AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
California CIPA Tracking Litigation and SB 690
Coverage from CalMatters, Ashurst Perkins Coie, and others
California’s Invasion of Privacy Act (CIPA) became the basis for lawsuits alleging that website and app tools—including cookies, pixels, analytics, and session replay—improperly acted as pen registers or trap-and-trace devices.
Senate Bill 690 amended that framework by ending private actions under CIPA section 638.51 for covered website and app conduct and reserving civil enforcement of those claims to the California Attorney General. The change applies retroactively to qualifying cases filed from January 1, 2025, and took effect on January 1, 2027. Other CIPA claims and privacy-law obligations remain distinct, so the reform narrows one route to litigation rather than eliminating legal challenges to tracking.
The current version largely confirms the existing account; it adds no material change to the law’s scope or implications.
Governor Newsom signed SB 690, turning a pending proposal into enacted law. The change is now scheduled to take effect January 1, 2027, and its retroactive reach is confirmed for qualifying cases dating from January 1, 2025.
- Newsom signed SB 690 on September 30, 2026.
- The law takes effect January 1, 2027.
The current version adds that SB 690 passed unanimously, but otherwise reinforces the prior account without materially changing its status or implications.
California’s Legislature passed SB 690, which would bar private lawsuits under CIPA Section 638.51 for specified tracking conduct involving websites and apps, while leaving enforcement to the state Attorney General. The measure was awaiting Governor Gavin Newsom’s action in the reports; if enacted, it would take effect in 2027 and apply retroactively to certain claims. Other CIPA provisions and separate privacy claims would remain available, so the bill would narrow one litigation route rather than end tracking-related privacy litigation.