SB 690 Explained: What California's CIPA Reform Actually Means
On September 30, 2026, Governor Newsom signed SB 690 into law — the biggest change to California's wiretap-litigation landscape in years. But it's far narrower than the headlines suggest. Here's exactly what changed, who it protects, and why it doesn't end your website tracking risk.
What's on this page
SB 690 is the California bill that, after a four-year wave of website-tracking lawsuits under the California Invasion of Privacy Act (CIPA), curbs one of the two legal theories plaintiffs have been using. Governor Newsom signed it on September 30, 2026, and it becomes operative on January 1, 2027. If you've been following the CIPA litigation — or received a demand letter — you've probably seen the headlines calling it a game-changer. It is significant. It is also much narrower than "CIPA is over," and reading it that way is a mistake that could leave you exposed. This guide explains exactly what SB 690 does, walks you through a decision tree to see whether it affects you, and makes the case most reform coverage skips: the theory SB 690 leaves fully intact is the one that matters most for your website.
What SB 690 actually does
CIPA litigation against websites has run on two main theories. The first is Section 631 — the wiretapping/interception theory: that trackers intercept a visitor's communications without consent. The second is Section 638.51 — the "pen register / trap and trace" theory: that tracking software is an illegal device capturing routing and identifier data. Over the last few years, plaintiffs' firms leaned heavily on §638.51 because it was newer and, for a while, harder for defendants to beat.
SB 690 amends Section 638.51 to remove the private right of action for pen-register/trap-and-trace claims arising from website, app and mobile tracking. In plain terms: private plaintiffs and their firms can no longer file §638.51 website-tracking suits. Only the California Attorney General can bring those claims now. The bill also reaches back — it applies to pending §638.51 claims within its retroactivity window, not just future ones, which is why hundreds of stayed cases are watching it closely.
Crucially, SB 690 does one thing to one theory. It does not touch Section 631, Section 632, federal law, or any other state's wiretap statute. That narrowness is the whole story — and the rest of this guide is about what it means for you.
The timeline: passed, signed, operative
Three dates matter, and conflating them is the most common error in early coverage.
So where are we today? SB 690 is signed law, but not yet operative — it takes effect January 1, 2027. Anyone telling you "§638.51 suits are dead now" is a quarter off: the change is certain, but its operative date is in the future, and its retroactivity will be litigated. Don't write off a live matter on the assumption the law already applies.
What it changes — and what it leaves alone
This is the heart of it. SB 690 is a scalpel, not a repeal. Here's the full picture of what's curbed versus what survives completely intact.
Read the right-hand column again. The §631 interception theory — the one alleging that trackers capture a visitor's communications before they consent — is completely untouched. So is §632 recording (the basis of settlements like the $4.5M AMN Healthcare interpreter-session case). So is the federal Wiretap Act, and so is every other state's wiretap statute. SB 690 closed one door in one state; the others are wide open.
Does SB 690 apply to me?
Most coverage explains the law but never answers the only question a site owner actually has: does this change anything for me? Run your situation through this decision tree.
The punchline most reach: unless your matter is a California, §638.51-only claim, SB 690 changes little for you. And here's the catch that the decision tree's last line makes — most plaintiffs' complaints plead §638.51 and §631 together. Strike the §638.51 count and the §631 count carries the case forward. That's not theoretical: in the Wayfair litigation, the §638.51 claim was dismissed while the §631 and trap-and-trace claims survived. SB 690 formalizes a pivot that was already happening.
Why §631 is the theory that matters now
If §638.51 is being curbed and plaintiffs are pivoting to §631, then §631 is the theory to understand. And §631 is fundamentally about timing: it alleges that trackers intercept a visitor's communications before the visitor consents. That's the pre-consent interception pattern — the pixel, the session-replay script, the analytics tag that fires the instant the page loads, before anyone clicks "Accept."
This matters enormously for how you respond to SB 690. Competitors' advice is pivoting toward "collect better individual-level records so you can defend a §631 claim." That's monitoring after the fact. The prevention-first answer is simpler and stronger: if nothing fires before consent, there's no pre-consent interception to allege in the first place. SB 690 didn't reduce the importance of blocking trackers before consent — by pushing litigation toward §631, it increased it.
SB 690 closed the door plaintiffs were leaving anyway. The door they're walking through — §631, pre-consent interception — is the one a prevention-first setup was always built to shut.
See what fires before consent on your site
§631 turns on trackers firing before consent. Scan your site free and see exactly which trackers fire before anyone clicks "Accept," in about 10 seconds — the pattern the surviving theory targets.
