California Invasion of Privacy Act (CIPA) Update
Legislature Eliminates Private Right of Action for Website Pen Register/Trap and Trace Claims (Cal. Penal Code § 638.51)
The California Invasion of Privacy Act (CIPA), originally enacted in 1967 as a telephone wiretapping law, has become a major concern for website operators of all sizes, regardless of location. In recent years, plaintiffs’ attorneys have increasingly targeted California Penal Code § 638.51—intended to regulate law enforcement’s use of pen registers and trap and trace devices—by alleging that common website tracking technologies (such as pixels, cookies, and analytics tools) violate the statute. Many courts have allowed these claims to proceed, exposing businesses to statutory damages of $5,000 per website visit without proof of actual harm.
Major Legislative Change
On Friday, August 28, 2026, the California Legislature unanimously passed S.B. 690, which eliminates the private right of action for § 638.51 claims arising from website and application activity. The bill applies retroactively to claims accrued within the past two years and will soon be sent to Governor Newsom, who has until September 30, 2026 to sign or veto. If enacted, the law will take effect January 1, 2027.
Key Changes Under S.B. 690
- No Private Right of Action: The bill amends Penal Code § 637.2, removing the mechanism that fueled thousands of demand letters under § 638.51. Enforcement authority will rest solely with the California Attorney General.
- Retroactive Application: If signed, the bill will apply to any claim filed within two years before January 1, 2027. Businesses facing § 638.51 lawsuits should carefully assess their litigation and settlement strategies in light of this retroactivity.
- Severability: The bill includes a severability clause, ensuring that the elimination of the private right of action remains intact even if the retroactivity provision is challenged.
What S.B. 690 Does Not Change
- Criminal Penalties Remain: The bill does not repeal § 638.51 or its criminal penalties. The Attorney General retains enforcement authority.
- Other CIPA Claims Unaffected: The private right of action for other CIPA provisions, including § 631(a) (wiretapping), remains. Website tracking litigation may continue under § 631(a), but those claims require proof that the contents of a communication were intercepted in transit—a higher bar for plaintiffs.
Text of the Changes
S.B. 690 amends California Penal Code § 637.2 to read:
Next Steps
S.B. 690’s passage by the legislature does not guarantee it will be signed into law, and it does not fully eliminate exposure under CIPA or other state and federal privacy law claims. Businesses operating websites should consider:
- Auditing what their websites actually collect and where, or to whom, that data goes;
- Implementing proper consent mechanisms; and
- Confirming that their privacy policies accurately describe actual data practices, are compliant with state laws, and reviewed regularly to keep it up to date.
We are monitoring the bill’s progress and will provide updates as developments occur.
