SB 690 Is Now Law. The CIPA Lawsuits Aren't Done Yet.

California finally passed CIPA reform.

Governor Newsom signed SB 690, and if your brand has fielded a demand letter over a chat widget or ad pixel, or you've been wondering whether one is coming, that's good news.

Just know what changed before you celebrate. There's still plenty for ecommerce brands to pay attention to.

A quick refresher on CIPA

The California Invasion of Privacy Act (CIPA) is a 1967 wiretapping law. It was written for phone lines and doesn't mention the internet once.

But the law comes with statutory damages in the thousands per violation, whether or not the data involved is sensitive. That combination caught the attention of plaintiffs' lawyers.

The result has been an entire cottage industry of lawsuits against online businesses over everyday tools: chat widgets, analytics, ad trackers, and other third-party scripts. Thousands of these cases have been filed in California courts, with plenty more settled before a complaint was ever drafted.

Over the past couple of years, many plaintiffs shifted toward "pen register" and "trap-and-trace" (PR/TT) claims because they're generally easier to prove. The basic argument: an ad tracker firing without opt-in consent is the digital equivalent of a device that logs information about your phone calls.

SB 690 takes direct aim at those claims.

What SB 690 actually does

The original version of SB 690 would have carved out activity already covered by the California Consumer Privacy Act (CCPA), potentially shutting down CIPA website lawsuits much more broadly.

Privacy advocates pushed back. The Assembly rewrote it. What passed is considerably narrower.

It does two important things:

1. Only the California Attorney General can now enforce the PR/TT section (Section 638.51) against privately operated websites and apps.

Individual plaintiffs can no longer use that section to sue businesses over their tracking setups.

2. It applies retroactively.

The bill covers pending claims in lawsuits filed up to two years before its effective date of January 1, 2027. If you're currently fighting a suit filed after January 1, 2025, or sitting on an unsettled demand letter, Section 638.51 claims are wiped out.

Some plaintiffs may challenge that retroactivity on constitutional grounds, particularly in pending class actions. For now, businesses should understand the law as written.

So will the lawsuits stop?

Probably not entirely.

SB 690 leaves the rest of CIPA intact, including Section 631, the anti-wiretapping provision. Private plaintiffs can still bring claims under that section.

Section 631 prohibits intercepting the contents of communications in transit, or helping someone else do it. That's the theory plaintiffs used against chat tools and third-party scripts during the earlier wave of CIPA cases.

Those claims can be harder to prove, and businesses have stronger defenses, including the party exception and arguments over whether the data at issue qualifies as the "contents of a communication." That's one reason plaintiffs shifted toward PR/TT claims in the first place.

With that path narrowed, we may see renewed attention on Section 631.

SB 690 also leaves several underlying questions unresolved, including what counts as a pen register and when website tracking is permissible. And because the amended statute expressly addresses websites and apps, plaintiffs may try to use that language to support claims under other laws, including the federal Electronic Communications Privacy Act.

The playbook for website privacy litigation is likely to shift.

What to do now

SB 690 should reduce a major category of CIPA claims. But it's still worth keeping your privacy setup current.

Keep your opt-in consent banner. Pixels, cookies, and scripts that fire as soon as a page loads can create unnecessary exposure because visitors haven't had an opportunity to consent. Whatever the next wave of claims looks like, opt-in consent remains an important part of a defensible privacy setup.

Keep your privacy policy current. Accurate privacy disclosures can matter in defending against certain wiretapping claims. Review your policy regularly, and make sure your data map still reflects the vendors and tools actually running on your site. Another pixel or tracking tool probably got added since the last time you checked.

Pay attention to chat and similar tools. Early CIPA cases targeted support chat, search bars, and email tracking. With PR/TT claims no longer available to private plaintiffs, those tools could receive renewed attention. Clear disclosures and appropriate consent remain important.

Watch where the claims go next. Plaintiffs' strategies have shifted before, and they're likely to shift again. Staying current on litigation trends is now part of maintaining a privacy program.

The short version: SB 690 clears out a significant category of CIPA lawsuits, and that's meaningful.

Your website will keep changing. Your vendors will keep changing. Privacy law will keep changing. Privacy compliance doesn't stay finished.