CIPA Case Watch — October 2026: The Law Changes, the Theory Doesn't
The month CIPA reform finally landed: Governor Newsom signed SB 690, narrowing the pen-register theory. But the theory that actually drives most website suits — §631, pre-consent interception — came through untouched, and the healthcare settlement wave kept paying out. Here's the month that was.
In this edition
If you track CIPA litigation, October 2026 is the cycle you'll remember as the one the law actually changed. On September 30, Governor Newsom signed SB 690, the first real statutory curb on the four-year wave of website-wiretapping suits. The headlines call it the end of CIPA litigation. It isn't — and the gap between what SB 690 did and what people think it did is the single most important thing for a site owner to understand this month. Three threads define the cycle: the pen-register theory narrowing, the §631 interception theory surviving and absorbing the pressure, and a healthcare settlement wave that kept paying out regardless of the legislative drama.
The shift this cycle
For two years the story was escalation — more filings, more demand letters, new theories. This cycle the story is divergence: one theory contracting by statute while another expands by litigation. SB 690 removed the private right of action for §638.51 pen-register/trap-and-trace website claims, handing them to the California Attorney General alone from January 1, 2027. Simultaneously, courts kept letting §631 interception claims proceed, and plaintiffs kept filing them. The net effect isn't less CIPA risk — it's a migration of CIPA risk from one statute to another. If your mental model is "pen register," update it to "§631, pre-consent."
It is worth being precise about scale, because the numbers explain the politics. Over roughly four years, CIPA produced thousands of filed suits and many thousands more demand letters — an entire cottage industry built on a 1960s-era wiretap statute applied to modern web tools. SB 690 is the establishment response to that volume. But a response aimed at the volume (the §638.51 demand-letter channel) does not touch the merits of the core theory (§631 interception), which courts have repeatedly allowed to proceed. That is why this cycle feels paradoxical: the biggest pro-defendant legislative event in CIPA history landed in the same month that §631 claims, AI-recording claims, and eight-figure settlements all kept advancing.
The Good — the pen-register door closes
The genuinely good news for defendants: the §638.51 theory that drove much of the demand-letter economy is being shut down, from two directions at once.
A few specifics worth holding onto, because they will shape how the next year of litigation plays out. SB 690 passed unanimously — 66-0 in the Assembly with unanimous Senate concurrence — which tells you the political consensus against the demand-letter wave was overwhelming. The version signed dropped an earlier "commercial business purpose" exemption, so the final law is cleaner and narrower than some drafts: it simply reassigns §638.51 website/app enforcement to the Attorney General rather than carving out categories of business. And the retroactivity provision reaches pending claims within its window, which is why plaintiffs' firms with §638.51-heavy dockets spent late September recalculating — some pending cases pleaded on a pure pen-register theory may not survive the operative date.
But note the ceiling on all of this: SB 690 is not yet operative. It takes effect January 1, 2027, and its retroactive application will be litigated case by case. Anyone who tells you §638.51 suits are "over" as of today is a quarter early and overstating the scope. The honest read is that a specific, high-volume nuisance channel is being closed on a known timetable — real relief for a narrow band of cases, and nothing at all for the broader §631 wave.
Limas v. Wayfair — the pattern in a single ruling
Limas v. Wayfair LLC is the cycle's most instructive case because it previewed SB 690's effect weeks before the signing. The court dismissed the §638.51 pen-register claim — but let the §631 and trap-and-trace claims survive, where identifiers were allegedly matched to social accounts. Six trackers, one dismissed theory, and the case rolls on anyway. That's SB 690 in miniature: close the pen-register door and plaintiffs walk through the §631 one.
Don't read "pen register is dead" as "I'm safe." The theory that survived Wayfair is the one SB 690 leaves alive — and it turns on trackers firing before consent, which is a configuration problem you can actually fix.
The stayed docket may resolve all at once
Dozens of pen-register cases were stayed pending the Variety Media appeal on whether §638.51 reaches online technology at all. SB 690 may moot much of that question for private plaintiffs going forward — but watch for a cluster of resolutions once the stays lift. A quiet docket this month isn't peace; it's cases holding their breath.
The Bad — §631 survives, and new verticals open
The flip side of SB 690's narrowness: everything it didn't touch kept moving. §631 interception claims advanced, and plaintiffs opened fronts in verticals that were quiet a year ago.
AI notetakers become a tracked tool class
The cycle's genuinely new category. In re Otter.AI Privacy Litigation saw claims proceed over AI meeting transcription recorded without all-party consent — CIPA §631/§632 plus the federal Wiretap Act and BIPA. Chamberlain v. Granola (N.D. Cal.) brings the same theory against another AI notetaker. These aren't website-pixel cases; they're recording-consent cases against meeting software — a §632 theory SB 690 doesn't touch at all.
If your business runs AI notetakers or transcription on calls, all-party recording consent is now a live litigation area. The "new tool, old statute" pattern that hit pixels is repeating with AI.
