What SB 690 Does
On September 30, 2026, California's Governor, Gavin Newsom, signed SB 690 into law. To Penal Code section 637.2, the section that lets people sue under CIPA, SB 690 added a new rule under which claims that a private actor violated section 638.51, the pen register and trap and trace provision, through conduct on a website, online application, or mobile application can be brought only by the Attorney General.
Pen registers and trap and trace devices are tools from phone surveillance. Section 638.51 bars installing or using either without a court order, with limited exceptions. Since 2023, plaintiffs have argued that cookies, pixels, and similar tools that capture a visitor's IP address and device data are pen registers. Courts are split on that argument, and many companies have settled instead of pursuing further litigation.
When SB 690 Applies
On January 1, 2027, the shift from private plaintiffs to the Attorney General will become operative and will apply retroactively to any pending claim in actions filed within two years before that date, that is, since January 1, 2025.
In his signing message, Newsom said he supports shielding small businesses from lawsuits under what he called an outdated statute, and he asked the Legislature to address CIPA's other provisions in 2027.
A closer look at the text: SB 690 (Chapter 976) adds subdivision (d) to Penal Code section 637.2. Subdivision (d)(1) reserves section 638.51 claims over website and app conduct to the Attorney General. Subdivision (d)(2) applies the amendment retroactively to "any pending claim in an action commenced within two years before the operative date of that legislation." The default rule in Article IV, section 8(c) of the California Constitution applies because the bill has no urgency clause. For a bill enacted on September 30, 2026, that rule makes the operative date January 1, 2027.
Does SB 690 Affect Claims Against You?
Remaining Claims and Open Questions
SB 690 changes only who can bring section 638.51 claims over website and app conduct. It does not affect wiretap claims under section 631, eavesdropping claims under section 632, or computer fraud and intrusion upon seclusion claims. The Attorney General can also still bring section 638.51 claims.
Plaintiffs may turn to other theories, such as wiretap claims under section 631. Those claims are harder to plead because they require the contents of a communication, read while in transit. Our July post explains how section 631 applies to chatbots and analytics.
The reach of the retroactive clause is less certain. A constitutional challenge is likely, and until a court rules, it is unclear which pending cases the clause covers.
In a tentative ruling on August 21, 2026, in Variety Media v. Superior Court, the California Court of Appeal indicated it would hold that CIPA's definition of a pen register covers online as well as telephone communications. The court also indicated that a tracker that collects only a visitor's IP address is not a pen register, because an IP address identifies the source of a communication, not its destination. Under the tentative ruling, the plaintiff could amend the complaint to allege that the trackers capture destination information. Because the plaintiff filed suit in 2025, SB 690's retroactivity clause may reach the case.
If the court issues a published opinion, California trial courts would have to follow its definition of a pen register in the section 638.51 cases that remain. Those include suits by the Attorney General, criminal prosecutions, and private suits SB 690 does not cover, such as suits against public entities or over conduct outside websites and apps. If a court strikes down the retroactive clause, the opinion would also govern private website and app suits filed in 2025 and 2026.
Action Items
- Sort pending claims by theory and date. List every demand letter and complaint with its legal theory and filing date, and flag any that rest only on section 638.51.
- Load non-essential tags only after consent. Section 631 bars reading the contents of a communication without the consent of all parties. A setup where cookies and similar tools fire only after a visitor agrees supports a consent defense to wiretap claims.
- Review tools that capture what visitors type. Chat, search, and session replay tools can collect the contents of communications, which section 631 claims require. Check what each tool records and when consent is collected.
- Watch for developments. SB 690 becomes operative on January 1, 2027, and the Legislature may take up CIPA's other provisions in its 2027 session.
If you also serve visitors in the EU, a consent-first setup will be familiar. National laws implementing Article 5(3) of the ePrivacy Directive require consent before non-essential cookies and similar tools are set or read. The same technical setup can often serve both California and the EU, with a different banner. In the EDPB's 2023 cookie banner taskforce report, a vast majority of participating authorities said a banner with an accept button but no reject option on the same layer is an infringement. Check the banner's design as well as when tags fire.
