California has enacted Senate Bill 690 (SB 690), which bars private plaintiffs from suing over website and app tracking under one California Invasion of Privacy Act (CIPA) provision. This offers some relief to businesses that have faced lawsuits and demand letters under the CIPA over website cookies and tracking tools.

CIPA was enacted in 1967, a year before the federal Wiretap Act. Federal law requires only one-party consent, but CIPA generally requires the consent of all parties. Because CIPA’s language is broad, modern-day plaintiffs have increasingly tried to use it over the past few years to target website cookies, pixels and similar technologies across the United States.

On Sept. 17, the Texas Attorney General issued a warning, stating that: “Demand letters of this type may exaggerate or misrepresent a potential violation of law.” It also advised, “While receiving such a letter can be concerning, entities should not respond directly to the sender or provide payment without first consulting qualified legal counsel, if possible.”

Less than two weeks later, on Sept. 30, Governor Newsom signed SB 690 into law. The governor also called for further reform of CIPA’s other “decades-old” provisions and urged the California legislature to take this on next year.

About SB 690:

• The law takes effect Jan. 1, 2027.
• Applies retroactively to pending actions filed within two years before the law takes effect.
• Only the Attorney General may bring an action against a private actor under CIPA Section 638.51.

What SB 690 doesn’t do: SB 690 does not change what Section 638.51 prohibits, it only removes the private right of action under that section. Plaintiffs may still bring claims under other CIPA provisions, such as Sections 631 and 632, and under other legal theories, such as the federal Electronic Communications Privacy Act. Some are shifting their theory of liability altogether and alleging other types of internet claims, such as those premised on a website’s consent banner disclosure and internet cookie configuration. Plaintiffs’ firms are also likely to challenge the retroactivity provision on constitutional grounds. However, SB 690 contains a severability clause stating that if a provision is invalidated, the rest of the act will remain in effect, providing at least prospective relief against these pen register claims.

Recommended steps:

• Keep your Terms of Use and Privacy Policy current, including how visitor information is collected and used.
• Configure cookies and trackers so they fire only after a visitor affirmatively consents.
• Maintain a clear consent mechanism, such as a homepage cookie banner.

For questions about SB 690, a CIPA demand letter or digital privacy-related questions, please contact us.