E-commerce businesses received welcome news on September 30, 2026 when Governor Gavin Newsom signed Senate Bill 690, a pro-business measure aimed at curbing the recent epidemic of lawsuits and demand letters brought under the California Invasion of Privacy Act (CIPA). Based on CIPA’s anti-surveillance wording dating back to the 1970s, plaintiffs had been using the statute to target e-commerce websites for using common website tracking technologies.
In recent years, plaintiffs increasingly relied on CIPA’s pen-register provisions to challenge the use of website analytics, advertising pixels, and similar technologies. The resulting claims exposed businesses to potentially significant statutory damages based on routine website practices that bear little resemblance to the telephone surveillance that these provisions were originally enacted to address. Many businesses paid five-figure settlements to avoid the expense and risks of litigation in California courts or arbitration.
The signing into law of SB 690 substantially changes that landscape. The new law will eliminate private lawsuits for alleged violations of CIPA’s pen-register provisions, leaving enforcement principally to the California Attorney General. Importantly, the legislation will apply retroactively and will cover many existing claims. Businesses currently facing lawsuits or demand letters asserting CIPA pen-register claims should therefore reassess those claims in light of the new legislation.
However, the change does not mean the end of CIPA website-tracking litigation. CIPA contains other provisions that plaintiffs have similarly invoked against businesses using website tracking technologies. Most notably, SB 690 does not eliminate private claims under CIPA’s wiretapping and eavesdropping provisions, which have also generated substantial litigation involving advertising pixels, analytics tools, chat functions, and similar technologies.
Businesses should therefore continue to review their website tracking and consent practices. Nevertheless, SB 690 represents a reduction in potential exposure and removes one of the CIPA theories that has helped fuel the recent surge in website-tracking lawsuits and demand letters.
