SB 690 Explained: 1 CIPA Lawsuit Theory Ends in 2027, 2 Remain

California passed the California Invasion of Privacy Act (CIPA) in 1967 to protect residents from eavesdropping on their private conversations (Crowell). It was written for telephones, but its wording is broad enough that plaintiffs apply it to the web. Three sections matter for website owners:

• §631 (wiretapping): bars reading or learning the contents of a communication in transit "without the consent of all parties," and reaches anyone who "aids, agrees with, employs, or conspires" with someone who does (§631). Plaintiffs argue that a third-party script on your site is an outside listener and that you helped it listen.
• §632 (eavesdropping): bars recording or eavesdropping on a confidential communication without the consent of all parties (§632).
• §638.51 (pen registers and trap-and-trace devices): restricts "pen registers," which record "dialing, routing, addressing, or signaling information" but not the contents of a communication, and "trap and trace devices," which capture information identifying the source of a communication (§638.50 definitions). Plaintiffs argue that trackers capturing IP addresses and device data are such devices.

What makes CIPA expensive is its damages clause. A private plaintiff can recover the greater of $5,000 per violation or three times actual damages, and does not have to prove actual harm (§637.2). Courts disagree on how violations are counted, but in a class action that per-violation figure drives settlement pressure. Holland & Knight notes that "a nuisance-value settlement will often be the economically rational choice" for defendants (Holland & Knight).

Plaintiffs have brought §631 cases over pixels, cookies, session replay and website chat (Hinshaw). The allegation changes with the tool:

• Advertising and analytics pixels: page views, searches or form entries are sent to an ad platform as they happen, letting a third party "read" the communication.
• Chat widgets: a vendor's servers receive and store the conversation, making the vendor an unannounced third party in the chat.
• Session replay: the script captures clicks, scrolling and typing, effectively recording the visit.
• Pen-register claims: any tracker that collects IP addresses or device identifiers is a "trap and trace device," even if it captures no contents.

The pen-register theory spread because it did not need any "contents" at all, and courts split on it. In 2024, Licea v. Hickory Farms in Los Angeles Superior Court and Levings v. Choice Hotels reached opposite conclusions on whether web tracking counts, and a tentative ruling from California's Second Appellate District in Variety Media v. Superior Court said trackers that collect only IP addresses are not pen registers (Crowell).

The volume has been large. An earlier Crowell case study described "dozens" of class actions and "hundreds of demand letters" built on these theories, and in October 2026 WilmerHale wrote that SB 690 is "likely resolving thousands of pending lawsuits" (Crowell; WilmerHale).

SB 690 amends CIPA's remedies section, §637.2. Starting January 1, 2027, a pen-register claim under §638.51 that arises from conduct on an "internet website, online application, or mobile application" can be brought only by the Attorney General (Crowell; Covington).

• Who loses the claim: private plaintiffs and their lawyers, for website and app conduct.
• Who keeps it: the California Attorney General.
• Pending cases: the law applies to any pending claim in an action filed within the two years before January 1, 2027, which law firms read as suits filed on or after January 1, 2025 (Hinshaw).
• A challenge is coming: plaintiffs have signaled a constitutional challenge to that retroactivity provision, and the Legislature added a severability clause so the rest of the law survives if it falls (Hinshaw).

The enacted bill is far narrower than its original draft, which would have exempted tracking for a "commercial business purpose" from CIPA altogether (WilmerHale). In his signing message, Governor Newsom criticized "the vexatious use of CIPA lawsuits and demand letters to extract settlement money" and called for "additional work" on broader reform (Covington), so more changes may come in 2027.

Only one of CIPA's three website theories moves to the Attorney General. Here is where each claim stands after January 1, 2027:

Other routes also remain, including the California Comprehensive Computer Data Access and Fraud Act, other states' wiretap laws, the federal Electronic Communications Privacy Act, common-law privacy claims and unfair-practices claims (Crowell; WilmerHale).

Plaintiffs' firms have framed SB 690 as a green light for §631 website-tracking claims. Holland & Knight calls that argument "conclusory," because §631 requires a provable "communication," a harder showing than the IP address and browser data most recent complaints rely on. It also notes that district judges have denied class certification in "at least seven" website wiretapping cases in recent months (Holland & Knight). In practice, expect fewer pen-register letters and more §631 letters, not an end to the letters.

These steps reduce both CIPA risk and state privacy-law risk, and none of them requires a new vendor:

1. Inventory every third-party script: ad pixels, analytics, tag managers, chat, session replay and embedded video, with what each one collects and where it sends it.
2. Gate non-essential tags behind consent. CIPA complaints typically target tracking that runs without prior consent (Crowell), so set your consent tool to load pixels and session replay only after a visitor agrees, then verify it with a scan.
3. Disclose chat recording before the chat starts. Tell visitors the conversation is recorded and handled by a named vendor, and get agreement before the first message.
4. Mask session replay. Turn on input masking for every form field, and exclude checkout, login, account and health-related pages entirely.
5. Strip sensitive data from pixels. Remove search terms, form values and URL parameters that could reveal health, financial or identity details.
6. Sign proper vendor contracts. Use service-provider terms that limit each vendor to your purposes. Tractor Supply's $1.35 million CCPA fine in 2025 included disclosing personal information without such contracts (CalPrivacy).
7. Honor opt-out signals such as Global Privacy Control across your site. Here is how to test it.
8. Make your privacy policy match reality. Name the trackers' purposes and recipients, and update the policy whenever you add a tool.
9. Keep dated evidence of scans, consent settings and policy versions, so you can show what your site did on any given date.

Do not ignore it, and do not assume SB 690 ends it. Ask your lawyer three questions:

• Which sections does it cite? A pure §638.51 website claim is the one SB 690 targets; many letters also plead §631.
• When was the suit filed? Retroactivity reaches pending claims in actions filed within the two years before January 1, 2027.
• What does the site actually load, and when? Your tracker inventory and consent records are the core of any defense.

Kilpatrick recommends reviewing pending §638.51 claims for a notice of supplemental authority and revisiting demand letters that rely on a §638.51 theory (Kilpatrick). For a broader view of website litigation exposure, see our lawsuit risk overview.