Thousands of California web-tracking lawsuits could face dismissal under a new state law.
Governor Gavin Newsom signed Senate Bill 690, known as SB 690, on September 30, 2026.
The law changes who can bring some claims under the California Invasion of Privacy Act, or CIPA.
The change covers some website and app tracking tools. These tools include cookies, tracking pixels, and analytics software.
However, SB 690 does not end all California privacy lawsuits. It limits private claims under one part of CIPA.
Key Takeaways
- SB 690 takes effect January 1, 2027.
- The law limits some claims under CIPA Section 638.51.
- The change affects certain website and app tracking claims.
- The California Attorney General will handle these claims.
- Some cases filed since January 1, 2025, could be affected.
- More than 4,700 digital privacy lawsuits have been filed since 2022, based on Fisher Phillips data.
- Other CIPA claims will remain available.
- Businesses should still review their tracking practices.
SB 690 and Tracking Suits
California passed CIPA in 1967. Websites did not exist at that time.
Today, lawyers use CIPA to challenge some website tracking practices.
Some lawsuits claim tracking tools act like pen registers or trap-and-trace devices.
These tools can collect information about website visitors. They can also track activity in apps.
Common tracking tools include cookies, pixels, and analytics software.
SB 690 changes the rules for some of these claims.
Private plaintiffs will no longer be able to bring certain Section 638.51 claims involving websites and apps.
Instead, the California Attorney General will handle these claims.
As a result, businesses could face fewer private lawsuits under this section.
Thousands of Lawsuits at Risk
The new law could affect thousands of cases.
More than 4,700 digital privacy lawsuits have been filed since 2022, based on an estimate from Fisher Phillips partner Usama Kahf.
About two-thirds of those cases reportedly included a CIPA pen-register claim.
The total number may be higher. Demand letters and arbitration claims could add to the broader litigation activity.
The lawsuits have involved many industries.
Retailers, media companies, financial firms, and nonprofits have faced claims. Website operators have also faced lawsuits.
Why CIPA Created Legal Risk
CIPA can create major financial risks for businesses.
Some claims can carry damages of up to $5,000 per violation.
As a result, common website tools can lead to costly legal disputes.
Businesses may face claims over tracking technology on their websites.
SB 690 now changes the rules for one major type of claim.
SB 690 Could Affect Pending Cases
The new law does not apply only to future lawsuits.
It can also affect some pending claims.
SB 690 includes a two-year look-back period. That period begins on January 1, 2025.
As a result, some existing Section 638.51 cases could face new legal challenges.
Some cases could also face dismissal.
This change will matter to law firms handling CIPA cases.
Defense lawyers may review their current cases.
Meanwhile, plaintiffs’ lawyers may need to consider other legal claims.
SB 690 Does Not End Privacy Litigation
SB 690 does not remove all private CIPA claims.
Other parts of the law remain in effect.
For example, CIPA Section 631 still covers certain wiretapping claims.
Sections 632 and 632.7 also remain part of California privacy law.
Therefore, SB 690 does not end privacy lawsuits in California.
Instead, it removes one path for private claims.
Other Privacy Claims May Continue
Some web-tracking cases may continue under other laws.
Plaintiffs may also use other CIPA provisions when the facts support them.
Federal privacy laws could apply in some cases, too.
Therefore, businesses should review each case carefully.
A company may face less risk under Section 638.51. However, another privacy claim could still apply.
What SB 690 Means for Law Firms
The new law will affect both plaintiffs’ and defense firms.
Defense lawyers will likely review current CIPA cases.
They may also review demand letters and settlement talks.
The goal is to determine how SB 690 affects each case.
Plaintiffs’ lawyers face a different challenge.
They may need to review cases based on the pen-register theory.
Some firms may need to consider other legal claims.
Law firms that represent website operators may also see more demand for privacy reviews.
Businesses Still Face Privacy Risks
SB 690 may reduce one type of lawsuit.
However, businesses should still review their privacy practices.
Companies should know which tracking tools run on their websites and apps.
