SB 690 CIPA Law Signed: Private Pen Register Suits Over Websites End, Retroactive to 2025 Filings

SB 690 CIPA reform is now law: Governor Gavin Newsom signed Senate Bill 690 on Wednesday, September 30, 2026, ending private lawsuits under the California Invasion of Privacy Act's pen register and trap-and-trace provision, Penal Code section 638.51, where the alleged conduct happened on a website, online application or mobile app. From January 1, 2027, only the California Attorney General can bring those claims, and the change reaches back to pending claims in actions filed on or after January 1, 2025, while CIPA's section 631 wiretapping and section 632 recording claims stay fully available to private plaintiffs.

The signature closes the theory that drove the largest single share of California web-tracking litigation since 2023: the argument that cookies, pixels, analytics scripts and software development kits are "pen registers" that need a court order. Each claim carried statutory damages of $5,000 per violation, and the same theory fed thousands of pre-suit demand letters and individual arbitration demands. The new law removes one count from that playbook. It does not remove the playbook. Wiretapping claims under section 631, which the plaintiffs' bar has pursued for longer, are untouched, and the statute's retroactivity clause is written for "actions," a word that does not obviously cover a pending arbitration.

This piece sets out what SB 690 changes, the exact retroactivity window, how it got narrowed from a far broader bill, what Newsom said, and the question most commentary has skipped: what happens to the pen register claims sitting in arbitration dockets and mass-arbitration campaigns.

What does SB 690 do to CIPA lawsuits?

SB 690 strips private plaintiffs of standing to sue under section 638.51 for website and app conduct and makes the Attorney General the only party who can bring that claim. It does so through a single new subdivision. As quoted in multiple post-signing analyses, new Penal Code section 637.2(d) reads: "An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General."

Section 637.2 is CIPA's civil remedy provision. Subdivision (a) lets "any person who has been injured" by a violation of the chapter sue for the greater of $5,000 per violation or three times actual damages. Section 638.51 makes it unlawful to install or use a pen register or trap-and-trace device without a court order. Read together, the two provisions produced the claim: a website visitor alleges that a third-party script captured addressing or routing information, no court order existed, and each visit is a violation worth $5,000.

SB 690 does not repeal section 638.51 or change its definitions. Installing a pen register without a court order is still unlawful, and the statute still applies to telephone and other non-website conduct. What changes is who may sue and in what setting:

Element	Before SB 690	After SB 690 (operative January 1, 2027)
Section 638.51 claim over website, online app or mobile app conduct	Any injured person may sue under § 637.2(a)	Attorney General only (§ 637.2(d))
Section 638.51 claim over non-web conduct (e.g., telephone)	Private suit available	Unchanged; private suit available
Section 631 wiretapping (pixels, session replay, chat, SDKs)	Private suit available	Unchanged
Section 632 recording of confidential communications	Private suit available	Unchanged
Statutory damages under § 637.2(a)	$5,000 per violation or treble actual damages	Unchanged for surviving claims
Pending § 638.51 web claims in actions commenced on or after January 1, 2025	Proceeding	Subject to the retroactivity clause
Settled or dismissed § 638.51 cases	Closed	Stay closed

The carve-out is limited to a "private actor" defendant. The statute does not alter the rules for public entities, and it does not create any new defense to claims under other sections.

When does SB 690 take effect, and is it retroactive?

SB 690 takes effect January 1, 2027, the default operative date for a regular-session California bill without an urgency clause. It is expressly retroactive: the amendments apply to any pending claim in an action commenced within two years before the operative date, which captures actions filed on or after January 1, 2025.

That window matters because the pen register wave peaked inside it. PPC Land counts roughly 4,000 section 638.51 claims since February 2025, and nearly all of them fall within the reach-back period. Cases filed in 2023 and 2024, when the theory first spread after the Southern District of California's 2023 ruling in Greenley v. Kochava, Inc., sit outside the two-year window and are not affected by the retroactivity clause, although defendants in those cases will still argue the general California rules on repealed statutory remedies.

