SB 690 Gives Partial Relief from California Invasion of Privacy Act (CIPA) Lawsuits and Demand Letters

California’s SB 690 will end plaintiff lawsuits over one CIPA claim, the pen register and trap and trace claim, from 1 January 2027. However, it will not end all demand letters and litigation over website tracking technology. This article explains where the claims come from, what SB 690changes and what it leaves in place, and practical steps to reduce your risk.

This article is for general awareness only and is not legal advice. See the full disclaimer at the end.

A Brief History of CIPA

The California Invasion of Privacy Act (CIPA) was enacted in1967 to counter the spread of cheap wiretaps and hidden recorders. It was written for telephone wiretapping and eavesdropping. Cookies and online tracking did not exist when the law was written, so it was never intended to address them.

What CIPA regulates

• § 631 - wiretapping: intercepting, or reading or learning the contents of a communication in transit without the consent of all parties. Aiding or abetting someone else to do so is also covered.

• § 632 - eavesdropping: recording or listening in on a confidential communication without the consent of all parties. This makes California an “all-party” (often called “two-party”) consent state.

• §§ 632.5 to 632.7 - later additions covering the interception and recording of cellular and cordless phone calls.

• §§ 638.50 and 638.51 - pen registers and trap and trace devices (added in 2015): § 638.51 bans installing or using a device that captures dialing, routing, addressing, or signaling information (not content) without a court order. § 638.50 holds the definitions.

• § 637.2, private right of action - statutory damages of $5,000 per violation, with no need to show actual harm. This is what has driven the wave of demand letters and litigation.

How CIPA has Driven a Wave of Demand Letters and Lawsuits

Plaintiffs’ firms now apply CIPA to cookies, pixels, SDKs, and other tracking technologies on websites and mobile apps. They allege violation of the law when these technologies run without the visitors’ prior explicit consent.

A common first check is timing - do marketing, advertising, and social media cookies fire before the visitor has made a choice? In an opt-out model, cookies are set as soon as someone lands on the site or opens the app. In an opt-in model, the visitor first sees a consent banner, and non-essential cookies are set only if they provide explicit opt-in consent.

The early cases targeted session replay tools and chat features. More recent demands focus on marketing, advertising, and analytics cookies. Demand letters and lawsuits have reached such a volume against both small businesses and large enterprises that the Legislature stepped in. Court outcomes have been mixed: some claims have survived dismissal, while others have been thrown out, increasingly because the plaintiff could not show a concrete injury.

The theory depends on what the tracker collects:

• Pen register and trap and trace (§ 638.51) violations are claimed when pixels, cookies, or SDKs send a visitor’s IP address, device or browser identifiers, cookie IDs, referring URLs, or similar routing data to a third party.

• Wiretapping and eavesdropping (§§ 631, 632 and 632.7) violations are claimed where tracking reaches the contents of a communication. Examples include the Meta Pixel capturing search terms or URL query parameters; session replay recording what visitors type into form fields; chat sessions recorded or analyzed by a vendor; and call-center recordings, including AI call analytics, where the vendor can access the recordings.

The California Comprehensive Computer Data Access and Fraud Act (CDAFA)

CDAFA, Penal Code § 502, is a second law now appearing in demand letters and lawsuits. It was enacted in 1989 to combat hacking, unauthorized access to computers, and misuse of electronic data.

CDAFA claims allege that websites use Meta Pixel, Google Analytics, session replay, cookies, browser fingerprinting, chat widgets, and marketing automation scripts to access, collect, and transmit visitors’ data without permission. Plaintiffs say these tools capture browsing behavior, device identifiers, form entries, and sometimes sensitive personal information, and share it with third parties for advertising, analytics, or profiling.

CDAFA claims are harder to win than CIPA claims. There are no statutory damages: a plaintiff must show they suffered “damage or loss”, and courts have often rejected theories based on lost control or reduced value of personal data. Courts are also split on what counts as access without permission. SB 690 amends only CIPA, so it does not affect CDAFA claims.

