SB 690 Is Law: Will the CIPA Shakedown Continue?

California Gov. Gavin Newsom has signed Senate Bill (SB) 690, one of the most-watched privacy bills this cycle. SB 690 eliminates the private right of action for some claims under the California Invasion of Privacy Act's (CIPA) pen register and trap-and-trace provision, California Penal Code Section 638.51, by restricting enforcement to the California Attorney General for conduct occurring on a website or mobile application. It takes effect January 1, 2027.

But will it actually end the flood of vexatious CIPA demand letters and complaints? Not likely.

SB 690 is the conclusion of a two-year legislative effort to stem the tide of CIPA demand letters and complaints by high-volume plaintiffs' firms looking for quick, nuisance-value individual settlements. After a version of the bill that would have covered both Section 631(a) and Section 638.51 claims passed in the Senate, the bill stalled in the Assembly at the conclusion of the legislative session last year. As legislative deadlines approached in 2026, the bill was amended to add a two-year retroactivity provision and narrowed to focus on the most egregious claims and abusive litigants.

Since the bill passed out of the legislature at the end of August, plaintiffs' firms have worked to reframe SB 690 as their own "win," with many claiming that the final form of the legislation amounts to a green light to pursue website tracking allegations under CIPA Section 631(a). That conclusory argument ignores the context of the amendments during the legislative process, as well as the steeper hill plaintiffs must climb to succeed under Section 631(a). Section 631(a) requires a provable "communication" – certainly more than the signal information such as IP address and browser metadata on which most complaints have recently been based. And a series of class certification denials in website wiretapping cases, at least seven from district court judges in recent months, help to establish a road map for those unwilling or unable to reach a quick settlement.

Lopsided Settlement Economics

But although SB 690 likely eliminates new Section 638.51 claims, the business case for litigating Section 631(a) and derivative website privacy claims brought by individual plaintiffs remains weak. The cost of a single motion to dismiss or demurrer, even in arbitration, will generally exceed the typical individual CIPA settlement. Hearing delays, the liberal standard for amendment and discovery only compound the burden and cost imbalance on defendants. Plaintiffs' firms understand and are counting on a corporate defendant to understand that dynamic. So, however meritless newly reframed Section 631(a) claims may be, a nuisance-value settlement will often be the economically rational choice.

Perhaps the one upside to continued exploitation of CIPA by plaintiffs' firms will be to compel further legislative action that finally solves the issue for suffering businesses. As the governor's letter regarding his signing of this bill noted, "additional work in this area is needed, as CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants." The governor urged the legislature to "take this on next year to ensure a fair balance between protecting privacy information and preventing rapacious litigation."

Until then, though, SB 690 is likely to help adtech companies defending CIPA claims, as well as website owners prepared to litigate in court or arbitration. But SB 690 is unlikely to be a panacea for the CIPA shakedown that has plagued businesses around the country for nearly five years.