California has enacted Senate Bill (SB) 690, which narrows the circumstances under which private parties may bring lawsuits under the California Invasion of Privacy Act (CIPA), Cal. Penal Code Section 638.51.
The new law takes effect January 1, 2027, and notably includes a two-year look-back period for pending lawsuits commenced before the law was enacted.
Brief History
CIPA, enacted in 1967, includes civil and criminal provisions and, importantly, allows private parties to enforce the law. The law also allows those private parties to recover at least $5,000 per violation. CIPA generally prohibits the interception and use of the contents of a communication without the consent of all parties to the communication. Subject to narrow exceptions, the law also prohibits the installation or use of a “pen register” or “trap and trace device” without a court order or consent of all parties whose communication might be captured by those devices.
Plaintiffs Have Targeted Websites
Although terms in the law like “pen register” or “trap and trace device” referred to physical devices used to collect telephone dialing and routing information on a landline telephone network, plaintiffs have increasingly alleged that this provision should apply to common website technologies, such as cookies, pixels, and tags, under the theory that those technologies capture information about the website visitor and their activity similar to a pen register and trap and trace device.
CIPA allows an injured person to recover statutory damages of $5,000 per violation or three times the amount of actual damages, whichever is greater. A plaintiff generally does not need to prove actual damages. As a result, businesses of various sizes have faced lawsuits, arbitration demands, and prelitigation notices alleging that their websites and the technologies deployed on their websites violated CIPA by collecting visitors’ digital routing, addressing, or signaling information.
Relief for Businesses
SB 690 eliminates the private right of action under the “pen register” or “trap and trace device” provisions of the law against digital properties. Under the amendment, only the California Attorney General may bring an action under CIPA’s civil-remedies provision against a private actor for an alleged violation arising from conduct occurring on an internet website, online application, or mobile application. The limitation also applies retroactively to pending claims in actions commenced during the two years preceding the law’s operative date.
SB 690 did not repeal CIPA’s restrictions on pen registers and trap and trace devices. Instead, it changes who may pursue civil remedies for this defined category of online conduct.
SB 690 also does not eliminate private lawsuits involving other provisions of CIPA, including certain claims alleging unauthorized wiretapping or the recording or use of confidential communications.
Businesses should therefore avoid treating SB 690 as a general exemption for website tracking technologies. Companies should continue reviewing the cookies, pixels, analytics tools, chat functions, session-replay software, and other third-party technologies deployed on their websites and applications.