AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
California Is Narrowing Tracking Suits, Not Privacy Duties
Yesterday’s legal reporting confirmed that California has enacted a law narrowing private website-tracking claims while separately establishing substantial new insurance privacy obligations. The practical distinction matters: reducing one route to litigation does not mean reducing the work required to govern personal data.
These were clarifications of September enactments, not new actions yesterday. Reporting also examined an earlier Second Circuit decision allowing suspicionless manual device searches at the border—a separate expansion of government access, rather than part of a single direction for privacy protection.
SB 690 is now an enacted law, not the proposal described in our previous briefing. The National Law Review reports that Governor Gavin Newsom signed it on September 30. Effective January 1, 2027, it removes private actions against private actors under CIPA Section 638.51 for covered website and app tracking conduct. It also applies retroactively to covered claims in actions commenced from January 1, 2025. Attorney-general enforcement and other privacy claims remain available, making the scope of each claim—not simply the presence of tracking—the consequential question.
California’s insurance privacy framework creates a different kind of workload. Lexology’s analysis of SB 354, enacted September 27, describes new notices, access, correction and deletion rights, sharing limits, retention policies and breach reporting under CIIPPA. Insurers and specified service providers are covered, including when handling biometric data. Most provisions become operative July 1, 2028: this is preparation time, not immediate applicability of every requirement.
Tech Policy Press examined the Second Circuit’s September 17 ruling in United States v. Alisigwe, reversing a 2023 district-court decision and permitting manual border searches of electronic devices without warrants or suspicion. The reported holding excludes advanced searches that copy and retain device contents. That boundary is essential; the decision should not be described as authorizing every form of device search.
Key Points
- California’s two enactments separate enforcement exposure from operational obligations. A narrower private-litigation pathway for tracking can coexist with a broader sector-specific compliance program. Privacy risk assessments need to track both, rather than treating legislative direction as uniformly protective or permissive.
- The border ruling complicates the recent picture of judicial limits on surveillance. Previous briefings examined a constraint on historical vehicle-location searches; yesterday’s reporting describes greater latitude in a different search context. Together, they support context-specific analysis, not a national trend toward either stronger or weaker search protections.
Implications
Website and app operators should reassess covered pending claims without treating SB 690 as permission to relax tracking controls. Other CIPA provisions, federal law and state privacy claims remain possible. The reported retroactivity makes verification against the enacted text particularly important.
Insurers and covered providers have a substantial implementation program spanning data inventories, rights handling, retention, vendor contracts and incident response. Lexology reports that regulations are due January 1, 2029—after the main operative date—so planning should distinguish established statutory duties from details awaiting guidance.
Organizations reviewing travel and device-access policies should account for the reported latitude for manual border searches. Broader operational conclusions require checking the opinion’s precise scope, especially the distinction between manual access and copying or retaining contents.
Watchpoints
Watch
How the enacted text of SB 690 defines covered conduct and retroactivity, and how courts treat pending Section 638.51 claims alongside alternative claims.
Watch
CIIPPA guidance, provision-specific deadlines and insurer/vendor readiness ahead of July 2028, particularly where implementation depends on later regulations.
Watch
Further review of Alisigwe or subsequent rulings clarifying the boundary between manual and advanced device searches.
Fallout
The most consequential changes concern three distinct questions: who can sue over tracking, what insurance organizations must do with personal data, and when officials may inspect travelers’ devices.
Website and App Tracking Litigation
California is narrowing a specific private enforcement route without eliminating tracking-related legal exposure.
Fresh developments
The National Law Review confirmed SB 690’s September 30 signature, January 2027 effective date and reported retroactive application to covered claims in actions commenced from January 2025.
Why we noticed
This replaces the previous briefing’s proposal-stage understanding with an enacted-law assessment. It changes litigation strategy more directly than it changes the need for compliant data practices.
Watch for:
- Verification of covered claims and retroactivity against the enacted law.
- Treatment of pending cases and continued use of other privacy claims.
Insurance Privacy Implementation
CIIPPA establishes a sector-specific compliance framework for insurers and specified service providers.
Fresh developments
Lexology detailed the obligations created by SB 354, enacted September 27, including consumer rights, sharing restrictions, retention policies, breach reporting and civil penalties.
Why we noticed
The delayed operative date gives organizations time to prepare, but the breadth of the requirements makes this an operational program rather than a notice-only update. Precise coverage and exceptions still require verification.
Watch for:
- Provision-specific implementation dates and coverage guidance.
- Preparation of rights-handling processes, vendor contracts and retention controls.
Border Device Searches
The reported Second Circuit holding permits suspicionless manual searches while leaving advanced searches outside its scope.
Fresh developments
Tech Policy Press analyzed the September 17 Alisigwe decision allowing manual border-device searches without warrants or suspicion.
Why we noticed
Accessible personal and professional information faces exposure in this search context. The decision’s limited category matters more than a broad claim that device privacy has uniformly weakened.
Watch for:
- Verification of the holding and jurisdictional implications against the opinion.
- Further review or decisions distinguishing manual inspection from advanced searches.
Final Thought
The useful distinction is not whether privacy protection is rising or falling. It is whether a development changes data-handling duties, access powers or the routes available to enforce rights. Yesterday made those differences more consequential.