Run a free scan →The retroactivity fight: why SB 690 isn't settled yet
Signing the bill didn't end the argument — it moved it. SB 690's pen-register carve-out doesn't take effect until January 1, 2027, and it was written to reach backwards: it applies retroactively to pending §638.51 claims filed in the two years before that date — roughly any suit filed on or after January 1, 2025. That retroactive reach is now the live battleground.
CIPA plaintiffs have signalled that they intend to challenge the retroactivity provision on constitutional grounds, which means the dismissals businesses are expecting for pending pen-register cases may be contested rather than automatic. The Legislature anticipated this and added a severability clause: if a court strikes down the retroactivity provision, the rest of SB 690 still stands. In practice that creates a window of ambiguity between now and the January 1, 2027 effective date — the statute is law, but how it treats cases already on file is not yet resolved.
For a business with a live demand letter or a pending §638.51 claim, that uncertainty is the whole story. Three things are moving on different clocks:
The private pen-register claim still exists. Until the operative date, §638.51 private suits can still be filed and litigated. The change is coming, not here.
Private §638.51 claims become AG-only for website, app and mobile conduct — and the law reaches back to pending claims filed on or after Jan 1, 2025.
Retroactivity may be struck down. If plaintiffs' constitutional challenge succeeds, pending cases could survive — but the severability clause keeps the forward-looking AG-only rule intact either way.
The practical takeaway hasn't changed, and that's the point: betting your compliance posture on pending-case dismissals is betting on an unresolved question. The conduct that drives the claims — trackers firing before consent — is still what a §631 suit targets, and §631 isn't part of this fight at all.
The false comfort to avoid
The single biggest risk around SB 690 isn't legal — it's psychological. The headlines read "California curbs CIPA lawsuits," and a busy site owner concludes "good, I can stop worrying about tracker consent." That conclusion is wrong in at least five ways, and acting on it is how a reform meant to help you ends up hurting you.
It isn't only privacy advocates saying the risk survives. In October 2026 the IAB — the advertising industry's own trade body — published analysis concluding that websites still face $5,000-per-violation wiretap claims after SB 690, because the surviving §631 and §632 sections carry the same statutory damages under California Penal Code §637.2 that the pen-register theory did. When the ad industry's own association tells its members the exposure didn't end, "the lawsuits are over" is not a reading you want to rely on.
The honest one-line summary: SB 690 narrows one theory, in one state, from one future date — and leaves the theory that most likely applies to you fully alive. It's real relief for a specific slice of §638.51-only California litigation. It is not permission to stop caring what fires on your site before consent.
Who is CIPA reform really for?
SB 690 passed the California Legislature unanimously, which is rare and tells you something about how the politics lined up. It's worth understanding who pushed for it and who pushed back, because it shapes how to read the "relief" framing.
Supporters — including major technology and advertising companies — argued that a cottage industry of plaintiffs' firms had weaponized a decades-old wiretap statute, sending thousands of demand letters over ordinary, widely used web tools, and that the litigation had become abusive rather than protective. News publishers, in particular, framed it as relief from "unreasonable lawsuits." Critics — including the ACLU and consumer-privacy groups — characterized the bill as industry-backed and argued it strips individuals of a meaningful enforcement tool, with some calling the campaign behind it astroturfing. Both characterizations are part of the public record; which you find persuasive depends on your view of private enforcement versus regulator enforcement.
For a site owner, the practical reading sits above that debate: a law written to curb abusive demand letters under one theory does not change the underlying privacy expectation — that you shouldn't collect a visitor's data before they agree. The demand-letter economy may cool for §638.51; the reason it existed (trackers firing before consent) is unchanged, and it's still actionable under §631. If you received a demand letter, by the way, the response playbook is its own topic — and a state Attorney General recently called many such letters outright scams, which is worth knowing before you pay anyone.
SB 690 in context: the wider California shift
SB 690 didn't pass in isolation. It moved through the Legislature alongside a cluster of privacy bills, and reading it next to them shows the real direction of California privacy law: narrowing one private-litigation theory while expanding regulator-driven controls elsewhere. That matters, because the "CIPA is getting easier" headline misses that other obligations are getting harder at the same time.
Two companion measures moved alongside SB 690: one aimed at strengthening consumers' deletion rights as they flow through to data brokers, and another aimed at restricting the sale of precise geolocation, biometric and health data. Treat the specifics of those as "watch and verify" rather than settled — the point here isn't the detail of each bill, it's the pattern. California is not retreating from privacy enforcement; it's reshaping who enforces and how. The §638.51 demand-letter channel narrows; regulator authority and data-type-specific rules broaden.
