Civil litigation almost always involves providing your sensitive information to the other parties and lawyers in the case. It can be uncomfortable, however, to share things like financial records or your text messages with the same people who are suing you.
On September 30, 2026, Governor Newsom signed Senate Bill 690, which eliminates the private right of action under the California Invasion of Privacy Act (CIPA) for “pen register” and “trap and trace” claims arising from conduct on a website, online application, or mobile application. Enforcement of those claims now rests with the California Attorney General.
In recent years, businesses using common website tools such as analytics, pixels, and chat features have faced a wave of lawsuits and demand letters under this theory. In his signing message, the Governor described the bill as addressing “the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses.”
What it changes: Private plaintiffs can no longer bring these pen register and trap-and-trace claims tied to websites and apps. The law takes effect January 1, 2027, and applies to pending claims in actions filed on or after January 1, 2025.
What it doesn’t change: Other CIPA theories (including wiretapping claims under Section 631), federal statutes, and other state privacy laws remain available to plaintiffs.
What to do now: Businesses with pending or threatened claims should review which theories are being asserted, and website tracking practices still deserve a careful look.
Questions? Contact Partner Jason Kelly, Esq., AIGP, CIPP/US/E at jason@annagueymccann.com.
This post is for informational purposes only and is not legal advice.
