If your company operates a website (as virtually every company does), a California statute enacted almost six decades ago to combat telephone wiretapping is already creating significant litigation exposure for your business. The California Invasion of Privacy Act (“CIPA”) is one of the country’s most actively litigated privacy statutes, with claims targeting ordinary analytics tools, advertising pixels, and chat widgets that power the modern internet. On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 690 (“SB 690”) into law, reshaping this litigation landscape significantly. SB 690 is poised to grant a degree of reprieve to website operators, particularly those who understand what has changed about CIPA, and what remains the same.
Overview of CIPA and the Litigation Landscape
CIPA was enacted in 1967 to prohibit eavesdropping and wiretapping of private communications, but plaintiffs’ attorneys have repurposed it to target common website tracking technologies such as cookies, tracking pixels, session replay software, and analytics platforms. Because CIPA’s protections follow the website visitor rather than the business, any company whose website collects data from California visitors can face claims. CIPA authorizes statutory damages of $5,000 per violation, and plaintiffs routinely argue that each website visit constitutes a separate violation, creating substantial potential exposure without proof of actual harm.
Recent Case Developments
CIPA website tracking claims generally proceed under two theories: (1) Section 631(a), which plaintiffs invoke to allege that third-party tools intercept, without consent, the “contents” of web communications in transit, such as text entered into search bars or online forms, and (2) Section 638.51, which plaintiffs apply to characterize pixel-tracking and analytics tools as pen registers, implying they capture website-visit metadata without statutory authorization.
Case law remains divided. California state trial courts have increasingly dismissed Section 638.51 claims as aimed at telephonic surveillance rather than commercial websites, while federal courts have more often allowed them to survive the pleading stage. In June 2026, the U.S. District Court of the Northern District of California approved a $3.85 million class settlement in Mirmalek v. Los Angeles Times Communications LLC. The settlement did not resolve the merits, but it underscores the continuing financial exposure. Variety Media, LLC v. Superior Court remains pending before the Second Appellate District and presents the first opportunity for a California appellate decision on Section 638.51’s application to website tracking. In August 2026, the California Court of Appeal issued a tentative ruling that CIPA’s pen register provision is not limited to telephone equipment and may include data collection processes concerning online communications. It also held that collecting a visitor’s IP address alone was not sufficient to state a pen register claim. The ruling may still change, so website operators should not treat this as a settled issue.
California SB 690
SB 690 amends Cal. Penal Code § 637.2 so that a Section 638.51 claim arising from conduct on a website, online application, or mobile application may be brought only by the California Attorney General, not by a private plaintiff. SB 690 applies retroactively to pending claims in actions commenced up to two years before the law’s operative date of January 1, 2027.
These changes should bring relief, but are still narrower than those originally proposed. Earlier versions included a broad “commercial business purpose” exemption covering Sections 631, 632, and 632.7 of CIPA, but that language was removed. SB 690 leaves Section 631 wiretapping claims and Section 632 eavesdropping claims intact. Plaintiffs will likely pivot to these surviving theories in new filings and amendments to existing complaints.
Practical Takeaways for Businesses
Businesses should take the following steps now.
- Audit, map, and test every website tracking tool. Identify all third-party tags, pixels, analytics tools, and chat widgets, and map where the resulting data goes, including whether vendors may use or monetize visitor data independently. Test what data each tool collects, when it fires, and to whom the collected data is sent.
- Implement meaningful consent mechanisms. Ensure tracking technology loads only after affirmative consent and that declining consent stops data collection. Disable or reconfigure any tool that collects or shares data before a visitor affirmatively grants consent.
- Update your privacy policy. Keep it specific and current, accurately describing the site’s data practices and CIPA’s reach to California visitors regardless of the business’ location. Correct any gaps between what the technology does and what you disclose to visitors.
- Inventory pending CIPA claims. For Section 638.51 claims filed within the retroactivity window, evaluate whether SB 690 provides a basis for dismissal.
- Preserve evidence needed for litigation. Save (with dates) all policy updates, consent records, testing and audit assessments, and deployment schedules.
- Reassess settlement posture. Businesses facing pen register-only claims without a Section 631 component should evaluate available grounds to challenge those actions before settling.
Website privacy compliance is neither optional nor a one-time exercise. Although SB 690 meaningfully reduces one category of claims, it does not eliminate broader compliance obligations. Businesses best positioned to navigate this environment are those that treat their website data practices as a current and ongoing legal priority.
If your business has questions about CIPA exposure, pending litigation, or reducing tracking-related risk, we encourage you to reach out to any member of the Broadfield U.S. team.
