California Governor Signs SB 690, Curtailing CIPA Pen-Register Litigation

by Elaine F. Harwell and Danielle Ocampo Hull

California Governor Signs SB 690, Curtailing CIPA Pen-Register Litigation

Businesses facing California privacy claims over cookies, pixels, analytics tools, and other common website technologies have a new defense against one of the most active theories of CIPA litigation. Governor Gavin Newsom signed SB 690 on September 30, 2026, eliminating private standing for alleged violations of the California Invasion of Privacy Act’s pen-register and trap-and-trace provisions while preserving enforcement authority for the California Attorney General. The legislation also provides for a two-year retroactive application to qualifying pending claims.

SB 690 responds to the recent wave of lawsuits and demands alleging that common website technologies, including cookies, pixels, analytics tools, and similar tracking technologies, constitute unlawful pen registers or trap-and-trace devices under Penal Code section 638.51. For pending litigation and arbitration, defendants facing covered § 638.51 website or app claims should evaluate whether SB 690’s retroactivity provision provides a basis to dispose of those claims.

Importantly, SB 690 does not eliminate CIPA website litigation more broadly. Claims under § 631 remain available, including claims alleging interception of communications through pixels, session replay, chat tools, SDKs, and other third-party technologies. Businesses should therefore continue evaluating their inventory of website technologies, including understanding what data is collected and transmitted, which third parties may receive data, and whether appropriate consent and disclosures are in place.

Businesses facing existing CIPA claims or seeking to reduce the risk of future litigation should work with experienced privacy counsel to assess how SB 690 affects pending matters and review their websites, apps, consent mechanisms, and third-party technologies for continuing CIPA exposure. Procopio’s Privacy and Cybersecurity attorneys advise businesses on CIPA compliance, website privacy risks, and the defense of privacy-related claims and litigation. Feel free to reach out for more guidance.

About the Authors

Elaine F. Harwell

Partner and Privacy Officer

Elaine focuses on representing clients in privacy and data security matters, including litigating claims involving privacy issues, helping clients manage emerging risks and conduct privacy risk assessments, and advising on regulatory and compliance issues. She has been involved in numerous trials, as well as arbitration proceedings, related to contract and general business disputes, trade secret matters, complex unfair competition and business practice claims, and professional liability. Elaine has earned the ANSI-accredited Certified Information Privacy Professional/United States (CIPP/US) and the Certified Information Privacy Manager (CIPM) credentials through the International Association of Privacy Professionals (IAPP), and is the leader of Procopio’s Privacy and Cybersecurity practice and the firm’s Privacy Officer.

Danielle Ocampo Hull

Associate

Danielle offers a full suite of data privacy and cybersecurity representation. She advises and counsels clients for legal and operational guidance on privacy and AI compliance with international, federal and state regulations such as CCPA, CPRA, E.U. and U.K. GDPR, CAN-SPAM, COPPA, CalECPA, CDA, and FERPA, as well as industry-specific regulations including HIPAA and FCRA. Danielle regularly leads incident response matters for businesses nationwide. Moreover, Danielle defends clients against a range of data-related matters, including data breach class actions and CIPA and VPPA litigation, and advises clients on litigation risks. Danielle is a Certified Information Privacy Professional (CIPP/US) and Certified Information Privacy Manager (CIPM) with the International Association of Privacy Professionals (IAPP).