Telehealth and the FTC-plus-private convergence
Doe v. Hims & Hers Health pairs a private CIPA suit with an FTC action — the FTC and states acted against the telehealth company over sharing health data with Meta and Snap. The convergence matters: when a regulator and a plaintiffs' firm target the same conduct, the exposure compounds, and SB 690 does nothing for either the FTC track or the §631 private track.
The banner-as-evidence fact pattern sharpens
Costello v. Posh Peanut is the cycle's cleanest cautionary tale: the site's banner allegedly said "no PII" while six trackers — Meta, GA, DoubleClick, TikTok, Klaviyo, AppLovin — fired on page load. The complaint cites the FTC's 2024 hashed-data guidance. The lesson is blunt: a banner that promises one thing while the tag stack does another isn't a defense — it's evidence.
Your cookie banner's copy is discoverable. If it claims you don't share data while trackers fire before consent, you've written the plaintiff's exhibit for them. The banner and the behavior have to match.
Standing becomes a defense again
Bonkowski v. Maison Miru LLC was dismissed for lack of Article III standing, with leave to amend, citing the Ninth Circuit's Popa v. Microsoft line. It's a reminder that even as §631 claims proceed broadly, defendants are winning on threshold standing where plaintiffs can't show concrete injury — a defense that SB 690 doesn't create but that runs alongside it. Expect more standing fights as the §638.51 path narrows and plaintiffs lean harder on §631, where the injury theory is more developed but still contestable.
Standing is a defense, not a strategy. Winning a motion to dismiss on standing is expensive and uncertain; preventing the pre-consent collection that creates the alleged injury is cheaper and more reliable.
The wiretap theory goes multi-state
Barker v. Warner Music (Songkick.com) is the cycle's clearest signal that this is no longer just a California story. It's brought under the Illinois Eavesdropping Act and the federal Wiretap Act — not CIPA at all — and the allegation is pointed: that a visitor's "reject all" choice was ignored while tracking continued. For any business reading SB 690 as relief, Songkick is the counterweight: a nearly identical fact pattern, in a different state, under a different statute SB 690 has no effect on. Multi-state exposure means a California-only fix isn't a fix.
If you serve traffic nationally, your consent posture has to work everywhere. "Reject all" has to actually stop the trackers — a banner that logs the rejection but keeps firing is the Songkick fact pattern.
Beauty and retail stay in the crosshairs
Retail and consumer brands remained active targets. Hartigan v. Ulta Salon brings a Meta Pixel CIPA claim in the beauty vertical, and a separate Ulta matter this year produced a ruling that a privacy policy alone does not equal consent — a theme echoing across the cycle in different forms (Songkick's ignored "reject all," Posh Peanut's banner copy). The consent-mechanism itself is increasingly what's litigated: not whether you had a banner, but whether it did anything.
Does your banner match what actually fires?
Posh Peanut turns on the gap between banner copy and tag behavior. Scan your site free and see which trackers fire before consent — the exact mismatch these cases are built on — in about 10 seconds.
Run a free scan →The Ugly — the settlement wave keeps paying
While the legislature debated, the checks kept clearing. This cycle confirmed a shift that's been building all year: the CIPA/pixel wave is moving from filings to payouts, and healthcare is where the money is.
| Settlement | Amount | Vertical | Note |
|---|---|---|---|
| Berman v. Forbes Media | $10M | Media | CIPA + UCL; claim deadline ~Nov 9 |
| Penn Medicine | $9.25M | Healthcare | Final-approval hearing ~Nov 12 |
| Wellstar Health System | $4.25M | Healthcare | Claim deadline ~Nov 10 |
| LifeStance Health | $3.02M | Healthcare | ~1M patients |
| Atrium Health | up to $1.8M | Healthcare | Patient-portal pixel |
| Cone Health | $1.76M | Healthcare | MyChart pixel |
Six settlements, four of them healthcare. Add the $4.5M AMN Healthcare interpreter-session case (a §632 recording theory, notably) and the pattern is unmistakable: healthcare has appeared in our signal tracking for eleven consecutive cycles, and it's now a payouts story, not just a filings one. The common thread in nearly every one: a tracking pixel on a patient portal or intake flow, firing before consent. Full detail on all of these is in the CIPA lawsuit tracker.
Why the money is in healthcare
The settlement table isn't random — it's a map of where the fact pattern is strongest. Health systems put tracking pixels on exactly the pages where the most sensitive data is entered: symptom checkers, "find a doctor" tools, appointment booking, and patient portals like MyChart. When a Meta Pixel fires on those pages before a patient consents, it can transmit the fact that a specific person is seeking specific care — a disclosure that's both legally potent and viscerally alarming to a jury. That combination is why health systems settle rather than litigate, and why the numbers climb into eight figures.
