California Moves to Curtail Vexatious CIPA Litigation
If your organization operates a website accessible in California, you are likely familiar with the wave of lawsuits and demand letters alleging violations of the California Invasion of Privacy Act (CIPA). These claims target businesses that use common third-party tracking technologies, including website pixels and cookies, and manipulate a statute intended to address governmental intrusions into privacy to attack commonplace business practices in the digital age. Given the wave of lawsuits and demand letters over the last few years, California’s Senate Bill 690 (SB 690), effective January 1, 2027, significantly changes how certain CIPA claims may be pursued. The intent of SB 690 is to curtail harassing and vexatious litigation tactics while providing recourse for significant and meaningful intrusions into privacy in the digital age. This alert provides an overview of the issues and what the new law may mean for your organization.
CIPA and Website Tracking Litigation
CIPA broadly prohibits recording or intercepting private communications without the consent of all parties involved.1 In recent years, plaintiffs have filed thousands of lawsuits and demand letters against businesses that operate websites accessible in California, alleging that third-party tracking technologies collected and transmitted user data without consent. What data is allegedly captured is often disputed, including its content. Under the current CIPA framework, businesses argue that many “plaintiffs” are hired testers who seek out and test websites rather than individuals who suffered actual damages or harm, while also disputing the veracity of data acquired from the website visitor. Plaintiffs argue that their “data” or “information” is being obtained without appropriate consent and used improperly.
These claims typically rely on an expansive interpretation of CIPA provisions enacted decades ago, including those governing “pen registers” and “trap and trace devices” that predate the internet.2 The legislative history of CIPA demonstrates these terms were intended to address telephone communications rather than internet activity—i.e., devices susceptible to traditional wiretapping.3 For years, courts have grappled with how to apply CIPA to internet-based claims. The issues finally came to a head and prompted the California Legislature to act by implementing SB 690.
What SB 690 Does
The fix is straightforward: SB 690 amends CIPA Section 637.2 to provide that only the California Attorney General—not private plaintiffs—may bring an action for violations arising from conduct on a website, online application, or mobile application.4 While the amendment spans only a few lines, it effectively closes the door on private Section 637.2 claims based on website tracking.5
Also impactful is that SB 690 includes a retroactivity provision.6 The amendment applies to any pending claim in an action commenced within two years before the bill’s operative date, meaning it will limit—and potentially foreclose—many lawsuits already in progress.7
The Catch: Limitations of SB 690
Unlike its predecessors considered in prior legislative sessions, SB 690 potentially addresses only claims brought under Section 637.2. The scope of SB 690 will surely be tested by litigants on both sides.8 It remains to be determined how SB 690 will impact claims brought under other CIPA provisions, including Sections 631 and 632.9 This means that SB 690 potentially leaves open “pen register” and “trap and trace” claims that are reconstructed under different statutory theories, while the underlying website tracking allegations remain the same. In other words, plaintiffs may attempt to replead the same website tracking allegations that SB 690 is supposed to eliminate or curtail under different sections of CIPA.
That said, SB 690 is expected to significantly reduce private CIPA litigation related to website tracking and removes one area of legal uncertainty. Courts will continue to address the remaining issues, as SB 690 will likely spur new forms of litigation.
California’s Governor Recognizes Additional Reform is Needed
In a letter accompanying his signature on SB 690, Governor Gavin Newsom noted that he endorsed the bill’s efforts to address the vexatious use of CIPA lawsuits and demand letters to extract settlements from small businesses.10 But consistent with the limitations described above, Newsom cautioned that “additional work in this area is needed” because other decades-old CIPA statutes remain susceptible to abuse by overly aggressive litigants.11 Newsom urged the Legislature to take up further reforms in 2027 “to ensure a fair balance between protecting private information and preventing rapacious litigation.”12
Recommendations for Businesses
Even with SB 690’s passage, businesses should continue to review their data privacy practices to best defend against privacy- and data-related litigation. Key steps include auditing website tracking technologies and confirming that third-party vendors comply with applicable privacy requirements. The Quarles & Brady data privacy team is available to assist with all your data and internet privacy needs.
END NOTES
1 See Cal. Penal Code §§ 630 et seq.
2 See Cal. Penal Code §§ 638.50, 638.51.
3 See, e.g., Licea v. Hickory Farms LLC, 2024 WL 1698147, at *3 (Cal. Super.); Sanchez v. Cars.com Inc., 2025 WL 487194, at *3 (Cal. Super.).
4 S.B. 690, 2025-2026 Leg., Reg. Sess. (Cal. 2026).
5See id.
6 Id.
7 Id.
8 Id.
9 See id.
10 Gavin Newsom, Governor of Cal., Letter to Members of the California State Senate Regarding S.B. 690 (Sept. 30, 2026).
11 Id.
12 Id.