Date	Event
July 27, 2023	Greenley v. Kochava, Inc. (S.D. Cal.) lets a section 638.51 claim against a data broker's SDK proceed, opening the website pen register theory
February 21, 2025	Senator Anna Caballero introduces SB 690 with a broad "commercial business purpose" exemption
June 3, 2025	Original SB 690 passes the Senate unanimously, then stalls as a two-year bill
January 1, 2025	Start of SB 690's retroactivity window (two years before the operative date)
July 1, 2026	Assembly amendments replace the broad exemption with the narrow § 638.51 carve-out
August 21, 2026	Court of Appeal issues tentative ruling in Variety Media, LLC v. Superior Court (No. B350578)
August 28, 2026	Assembly passes SB 690 66-0; Senate concurs 40-0
September 30, 2026	Newsom signs SB 690 on the last day to act on bills
January 1, 2027	SB 690 becomes operative; private § 638.51 web and app claims end

Will the retroactivity clause survive a challenge?

According to Fisher Phillips, plaintiffs' firms have said they will likely challenge applying SB 690 to cases already underway. California precedent leans against them. In Governing Board v. Mann (1977) 18 Cal.3d 819, the California Supreme Court restated the long-standing rule that repealing a purely statutory right of action without a saving clause terminates pending actions on that right if final relief has not been granted, even if a judgment is on appeal. In Californians for Disability Rights v. Mervyn's, LLC (2006) 39 Cal.4th 223, the court applied Proposition 64's new standing limits under the Unfair Competition Law to cases pending when voters approved them.

CIPA's private remedy is entirely a creature of statute, and SB 690 goes further than either precedent by stating its retroactive reach expressly. The likeliest arguments against it are vested-rights and due process theories for cases that reached judgment or a binding settlement before January 1, 2027, and the text's own carve-back for settled and dismissed cases removes most of that tension. Mervyn's also points to a practical consequence: the Supreme Court allowed plaintiffs there to amend to cure standing, and pen register plaintiffs can be expected to amend toward section 631 rather than accept dismissal.

What is a pen register under CIPA, and why were websites sued?

Under Penal Code section 638.50(b), a pen register is "a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication." A trap-and-trace device is the inbound counterpart: it captures information identifying the source of a communication. Both definitions were added to CIPA by AB 929, chaptered in August 2015 and effective January 1, 2016, with phone surveillance in mind.

Plaintiffs' firms argued that the words "device or process" are broad enough to cover software. On that reading, a tracking pixel or analytics script that sends a visitor's IP address, device details or browser data to a third party is a "process" that records addressing information, and the website operator who installed it needed a court order. Greenley v. Kochava accepted that a software development kit could qualify, and later federal and state trial courts split on whether ordinary website tools did.

The economics explain the scale. A single visit could be pleaded as a violation worth $5,000, so even an individual claim carried a meaningful number, and a putative class action carried an enormous one. That produced a business model built on volume: demand letters to hundreds of businesses running common tools such as Google Analytics, Hotjar or the Meta pixel, followed by suits or arbitration demands against those that declined to pay. Defense-side trackers, including Klein Moynihan Turco, identify Pacific Trial Attorneys and Swigart Law Group as firms that regularly serve CIPA arbitration demands, and Tauler Smith LLP has been reported to have sent pen register demand letters over those tools. The eComm Alliance, a merchant trade group that backed the bill, says pen register claims made up roughly two-thirds of active privacy litigation.

How did SB 690 get narrowed before passage?

SB 690 began as a much broader shield. Senator Anna Caballero (D-Merced) introduced it on February 21, 2025, with an exemption from CIPA for any disclosure of communications information to a third party for a "commercial business purpose," borrowing the definition from the California Consumer Privacy Act. That version would have reached most website tracking claims, including many section 631 wiretap theories. It passed the Senate unanimously on June 3, 2025, then stalled in the Assembly and carried over as a two-year bill.

On July 1, 2026, after what CIPAworld described as an intense lobbying effort, the Assembly Committee on Privacy and Consumer Protection took up an amended version that dropped the commercial business purpose exemption entirely. In its place came the narrow rule now enacted: one statutory section, one category of conduct, and a change in who may enforce. The narrowed bill leaves substantive privacy law intact and changes only the private remedy for one theory.

The trade-off bought consensus. The Assembly passed the amended bill 66-0 on August 28, 2026, and the Senate concurred in the Assembly amendments 40-0 the same day. Kilpatrick Townsend's post-signing alert called it meaningful relief but "not the sweeping CIPA reform businesses once hoped for," which is an accurate measure of what the July amendments gave up.

What did Governor Newsom say when he signed SB 690?

