On September 30, Governor Gavin Newsom signed SB 690, a significant new law aimed at curbing the wave of lawsuits and demand letters asserting “pen register” claims under the California Invasion of Privacy Act (“CIPA”).  The legislation eliminates the private right of action for pen register and trap-and-trace claims arising from conduct occurring on internet websites, online applications, or mobile applications, leaving enforcement authority exclusively with the California Attorney General.  The law goes into effect on January 1, 2027.

In signing the bill into law, Governor Newsom not only approved a substantial limitation on CIPA litigation but also issued a call to action for “additional work” on broader CIPA reform.  In an accompanying signing message, the Governor praised SB 690 as a measure addressing “the vexatious use of CIPA lawsuits and demand letters to extract settlement money” from businesses. At the same time, he emphasized that SB 690 addresses only one category of CIPA claims and urged the Legislature to revisit other CIPA provisions next year that remain “susceptible to abuse by overly aggressive litigants,” while calling for a “fair balance between protecting private information and preventing rapacious litigation.”   

As our previous coverage on SB 690 notes, the law makes the following key changes to existing state law:

• Eliminates private lawsuits for website-based pen register claims. Claims arising from conduct “occurring on an internet website, online application, or mobile application” could be brought “only by the Attorney General.”
• Applies to certain pending claims. The bill would apply retroactively to “any pending claim” in an action commenced on or after January 1, 2025, potentially affecting many pending lawsuits.
• Preserves Attorney General enforcement. The bill would keep enforcement authority with the Attorney General.
• Leaves other CIPA claims intact. The bill would not alter private rights of action under CIPA’s wiretapping provision (Section 631) or confidential recording provision (Section 632).

Looking Ahead

SB 690 represents one of the most significant legislative responses to the recent wave of website-based CIPA litigation.  While the law is likely to reshape the landscape for website-based pen register claims, Governor Newsom’s signing message suggests that broader CIPA reform efforts may follow next year.