The CIPA Landscape Just Changed: What SB 690 Means for Pending Pen Register Claims

California Governor Gavin Newsom has signed Senate Bill 690 (“SB 690”) into law, handing businesses facing certain California Invasion of Privacy Act (“CIPA”) lawsuits a significant, but narrow, win.

The big takeaway: private plaintiffs can no longer bring CIPA pen register claims under Penal Code Section 638.51 based on conduct occurring on a website, online application, or mobile application. Going forward, only the California Attorney General can bring those claims.

And importantly, the change is retroactive to certain pending cases. So, if your company is already defending a CIPA lawsuit, now is the time to take another look at the complaint.

Already in CIPA Litigation? Check Your Claims Now.

If a pending lawsuit includes a Section 638.51 claim involving your website or app, SB 690 may provide a basis to knock that claim out. The new law expressly applies retroactively to pending claims in actions commenced within two years before its effective date.

Defendants with potentially covered claims should consider promptly filing a notice of supplemental authority alerting the court to SB 690 and explaining how the new law affects the private plaintiff's ability to continue pursuing the claim. Depending on the case's posture, defendants should also evaluate whether dismissal or other relief is appropriate.

The same goes for pre-litigation demand letters. If a demand is based on a private Section 638.51 website or app claim, the claimant may no longer have a viable private cause of action.

What Does SB 690 Actually Do?

The final law does one relatively simple thing: it changes who can sue. SB 690 provides that an action against a private actor for a Section 638.51 violation arising from conduct on a website, online application, or mobile application may be brought only by the California Attorney General.

That matters because Section 638.51—California's pen register and trap-and-trace statute—has become an increasingly popular basis for CIPA claims targeting ordinary website technologies. Plaintiffs have argued that “tracking tools” collecting information such as IP addresses and other routing or signaling data function like the digital equivalent of traditional pen registers. SB 690 effectively takes private plaintiffs out of that equation for website and app-based Section 638.51 claims.

But there is an important distinction: SB 690 does not make the underlying conduct legal. It simply eliminates the private right of action for this category of claims and leaves enforcement to the Attorney General.

What SB 690 Does Not Do

Businesses should not mistake SB 690 for the end of CIPA website litigation. When originally introduced, SB 690 was much broader. It proposed a “commercial business purpose” exemption that could have substantially limited CIPA claims involving commonplace technologies like cookies, pixels, and session replay software.

That broader exemption did not survive. Most notably, SB 690 does not eliminate private claims under Sections 631 or 632. Those wiretap provisions, and the significant statutory damages available under CIPA, remain intact. That means plaintiffs can still bring CIPA claims challenging website technologies, such as cookies under other theories. Section 631 claims, for example, generally focus on the alleged interception of the contents of a communication rather than the routing or signaling information at issue in a pen register claim.

In short: SB 690 eliminates one increasingly popular path for private CIPA lawsuits. It does not eliminate the broader CIPA litigation risk.

What Should Businesses Do Now?

For businesses facing CIPA litigation or demands, there are three immediate steps:

1. Review pending lawsuits. Identify any Section 638.51 website or app claims and determine whether SB 690's retroactivity provision applies. If it does, consider filing a notice of supplemental authority and/or seeking appropriate relief, such as a reconsideration motion.
2. Revisit demand letters. If a demand relies on a private Section 638.51 theory, reassess the claimant's ability to pursue that claim under the new law.
3. Keep your CIPA compliance program in place.Sections 631 and 632 remain untouched, so businesses should continue evaluating website technologies for compliance with those laws.

The Bottom Line

SB 690 provides meaningful relief for businesses caught in California's wave of pen register litigation but it is not the sweeping CIPA reform businesses once hoped for.

For defendants with pending Section 638.51 claims, the impact could be immediate: review the complaint, determine whether the new law applies, and consider putting SB 690 before the court. For everyone else, CIPA remains very much in play.