They should also know what data those tools collect.
They should know where that data goes, too.
Third parties may receive or process some of that data.
Legal teams should review cookies, pixels, and analytics tools.
They should also check advertising technology and session-replay software.
Privacy notices and consent practices need regular review.
SB 690 Does Not Make Tracking Legal
One point is important.
SB 690 does not make all website tracking legal.
The law changes who can bring certain Section 638.51 claims.
It does not give businesses a general right to track website visitors.
It also does not remove other privacy duties.
Therefore, businesses should continue to review their tracking practices.
What Happens to Demand Letters?
Businesses should separate lawsuits from demand letters.
A demand letter is not a filed lawsuit.
The new law includes rules for certain pending claims.
Those rules apply to cases filed during the two-year look-back period.
However, not every demand letter will disappear.
Companies should review the claims in each letter.
A demand based only on Section 638.51 may face a different outcome.
A demand with other CIPA claims may continue.
Therefore, legal counsel should review each matter before responding.
California Privacy Litigation Shifts
SB 690 marks a major change in California web-tracking litigation.
The law limits private enforcement of one CIPA provision.
It also gives the California Attorney General authority over covered claims.
However, privacy litigation will continue.
Other CIPA provisions remain available.
Other state and federal privacy laws may also apply.
For businesses, the law could reduce some litigation risk.
It does not remove all privacy risks.
For law firms, the change creates new questions about pending cases.
Courts will also have a key role in applying the new rules.
FAQs
What is California SB 690?
California SB 690 changes who can bring certain CIPA claims.
The law covers claims involving pen registers and trap-and-trace devices.
For some website and app activity, private plaintiffs will lose the right to bring these claims.
The California Attorney General will handle the covered claims.
When does SB 690 take effect?
SB 690 takes effect on January 1, 2027.
Businesses and law firms can use the time to review their cases.
They can also review their privacy practices.
Will SB 690 end California web-tracking lawsuits?
No.
The law does not end all web-tracking lawsuits.
Instead, it limits private enforcement of certain CIPA Section 638.51 claims.
Other CIPA provisions can still support lawsuits.
Other privacy laws may also apply.
How many lawsuits could SB 690 affect?
More than 4,700 digital privacy lawsuits have been filed since 2022, based on Fisher Phillips data.
About two-thirds reportedly included a CIPA pen-register claim.
The broader number may be higher when demand letters and arbitration claims are included.
Does SB 690 make website tracking legal?
No.
SB 690 does not give businesses a general right to track website visitors.
It changes private enforcement of certain Section 638.51 claims.
Businesses must still follow other privacy laws.
Can businesses still face CIPA lawsuits?
Yes.
Other CIPA provisions remain available for qualifying claims.
For example, Section 631 still covers certain wiretapping claims.
Businesses should review the claims in each case.
What should businesses do before January 2027?
Businesses should review their privacy risks.
They should identify tracking tools used on their websites and apps.
They should also review privacy notices and consent practices.
Legal teams should examine pending CIPA cases.
They should identify the claims made in each case.
Finally, businesses should seek advice from qualified privacy counsel before making major changes.
Bottom Line
California’s new web-tracking rules could reduce some private privacy lawsuits.
However, the change is limited.
SB 690 targets specific claims under CIPA Section 638.51.
It does not remove every CIPA claim.
It also does not end privacy litigation in California.
For defense firms, the law may create new arguments in some cases.
For plaintiffs’ firms, it may require new legal strategies.
Meanwhile, corporate legal teams should continue reviewing website tracking practices.
California web-tracking litigation is changing, but it is not disappearing.
SB 690 closes one path for private claims. Other privacy protections remain in place.
Looking for your next legal opportunity? Explore the latest attorney and legal jobs on
LawCrossing and find positions that match your skills and career goals.
See Also:
Judge Warns AI Could Harm Lawyers and Clients
The post
New California Rules Put Web-Tracking Lawsuits at Risk first appeared on
JDJournal Blog.