In his signing message, Newsom said SB 690 "addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses that unwittingly install software on their websites." He added that he aligned himself "with the goal of protecting small businesses from overzealous lawsuits based on a statute written without today's complex technological landscape in mind."

Two points in that message matter for later litigation. First, Newsom named demand letters alongside lawsuits, which supports reading the bill's purpose as reaching the pre-filing and arbitration stages of the business model, not just court dockets. Second, the "statute written without today's complex technological landscape in mind" framing is a policy statement, not a holding: the Legislature did not amend the definition of pen register, so courts will still decide whether website tools meet it when the Attorney General sues, and when claims involve non-web conduct.

Bloomberg Law reported that Newsom signed the bill on Wednesday, the final day he had to act on legislation passed in the 2026 session. The same day he signed SB 574, the first state statute regulating generative AI use by lawyers and arbitrators.

Does SB 690 apply to CIPA arbitration demands and mass arbitration?

Probably yes for new claims, and unclear for pending ones. From January 1, 2027, a private claimant has no right to assert a section 638.51 website claim in any forum, because an arbitrator applies the substantive law and the statute now allows only the Attorney General to bring it. For arbitration demands already pending, SB 690's retroactivity clause speaks of claims in an "action" that was "commenced," and California's Code of Civil Procedure section 22 defines an action as "an ordinary proceeding in a court of justice."

That wording creates an argument none of the leading law-firm alerts has addressed. A claimant with a pen register demand filed with the AAA or JAMS in 2025 or 2026 can contend that an arbitration is not an "action," so the retroactivity clause does not reach it, and that the arbitrator should apply the law in force when the claim arose. A respondent has three replies. Section 637.2(d) itself is phrased as a limit on who may bring the claim at all, so after January 1, 2027 no private person holds a section 638.51 web claim to arbitrate. Under the Mann line of cases, repeal of a statutory remedy without a saving clause ends pending proceedings regardless of the express retroactivity text. And most consumer arbitration agreements require the arbitrator to apply the same substantive law a court would, which includes California's rules on repealed remedies.

Post-passage alerts advise defendants in pending litigation and arbitration to evaluate whether the retroactivity provision supports dismissal. In arbitration, that means a dispositive motion under the provider's rules once the operative date passes, or earlier where the rules let an arbitrator decide a legal issue in advance of a hearing.

What changes in a mass arbitration campaign?

For a business facing hundreds of identical CIPA demands, the fee structure is where SB 690 bites first. Mass filing fees under the AAA and JAMS mass-arbitration rules are charged per case, and the respondent usually pays most of them. A demand that pleads only section 638.51 loses its value on January 1, 2027, which changes the calculus for respondents deciding whether to pay initiation fees now or contest them. A demand that pleads both section 638.51 and section 631 keeps its section 631 count, so the fee exposure remains.

Two practical consequences follow. Claimants' counsel have a reason to file, amend or settle pen register demands before January 1, 2027, and respondents have a reason to slow the process until then, including through pre-arbitration notice and informal resolution periods in their arbitration agreements. Expect disputes over the timing of fee invoices and administrative deadlines in the last quarter of 2026, and expect arbitrators to be asked to decide the "action" question as a threshold legal issue.

What SB 690 CIPA reform leaves standing: Section 631, Section 632 and Variety Media

SB 690 CIPA reform targets one statutory theory. It leaves section 631, CIPA's wiretapping provision, completely untouched. Section 631 reaches anyone who reads or learns the contents of a communication in transit without consent, or who aids someone else in doing so, and plaintiffs use it against session replay software, chat widgets, pixels that capture form entries or search terms, and SDKs. Procopio notes that section 631 claims remain available across all of those tools, and Fisher Phillips says section 631 is behind the bulk of current CIPA activity, including many demands by serial plaintiffs.

Section 632, which bars recording confidential communications without consent, also survives, as do every non-CIPA theory: the federal Wiretap Act, the Video Privacy Protection Act, common-law intrusion on seclusion, and the California Constitution's privacy clause. Morgan Lewis's alert makes the same point: website wiretapping litigation continues.

Can plaintiffs still sue under CIPA Section 631 after SB 690?

Yes. Section 631 claims, with the same $5,000 statutory damages under section 637.2(a), are unaffected, and pen register plaintiffs are likely to replead under section 631 where their facts allow it. The difference is the element of content: section 631 requires interception of the contents of a communication, while pen register claims rested on non-content addressing data. That makes section 631 claims harder to plead against basic analytics tools that transmit only IP addresses and device data.

