California’s SB 690 Removes Some CIPA Claims, But Privacy and Legal Risks Remain

Given the number of California Invasion of Privacy Act (CIPA) class actions and serial plaintiffs’ demands and lawsuits in play, below is a high-level overview of the impact that SB 690 will have on these lawsuits.

How Does SB 690 Apply to CIPA Claims?

On September 30, 2026, Governor Newsom signed SB 690.

• • Starting January 1, 2027, private plaintiffs, including class action attorneys, may no longer pursue claims against private businesses under CIPA’s “pen register” and “trap-and-trace” provision (Penal Code Section 638.51) for conduct on a website, online application, or mobile application.

• • Only the California Attorney General may bring those claims.

• • While SB 690 takes effect January 1, 2027, it also applies retroactively to any pending claim in a lawsuit filed within the two years before that date, meaning any suits filed on or after January 1, 2025. For a copy of the revised law, see here.

• • CIPA plaintiffs have signaled that they plan to challenge the retroactivity provision on constitutional grounds, so dismissals of pending cases may be contested. The California Legislature added a severability clause with that in mind: if the retroactivity provision is struck down, the rest of the law still stands.

How Does SB 690 Affect CIPA and Other Privacy Demand Letters or Claims?

Other Causes of Action

• • If the demand letter or lawsuit contained other valid causes of action under federal or other state wiretapping laws or other privacy claims, those claims are not impacted by this limited law.

CIPA Section 631 (Wiretapping)

• • Claims that the contents of a communication were intercepted while in transit. Pixel, cookie, session replay, and website chat cases have been brought under this section and are not expressly covered by the amendment.

CIPA Sections 632 and 632.7 (Eavesdropping and Recording)

• • Claims that confidential communications were eavesdropped on or recorded without all parties’ consent (Section 632), or that cellular or cordless phone communications were intercepted and recorded without consent (Section 632.7) are not expressly covered by the amendment.

Recommended Next Steps for Privacy Regulatory Compliance

1. Maintain Your Tracking Technology Compliance Program

• • SB 690 is not a reason to stop your privacy compliance efforts over cookies, pixels, software development kits (SDKs), and similar tools under comprehensive state privacy laws. Wiretapping and eavesdropping claims under California and other state laws, and federal law, and invasion of privacy and other consumer protection claims, and Attorney General enforcement all remain possible.

• • We recommend that you confirm that your privacy disclosures accurately describe your actual personal information processing practices and document that confirmation.

2. Monitor Developments

• • Ensure you are subscribed to Hinshaw’s Privacy, Cyber, & AI Decoded alerts so you stay up-to-date on the CIPA legal proceedings, any challenges to SB 690’s retroactivity provision, and further CIPA reform.