that a state has moved to reduce the enforcement surface of an existing privacy statute — and it does so retroactively.
What CIPA’s Pen Register Theory Actually Was
The California Invasion of Privacy Act was written in 1967 for telephone wiretapping. Sections 638.50 and 638.51 cover pen registers and trap-and-trace devices — the old law-enforcement tools that recorded who you called and when without capturing what you said. Installing one without a court order is unlawful, and CIPA attaches statutory damages of $5,000 per violation.
Starting around 2023, plaintiffs’ firms made an argument that turned out to work: a tracking script on a website is a trap-and-trace device. It sits on a page you visit, and it captures dialling, routing, addressing and signalling information — your IP address, your device and browser fingerprint, the referring page, the sequence of your navigation — and transmits it to a third party, without a warrant and without your agreement.
Read literally, the statute fits. Read practically, it meant that a chat widget, a session-replay tool, a Meta Pixel or a Google Analytics tag could expose a website operator to $5,000 per visitor.
Thousands of demand letters and hundreds of filings followed. That volume is the entire political story of SB 690.
What the Bill Does
The version that passed is much narrower than the original, and the narrowing matters.
- Scope. It reaches only Penal Code §§ 638.50 and 638.51 — the pen register and trap-and-trace sections. The wiretapping and recording provisions of CIPA, including § 631 and § 632, are untouched. Session-recording and chat-interception theories survive.
- Only web and app conduct. The carve-out applies to violations “arising from conduct occurring on an internet website, online application, or mobile application.” Pen register claims outside that context keep their private right of action.
- Enforcement moves to the Attorney General. For qualifying claims, only the California AG may sue. Individuals cannot.
- It is retroactive. The amendment applies to pending claims in actions commenced within two years before the operative date — meaning cases filed from roughly January 2025 onward, already in court, can be extinguished by a statute passed after they were filed.
The Retroactivity Is the Part to Argue About
Reasonable people disagree about whether a 1967 wiretap statute should generate $5,000 per pageview. That is a genuine policy question, and the answer “no” is defensible.
Applying the answer backwards is a different question.
A plaintiff who filed in March 2025 did so under the law as it existed, as courts were then reading it. A defendant who deployed a tracking script in 2024 was subject to that same law. SB 690 does not say “going forward, this theory is unavailable.” It says the conduct that was actionable when it happened is no longer actionable now, for anyone who has not already reached judgment.
Expect constitutional challenges on that basis. Retroactive extinguishment of an accrued cause of action is not automatically unlawful, but it is not automatically fine either, and California courts will be asked.
Why the AG-Only Model Is Weaker Than It Sounds
“Enforcement remains with the Attorney General” is the reassuring line in every summary of this bill. It is worth being honest about what it means in practice.
The California AG’s privacy unit brings a handful of enforcement actions per year across the entire CCPA, and CalPrivacy — a dedicated agency with its own staff — produced two data broker orders in three days in August and that counted as a busy fortnight. Regulators triage by significance, resources and political weather. They cannot and will not pursue the long tail.
The private right of action is not efficient and it is frequently ugly, but it has one property no regulator has: it scales with the number of violations rather than the size of the agency’s budget. That is exactly why industry fights it, and exactly why New Jersey’s inclusion of one in its Kids Code Act was the provision lobbied against hardest.
Two states, two directions, three weeks apart.
What Actually Changes for You
If you are a California resident: the tracking has not stopped. The mechanism by which you could personally do something about a specific category of it is being removed. Your remaining levers are the CCPA’s opt-out rights, the Global Privacy Control signal, and complaints to CalPrivacy and the AG.
If you run a website: do not read this as an all-clear. The bill covers two sections of one statute in one state. CIPA § 631 wiretapping theories remain live, as do claims under the federal Wiretap Act, Washington’s My Health My Data Act, Illinois BIPA where biometrics are involved, and the video privacy statutes that produced the Texas Netflix litigation. The pixel-litigation problem is not solved; one branch of it has been pruned.
What To Do
- If you have a pending CIPA pen register claim, talk to your lawyer this week. The retroactivity provision reaches cases filed within the prior two years. Timing and posture will matter.
- Contact the Governor’s office before 9 September if you have a view. The window is short and this bill has had almost no public attention relative to its effect.
- Turn on Global Privacy Control. Firefox and Brave support it natively. In California it is a legally binding opt-out signal, and it does not depend on anyone’s private right of action to work.
- Block the trackers themselves. uBlock Origin, Brave’s shields, or Firefox’s strict Enhanced Tracking Protection stop the transmission rather than litigating it afterwards. Given what just happened in Sacramento, that distinction is the whole point.
- Watch what your state does next. SB 690 is a template, and California is the state everyone copies. The argument that “litigation volume proves the law is broken” will be made again elsewhere, about statutes you rely on.
