On September 30, 2026, Governor Newsom signed Senate Bill 690 into law. If your website serves visitors in California, this is good news with a few important limits.
The short version: one popular type of privacy lawsuit against website owners goes away on January 1, 2027. Other types remain, so the basics of website privacy still matter.
How a 1967 wiretapping law reached your website
The California Invasion of Privacy Act, known as CIPA, was written in 1967 to stop phone wiretapping. One part of it, Penal Code Section 638.51, bans “pen registers” and “trap and trace devices.” These were originally devices that logged the phone numbers a line dialed or received calls from.
In recent years, attorneys began arguing that everyday website tools do the same thing. Under this theory, a cookie, analytics script or advertising pixel that records a visitor’s IP address counts as an illegal pen register.
CIPA allows $5,000 per violation without proof that anyone was harmed (Section 637.2), so these claims multiplied quickly. According to the bill’s sponsors (opens in a new tab), lawsuits grew from roughly 600 to nearly 4,000 while SB 690 was being debated, with thousands of demand letters on top. Many went to small businesses and nonprofits using standard tools like Google Analytics.
What SB 690 changes
- Private pen register lawsuits end. Starting January 1, 2027, individuals and their attorneys can no longer sue under Section 638.51 over activity on a website or app.
- Only the Attorney General can bring these claims. Enforcement moves from private law firms to the state.
- It reaches back two years. The change also applies to pending claims in lawsuits filed within two years before the law takes effect.
You can read the full text of SB 690 (opens in a new tab) on the California Legislature’s website.
What SB 690 does not change
- Tracking is not automatically legal. The law changes who can sue. It does not declare cookies or pixels lawful, and the Attorney General can still enforce Section 638.51.
- Wiretapping claims remain. CIPA Section 631 covers intercepting the contents of a communication, and private lawsuits under it are untouched. These claims often target chat widgets, session recording tools that replay a visitor’s clicks and typing, and some advertising pixels. The same $5,000 penalty applies.
- Other privacy laws still apply. This includes the California Consumer Privacy Act (CCPA) for businesses that meet its thresholds.
- Demand letters are less clear. The two-year lookback covers filed lawsuits. A letter that has not yet become a lawsuit is a different situation.
- More changes may follow. In his signing message, the Governor asked the Legislature to revisit other outdated parts of CIPA next year.
What this means for your website
SB 690 lowers the risk for most business websites, but it is not a reason to remove your privacy protections. We recommend the following:
- Know what is running on your site. Analytics, advertising pixels, chat tools, embedded videos and marketing plugins can all collect visitor data. Many site owners are surprised by what they find.
- Keep your cookie consent banner. A banner that holds back tracking until a visitor agrees remains one of the best protections against the claims that survive.
- Look closely at chat, session recording and form tracking tools. These are the tools most exposed to Section 631 claims. Make sure each one is worth having and is covered by your consent settings.
- Keep your privacy policy current. It should accurately describe the tools you use and the third parties that receive data.
- Do not ignore a demand letter. If you receive one, speak with an attorney before responding or paying. SB 690 may change the picture, depending on what the letter actually claims.
How Razorfrog can help
We build and maintain websites with privacy in mind, and we follow changes like this so our clients do not have to. If you are not sure what your website is collecting, we can review the tracking tools on it, check that your consent banner is working as intended and help with your privacy and legal setup.
If you have questions about your website, get in touch and we will be happy to take a look.
This article is for general information only and is not legal advice. Razorfrog is a web design company, not a law firm. Please consult an attorney about your specific situation.