For a site owner, the takeaway is to resist a California-specific, CIPA-specific mental model. The thing that protects you across all of these shifts is the same: knowing what data you collect, collecting it only with consent, and being able to prove it. A business organized around that principle doesn't have to re-strategize every time one statute is amended — it is already positioned for whichever enforcement mechanism is ascendant this year. A business organized around "which exact lawsuit can hit me today" is forever chasing the last headline — and SB 690, for all its significance, is exactly the kind of headline that invites that mistake. The durable move is to fix the data practice underneath, so the next amendment, in any state, finds you already compliant.
What to do now
SB 690 is a good moment to get your house in order — not to relax. A practical order of operations:
The through-line: a prevention-first consent setup — one that blocks trackers before consent rather than just showing a banner — addresses the theory SB 690 leaves alive, across every state, regardless of this reform. That's the posture that was right before SB 690 and is still right after it. For the full litigation picture, see the CIPA lawsuit tracker and the CIPA overview.
Key takeaways
- SB 690 is signed (Sept 30, 2026) and becomes operative Jan 1, 2027 — it is not in force yet, and its retroactivity will be litigated.
- It removes the private right of action under §638.51 (pen register / trap and trace) for website and app tracking, making those claims Attorney-General-only.
- It leaves §631 (interception), §632 (recording), the federal Wiretap Act, and other states' laws fully intact — with their private rights of action.
- Unless your matter is a California, §638.51-only claim, SB 690 likely changes little — and most complaints also plead §631, which carries the case.
- The surviving theory, §631, is about pre-consent interception — so blocking trackers before consent matters more after SB 690, not less.
- $5,000 per violation under Cal. Penal Code §637.2 still applies through §631/§632 — SB 690 doesn't touch it.
- Don't read the reform as permission to relax: it narrows one theory, one state, one future date.
Frequently asked questions
Is SB 690 now law?
Yes — Governor Newsom signed SB 690 on September 30, 2026. However, it is not yet operative: it takes effect on January 1, 2027. So it is signed law but not yet in force, and its retroactive application to pending cases will be worked out in court.
What exactly does SB 690 change?
It amends California Penal Code §638.51 to remove the private right of action for pen-register and trap-and-trace claims based on website, app and mobile tracking. Private plaintiffs can no longer bring those specific claims — only the California Attorney General can. It applies to pending §638.51 claims within its retroactivity window as well as future ones.
Does SB 690 end CIPA website lawsuits?
No. It curbs one theory (§638.51) in one state (California). It leaves §631 wiretapping/interception claims, §632 recording claims, the federal Wiretap Act, and other states' wiretap laws fully intact — all with private rights of action. Most CIPA complaints plead §631 alongside §638.51, so they generally continue.
Does SB 690 apply to my business?
It helps most directly if you're facing a California, §638.51-only pen-register claim. If your matter also pleads §631, or is outside California, or is under federal law, SB 690 provides little or no relief. And it doesn't change your exposure for trackers firing before consent, which is a §631 issue it leaves untouched.
Does SB 690 mean I can stop worrying about tracker consent?
No — this is the most important misread. The §631 interception theory, which targets trackers firing before a visitor consents, survives in full. If anything, by pushing litigation toward §631, SB 690 makes blocking trackers before consent more important, not less.
Can the California Attorney General still sue under §638.51?
Yes. SB 690 removed the private right of action for §638.51 website claims; it did not make the conduct lawful. The California Attorney General retains authority to bring those claims.
Is the $5,000-per-violation figure still relevant after SB 690?
Yes. The statutory-damages figure of $5,000 per violation under Cal. Penal Code §637.2 still applies to the CIPA provisions SB 690 doesn't touch — principally §631 and §632. The financial exposure behind the surviving theories is unchanged.
The bottom line
SB 690 is a real and significant change — but a precise one. It takes a single litigation theory (§638.51 pen register), in a single state (California), and makes it enforceable only by the Attorney General, starting in 2027. For a narrow band of §638.51-only California cases, that's meaningful relief.
For everyone else, the picture is unchanged, and the honest headline is the opposite of the easy one: the theory SB 690 leaves alive — §631, trackers firing before consent — is the one most likely to apply to you. Treat the reform as a prompt to finally close that gap, not as permission to ignore it.
Close the gap SB 690 leaves open — free
§631 is about trackers firing before consent. See which ones fire on your site before anyone clicks "Accept," mapped to CIPA, CCPA and GDPR exposure, in about 10 seconds. No extension, no code.
Run your free scan →A plain-English explainer, not legal advice. SB 690 is newly enacted and its scope — especially its retroactive application to pending cases — will be tested in litigation. Section references (§638.51, §631, §632, §637.2) are summarized for context; the $5,000 figure refers to statutory damages under California Penal Code §637.2. Sources on the political background are attributed and reflect public reporting. Confirm how SB 690 affects your specific situation with qualified counsel.