California SB 690 was narrowed to limit private enforcement of certain pen-register claims involving websites and apps. Claims under CIPA Sections 631 and 632 remain distinct.
California Senate Bill 690 (SB 690) began as a proposal for broad changes to the California Invasion of Privacy Act (CIPA). Its original language contemplated exemptions for certain commercial uses of website technologies, including cookies, tracking pixels, chat tools, and session-replay software.But the bill’s July 2, 2026 amendment substantially narrowed that approach. As described in CIPAWorld’s July 3 report, the revised proposal focused on limiting private enforcement of California’s pen-register and trap-and-trace provisions, rather than broadly exempting commercial website tracking from CIPA.
The distinction matters for businesses evaluating privacy litigation risk: a limit on who may bring one type of claim is not the same as a general exemption from the statute.
The original version of SB 690 proposed a broader set of amendments to California law. Among other things, it would have:
These proposals were significant because website privacy lawsuits have increasingly challenged the use of technologies such as Meta Pixel, Google Analytics, session-replay tools, and live-chat features.
Supporters argued that the proposal would better align CIPA with the CCPA’s regulation of personal-information practices. Opponents, including privacy advocates and plaintiffs’ attorneys, argued that the exemptions would weaken existing privacy protections.
Those arguments were part of the debate surrounding the bill; they are not findings by a court.
According to CIPAWorld’s report, the July 2 amendment removed nearly all of the original bill’s broad substantive changes.
Instead, the revised proposal focused on California Penal Code Section 637.2, which addresses civil actions for violations of CIPA. The amendment proposed that only the California Attorney General could bring an action against a private actor for an alleged violation of Section 638.51 arising from conduct on an internet website, online application, or mobile application.
In practical terms, the proposal would shift enforcement of that specific category of website-related claims away from private plaintiffs and to the Attorney General.
It would not declare the underlying conduct lawful, provide businesses with blanket immunity, or eliminate every possible CIPA claim involving online tracking.
The July 2 version removed the proposed “commercial business purpose” exemptions and the associated definition. It also removed the proposed exclusion of website technologies from the statutory definitions of pen registers and trap-and-trace devices.
The amendment likewise did not retain the original proposal’s broad exemption for processing personal information or its wider limitation on CIPA’s private right of action.
As a result, the amended proposal did not provide a general defense to claims brought under CIPA Sections 631 or 632. Those claims remained separate from the specific Section 638.51 enforcement issue addressed by the revised bill.
The original proposal included broad retroactivity language. The July 2 amendment again included retroactive language, but in a more limited form.
As reported by CIPAWorld, the proposed restriction on private enforcement would apply retroactively to pending Section 638.51 claims filed within the two years before the bill’s operative date.
That provision would concern the specified pen-register claims. It should not be read as a retroactive dismissal of all pending CIPA website-tracking lawsuits.
If enacted in the form described in the July 3 report, SB 690 could affect who is permitted to pursue certain website-related claims under Section 638.51. It would not remove the need for businesses to evaluate their website technologies, data practices, disclosures, and compliance obligations.
Businesses should distinguish among:
The legal analysis may depend on the statutory provision asserted, the technology involved, the information allegedly collected, and the procedural status of the case.
CIPAWorld’s July 3 article described SB 690 as still moving through the California Legislature and noted that further amendments remained possible. A separate CIPAWorld post published August 30, 2026, subsequently reported that the bill had passed both chambers and was headed to the Governor’s desk.
That later report is a separate legislative update. The July 2 amendment article should be read as an account of the bill at that stage, not as a complete statement of its final or current legal status.
Before relying on SB 690 in a particular matter, readers should check the bill’s official legislative status and the enacted text, if any, rather than relying solely on a commentary article.
The original proposal sought broad changes to CIPA, including exemptions for certain commercial uses of website technologies and data processing.
According to CIPAWorld, the amendment removed most of the broad exemptions and focused on limiting private enforcement of certain Section 638.51 claims involving websites and applications.
Not generally. The reported amendment concerned who could bring a specific category of claim. It did not provide blanket immunity for website tracking or establish that the underlying conduct was lawful.
No. The July 2 version focused on Section 638.51. Claims under other provisions, including Sections 631 and 632, were not broadly eliminated by that amendment.
Yes. CIPAWorld reported that the amended proposal included a narrower retroactivity provision for pending Section 638.51 claims filed within two years before the operative date.
CIPAWorld’s July 3 article described it as still moving through the Legislature. A later CIPAWorld report dated August 30, 2026, said the bill had passed both legislative chambers and was awaiting the Governor’s action.
This article is for informational purposes only and is not legal advice. It summarizes legislative developments as reported by CIPAWorld. A bill’s language and status may change during the legislative process. Readers should consult the official legislative record and qualified legal counsel before relying on the bill in a specific matter.
Receive offers, product allerts, styling inspiration and more.
Learn what DNC.com does, how its TCPA and Do Not Call compliance tools work, Litigator Insights, reassigned-number screening, integrations, and its 2026 transition to Sonera.
Lawyer.com connects consumers with attorneys while operating a legal lead-generation and marketing platform. Explore its TCPA consent practices, automated calls, mass tort leads, compliance claims, and lawsuit history.
Cox Media Group has faced significant legal scrutiny, including an FTC Active Listening enforcement action and a Texas TCPA case involving defamation and free speech.
Explore Cox Media Group (CMG), its history, ownership, television and radio operations, digital advertising business, consumer data practices, privacy policy, Active Listening controversy, leadership and 2026 developments.
Explore MindSift’s data marketing platform, the Active Listening controversy, FTC allegations, 2026 consent order, consumer consent issues and legal implications.
Learn about MindSift, its audience intelligence and data platform, consumer and B2B databases, Visitor ID, Buyer Intent, OutReach Mining, advertising services, Active Listening controversy and 2026 FTC order.
