Full-Service Law Firm solving complex challenges through bold thinking, precise execution, and shared purpose.

Full Service Law Firm | Michael Best & Friedrich LLP

Specializing in the Intersection of Business &amp; Government

Meet our team of trusted advisors, strategic thinkers, and community builders dedicated to client success.

Learn about our full-service legal and business solutions, designed to address complex challenges for leading organizations across industries.

Access thought leadership, news, and resources to stay informed about the latest trends, legal developments, and industry innovations.

Discover how partnership, bold thinking, and precise execution drive results for clients nationwide.

Explore how our national reach and local expertise support clients across the United States and beyond.

Grow at a firm designed to bring out your best.

The California Legislature has passed Senate Bill 690, which restricts private lawsuits alleging that common website and application tracking technologies violate the pen-register and trap-and-trace provisions of the California Invasion of Privacy Act (“CIPA”). In recent years, these provisions have given rise to one of the most actively litigated legal theories in the data privacy arena. While the bill removes the private right of action for such claims, it does not amend other CIPA, state-law, or federal claims involving website tracking technologies.

core/paragraph

core/heading

California Penal Code Section 638.51 generally prohibits the installation or use of a pen register or trap-and-trace device without a court order, subject to limited statutory exceptions. Historically, these provisions were associated with telephone surveillance and the collection of dialing, routing, addressing, or signaling information.

In recent years, plaintiffs have increasingly argued that common website technologies, including cookies, pixels, analytics tools, and similar scripts, qualify as pen registers or trap-and-trace devices because they collect IP addresses, URLs, device identifiers, and other metadata. CIPA’s civil-remedies provision, found in California Penal Code Section 637.2, allows a private plaintiff to pursue injunctive relief and statutory damages of $5,000 per violation without proving actual damages. These statutory damages, coupled with plaintiffs’ novel website tracking legal theories, have driven a substantial volume of demand letters and lawsuits against website owners.

What SB 690 Changes, and What it Doesn’t

SB 690 amends CIPA’s civil-remedies provision to effectively eliminate the private right of action for pen-register or trap-and-trace claims arising from conduct occurring on an internet website, online application, or mobile application. Moving forward, only the California Attorney General can bring such claims against private actors.

Importantly, SB 690 does not eliminate CIPA liability arising from website tracking. Rather, it provides that only the California Attorney General may bring website- and application-based pen-register and trap-and-trace claims against private actors. SB 690 also does not amend CIPA’s wiretapping provision, California Penal Code Section 631, which plaintiffs have separately invoked against advertising pixels, session-replay software, chat tools, and other third-party website technologies.

SB 690 has cleared both houses of the California Legislature, and awaits action by Governor Newsom. It is expected to take effect January 1, 2027. Still, private litigation involving website-tracking technologies is likely to continue under CIPA’s wiretapping provisions, other federal and state privacy laws, and common-law privacy theories. The California Attorney General will also retain authority under CIPA to bring pen-register and trap-and-trace claims involving websites and applications. Accordingly, SB 690 should not be interpreted as reducing the need to review website tracking and consent practices.

This alert is for informational purposes only and does not constitute legal advice. For more information, please reach out to a member of our team.

Digital padlock icon at the center of a glowing circular network pattern in blue and purple tones.

Abstract purple and blue digital background with curved dotted lines and glowing light particles.

California Legislature Passes Bill Limiting CIPA Website-Tracking Lawsuits

Related People

Related Capabilities

You may also be interested in these

Wisconsin Circuit Court Reverses Shorewood Beach Access Trespass Conviction, Potentially Expanding Public Access Rights Along Lake Michigan

Does Your Church Need a Bag Policy? What Size, What Standard, and Why It Matters Now?

Emergency Declaration Targets Foreign-Produced Bulk Power Grid Equipment: Executive Order 14420