The Catch-22: Opt-in Consent is not a Free Fix

Switching cookie and other tracking technology consent models from opt-out to opt-in may seem like a simple fix, but it comes with a cost. With an opt-out model, relatively few US visitors opt out of tracking. With an opt-in model, you will see similar behavior – many users will not opt in, so you lose data on them.

That loss affects how you measure marketing and advertising campaigns, attribute results, segment visitors, and analyze website traffic. Before you decide, weigh how much your business relies on behavioral advertising and granular measurement against your litigation risk. If the impact is low, explicit opt-in consent for cookies and other trackers is an easy choice.

SB 690 Relief is Only Partial

Governor Newsom signed SB 690 on 30 September 2026, and it takes effect on 1 January 2027. It amends CIPA’s remedy section (§ 637.2) so that only the California Attorney General may sue a business for pen register and trap-and-trace violations (§ 638.51) arising from websites and mobile apps. It also applies to pending claims in lawsuits filed on or after 1 January 2025, which should end much of the current wave of private suits over pixels, cookies, and similar trackers.

The relief is partial for several reasons:

• The conduct is not made lawful. § 638.51 itself is unchanged, and the Attorney General can still enforce it.

• The core question stays open. The bill does not decide whether ordinary tracking tools are pen registers at all.

• Other private claims remain. Plaintiffs can still sue under CIPA’s wiretapping (§ 631) and eavesdropping (§§ 632 and 632.7) sections, with the same $ 5,000-per-violation damages. They can also use CDAFA, other states’ wiretap laws such as Florida’s and Pennsylvania’s, and federal statutes.

• Retroactivity may be challenged. The look-back to 2025 may face due process challenges, and it does not cover demand letters that have not resulted in lawsuits.

Practical Steps to Reduce Your Risk from Cookies and Tracking Technologies

1. Manage cookies and trackers actively. Scan your site every month and whenever a new pixel, script, or SDK is added. If tracking hasn’t been actively managed, run a cookie audit and remove unused pixels and scripts. Require privacy team review and approval before any new tracker goes live. Schedule a quarterly check with IT to confirm the consent banner is working. If you are using an opt-in consent model, non-essential cookies should remain blocked until the visitor agrees; under an opt-out model, they should stop once the visitor opts out.
2. Disclose clearly. Describe the cookies and trackers you use, the personal data they may collect and why, in your cookie banner, privacy notice and website terms and conditions. Show a notice with a link before a chat session starts and announce the call recording notice at the start of every call-center call.
3. Use the most restrictive settings. Many tools, including the Meta Pixel and Google Analytics, let you limit what they collect, for example by turning off automatic advanced matching, stripping query strings, and capturing only partial IP addresses. Aim for aggregated, de-identified data wherever possible, and document the settings you chose. These settings reduce exposure, but a tag that loads in the browser still sends the visitor’s IP address, so they do not replace consent.
4. Put protective contracts in place. Contracts with chat, call-center, and tracking vendors should bar them from using data captured in chats, calls, or web sessions for their own purposes. Where the vendors handle personal information, such as full IP addresses or chat or call contents, sign a data processing agreement and a CCPA service provider agreement with them.
5. Consider an opt-in model where risk is highest. Demand letters and lawsuits are most common in California, Florida, and Pennsylvania. Using explicit opt-in consent for visitors from those states greatly reduces, though it cannot eliminate, the risk of a claim. In every US state, visitors have a way to opt out of behavioral advertising and tracking and to honor browseropt-out signals, such as Global Privacy Control, where state law requires it.

How Aethicor can help

Aethicor helps organizations build a compliance program for cookies and other tracking technologies, covering disclosure notices, cookie banners, consent management, and operating procedures. Book a time at aethicor.com to discuss how we can help.

Disclaimer

This article is provided for general information and awareness only. It is not legal advice and does not create an advisory relationship. Laws, court decisions, and their interpretation change frequently, and this article reflects developments as of October 2026. How the law applies depends on your specific facts, so consult a qualified attorney licensed in the relevant jurisdiction before acting on anything in this article.