Whether SB 690 helps in your case depends on the claim, when it was filed, and how your site is set up.
Got a demand letter or complaint citing section 638.51? Get in touch with General Legal to understand how SB 690 specifically affects your business.
Sources
Statute and official sources
- SB 690, enrolled text (August 31, 2026)
- California Governor, legislative update (September 30, 2026)
- Governor's signing message for SB 690
- California Constitution, Article IV, Section 8 (effective dates of statutes)
Variety Media v. Superior Court
EU cookie rules
- EDPB, Report of the work undertaken by the Cookie Banner Taskforce (adopted January 17, 2023)
- CNIL, EDPB adopts final report of outcome of the cookie banner task force (January 18, 2023)
Our earlier post
This post is general information, not legal advice. Reading it does not create an attorney-client relationship.
- SB 690 removes the right of private plaintiffs to bring pen register claims under CIPA when the alleged violation involves websites, online applications, or mobile applications.
- Starting January 1, 2027, only California's Attorney General can prosecute pen register claims related to website and app conduct under Penal Code section 638.51.
- The law applies retroactively to any pending claims in lawsuits filed on or after January 1, 2025, effectively cutting off private litigation already in progress.
- Since 2023, plaintiffs have argued that cookies, pixels, and similar tracking tools constitute illegal pen registers under section 638.51, leading to numerous settlements.
- Governor Newsom cited protection of small businesses from lawsuits under an outdated statute as his rationale for signing the bill.
| Private enforcement eliminated | Only the California Attorney General can bring pen register claims over websites and apps starting January 1, 2027. |
|---|---|
| Retroactive application | The law applies to pending claims in actions filed since January 1, 2025, cutting off litigation already underway. |
| Tracking tools as pen registers | Plaintiffs have claimed cookies and pixels capturing IP addresses and device data are illegal pen registers; courts remain divided. |
| Amendment to CIPA | SB 690 adds subdivision (d) to Penal Code section 637.2, limiting private enforcement of section 638.51 for online conduct. |
| Operative date | Governor Newsom signed the bill September 30, 2026; it takes effect January 1, 2027 under California's standard constitutional rule. |
| Small business protection | Newsom justified the bill as shielding small businesses from lawsuits under an outdated surveillance statute. |
What changes have been caused by SB 690?
Starting January 1, 2027, only the Attorney General can bring section 638.51 pen register and trap and trace claims against private businesses over conduct on websites and apps. SB 690 does not repeal section 638.51; it changes only who can sue.
Does it end a pending lawsuit against us?
It may, if the suit rests on a section 638.51 claim over website or app conduct and was filed on or after January 1, 2025. A challenge to the retroactive clause is likely, and until a court rules, it is unclear which pending cases the clause covers.
How does SB 690 affect demand letters we have received?
A letter that relies only on a section 638.51 website or app theory carries less weight. A suit filed now would fall within the retroactivity window, and after January 1, 2027, a private plaintiff cannot bring that claim. Check whether the letter also relies on another theory.
Which claims are unaffected by SB 690?
Wiretap claims under section 631, eavesdropping and recording claims under section 632, and computer fraud and intrusion upon seclusion claims. Private section 638.51 claims against public entities, or over conduct outside websites and apps, are also unaffected.
Should we change our cookie banner or consent setup?
No. Loading non-essential tags only after consent supports a defense to wiretap claims, which SB 690 does not affect. Review chat, search, and session replay tools in particular.
- Can Your Website's Chatbot or Analytics Get You Sued?Plaintiffs' firms are using a decades-old wiretapping law to target ordinary website tools. Here's what to do about it.
- America.gov Integration: Legal Obligations for ContractorsAmerica.gov, the AI chatbot the White House launched on September 29, 2026, is the visible layer of an executive order requiring agencies to integrate their “covered services” with the platform. A covered service is a public-facing federal service that serves more than 100,000 users in a 12-month period and can be accessed or applied for online. The Office of Management and Budget (OMB) must issue implementing guidance by about December 28, 2026, and Phase 2, which adds applying for, enrolling in and tracking benefits, is planned for early 2027. This post, the second of three, covers the legal obligations that integration work will bring to contractors.