Where Variety Media fits

The California Court of Appeal's tentative ruling in Variety Media, LLC v. Superior Court (No. B350578), issued August 21, 2026 by the Second Appellate District, Division Three, will still shape what remains. As reported by Seyfarth and Jones Day, the tentative concluded that CIPA's pen register definition is not limited to telephones and can reach internet communications, but that capturing a website visitor's IP address alone does not state a claim, because a pen register records the destination of an outgoing communication, while the IP address of a site's visitor identifies its source. The tentative would direct the trial court to sustain Variety's demurrer with leave to amend.

Reports through September described the ruling as tentative after oral argument on August 25. Once final, it governs the Attorney General's enforcement of section 638.51, website claims commenced before January 1, 2025, and every non-web pen register claim. Its reasoning about source and destination data will also be cited in section 631 disputes over what counts as the contents of a communication.

What it means for claimants' counsel, defendants and arbitration drafters

Claimants' counsel. Pen register claims filed since January 1, 2025 need a plan before January 1, 2027: settle, amend to plead section 631 where the facts support interception of contents, or brief the retroactivity challenge. Demand letters relying only on section 638.51 lose leverage now, because recipients know the claim expires in three months. Firms running intake for mass arbitration should re-screen inventories for section 631 facts; claims with no content-capture allegation have little value after the operative date.

Defendants and in-house counsel. Kilpatrick Townsend recommends filing a notice of supplemental authority in pending cases that alerts the court to SB 690, then evaluating dismissal or a stay given the case's posture. Where the operative date is near, a stay until January 1, 2027 may cost less than litigating a motion that becomes moot. Settlement valuations of pending pen register matters should fall sharply. None of this reduces section 631 exposure, so tag audits, consent banners and vendor contracts remain the primary risk controls.

Arbitration providers. The AAA and JAMS will see requests to stay or pause batches of CIPA demands until the operative date and motions to dismiss soon after it. Providers whose mass-arbitration procedures appoint a process arbitrator to decide common issues have an efficient path: one ruling on whether SB 690 reaches pending arbitrations, applied across the batch.

Drafters of arbitration clauses. SB 690 is a reminder that a clause requiring individual arbitration under California law imports statutory changes into the arbitral forum. Clauses that require the arbitrator to apply the same substantive law, remedies and limitations a court would apply put the respondent in the strongest position to invoke SB 690 against pending demands. Clauses with fee-shifting or pre-filing notice provisions affect how many CIPA demands reach the fee stage before January 1, 2027.

The Attorney General. Enforcement now sits with a single office with finite resources and many competing priorities. Whether the Attorney General brings any section 638.51 web cases, and against whom, will decide whether the statute keeps any practical effect for ordinary website tools.

SB 690 CIPA: frequently asked questions

What does SB 690 do?

SB 690 adds Penal Code section 637.2(d), which allows only the California Attorney General to sue a private actor for a section 638.51 pen register or trap-and-trace violation arising from conduct on a website, online application or mobile app. Private plaintiffs lose that claim; all other CIPA claims remain.

When does SB 690 take effect?

SB 690 takes effect on January 1, 2027. Newsom signed it on September 30, 2026.

Is SB 690 retroactive to pending CIPA cases?

Yes, in part. It applies to pending claims in actions commenced within two years before January 1, 2027, which means private section 638.51 web and app suits filed on or after January 1, 2025. Settled and dismissed cases stay closed, and suits filed before 2025 fall outside the express retroactivity window.

Who can enforce CIPA pen register claims now?

For conduct on websites, online applications and mobile apps, only the California Attorney General can bring a section 638.51 claim against a private actor from January 1, 2027. Private plaintiffs can still bring section 638.51 claims over non-web conduct.

Does SB 690 end CIPA website lawsuits?

No. SB 690 ends one theory. CIPA section 631 wiretapping and section 632 recording claims, with $5,000 statutory damages per violation, remain available to private plaintiffs, along with federal and common-law privacy claims.

Does SB 690 apply to pending CIPA arbitration demands?

It is unsettled. After January 1, 2027, no private claimant holds a section 638.51 website claim in any forum. For demands already pending, the retroactivity clause refers to "actions," which California law defines as court proceedings, so respondents will rely on the text of section 637.2(d) and the rule on repealed statutory remedies, and claimants will argue that arbitrations fall outside the clause.