Penn Medicine's $9.25M (final-approval hearing approaching) and Wellstar's $4.25M anchor the high end; LifeStance's $3.02M reaches roughly a million behavioral-health patients — a category where the sensitivity is even higher. The smaller Atrium (~$1.8M) and Cone ($1.76M) MyChart-pixel settlements show the pattern isn't limited to the largest systems; any provider running analytics or ad pixels on a patient portal is exposed. And the $4.5M AMN Healthcare matter is the tell for what comes next: it's a §632 recording theory (interpreter sessions), not a pixel case — exactly the kind of claim SB 690 leaves completely alone.
If you're in healthcare or handle health-adjacent intake data, treat the patient-facing flow as the highest-risk surface on your site. The settlements share one root cause: a tracker firing before the patient agreed. That's auditable in minutes.
Beyond healthcare, Berman v. Forbes Media's $10M (CIPA + UCL, claim deadline around November 9) is the cycle's reminder that media and publishing remain squarely in the wave — and that the dollar figures outside healthcare are climbing too. The through-line across every vertical is the same: the money follows pre-consent tracking, wherever it happens.
The patterns: what changed, what didn't
The cycle in one table.
| Development | What changed | Your exposure |
|---|---|---|
| SB 690 signed | §638.51 private claims → AG-only (2027) | Lower for §638.51-only CA cases; unchanged otherwise |
| §631 interception | Nothing — fully intact | Unchanged and now the primary theory |
| AI notetakers | New tool class (§631/§632 + Wiretap Act) | New, if you record calls/meetings |
| Telehealth + FTC | Regulator + private convergence | Higher for health/intake data |
| Banner-vs-tagstack | Banner copy used as evidence | Higher if banner ≠ behavior |
| Healthcare settlements | Filings → payouts | Pattern: pixel on portal/intake pre-consent |
Read the second row twice. The theory with the biggest "unchanged" and the one plaintiffs are consolidating around is §631 — pre-consent interception — which is precisely the thing a prevention-first setup is built to eliminate.
Also this cycle
A few developments that didn't define the month but belong in the record:
If a demand letter is what brought you here, that's its own playbook — verify the sender, capture what your site actually does before you change anything, and don't pay on deadline pressure alone. We'll cover the full 48-hour response separately; for now, the scan is step one, because it preserves a record of current behavior.
What to do right now
The common fix behind all four: know what fires before consent, and stop it. See the CIPA overview, the SB 690 explainer, and run a scan of your own site.
Frequently asked questions
Did SB 690 end CIPA website lawsuits?
No. SB 690 (signed Sept 30, 2026, operative Jan 1, 2027) removed the private right of action for §638.51 pen-register claims in California only. It left §631 interception claims, §632 recording claims, the federal Wiretap Act and other states' laws fully intact. Most website suits plead §631, so they continue.
What's the biggest CIPA risk now that SB 690 is law?
§631 — the interception theory, which alleges trackers capture a visitor's communications before they consent. SB 690 doesn't touch it, and plaintiffs are consolidating around it. The underlying issue is trackers firing before consent on your site.
Why is healthcare dominating CIPA settlements?
Patient-portal and health-intake pages commonly run tracking pixels (often Meta Pixel) that fire before consent, sharing sensitive health data with third parties. That fact pattern is both legally strong for plaintiffs and reputationally costly, so cases settle. This cycle saw Penn Medicine ($9.25M), Wellstar ($4.25M), LifeStance ($3.02M), Atrium (~$1.8M) and Cone ($1.76M), among others.
Are AI notetakers really a CIPA risk?
Yes — it's the cycle's new tool class. Cases against Otter.ai and Granola allege AI meeting transcription recorded conversations without all-party consent, under CIPA §631/§632 and the federal Wiretap Act. This is a recording-consent issue SB 690 does not affect.
Where can I see the full list of cases?
Our CIPA lawsuit tracker maintains every tracked case with court, status, technology and settlement, updated monthly. Each §638.51 entry now carries an SB 690 status note.
The bottom line
October 2026 was the month the law finally moved — and the month that proved a law can move without the risk moving with it. SB 690 narrowed one theory, in one state, from a future date. The theory that actually drives most website suits, §631 pre-consent interception, came through completely intact and is now the center of gravity.
For site owners the takeaway is the opposite of the headline: this is not the moment to relax your consent setup — it's the moment the surviving theory became the only one that matters. Know what fires before consent, and stop it. That was the right answer before SB 690, and it's the right answer after.
See what fires before consent — free
The surviving CIPA theory (§631) turns on trackers firing before consent. See which ones fire on your site before anyone clicks "Accept," mapped to CIPA, CCPA and GDPR exposure, in about 10 seconds. No extension, no code.
Run your free scan →An educational roundup, not legal advice. Case names, dockets, dates and settlement amounts are drawn from public reporting and should be verified against primary court records before relying on them; some remain subject to confirmation or appeal. The $5,000-per-violation figure refers to statutory damages under California Penal Code §637.2, which applies to §631/§632 claims SB 690 does not affect. Confirm your situation with qualified counsel.