Key takeaways

California Senate Bill 690 seeks to amend the California Invasion of Privacy Act to eliminate the private right of action for pen register and trap and trace claims.

Recent amendments to the bill remove a previously proposed commercial business purpose exemption.

The legislation includes a retroactive provision, applying to cases brought within the previous two years.

The bill advanced through the California Assembly Committee on Privacy and Consumer Protection, aiming to curb high volumes of demand letters.

The Development

On or about July 2, 2026, legal media reported that the California Assembly Committee on Privacy and Consumer Protection voted to advance SB 690 (California). The bill proposes significant amendments to the California Invasion of Privacy Act. Specifically, the legislation seeks to eliminate the private right of action regarding pen register and trap and trace claims.

The committee's advancement of the bill marks a definitive step toward altering how the state handles digital privacy disputes. Proposed amendments to the bill also include removing the commercial business purpose exemption, a provision that had been debated in earlier iterations of the text. Furthermore, the legislation contains a specific lookback provision, meaning the bill applies to cases brought within the previous two years.

Why It Matters

The proposed elimination of the private right of action directly targets a specific mechanism plaintiffs use to sue companies over website tracking technologies. By removing the ability of private individuals to file these specific lawsuits, the legislature intends to address a high volume of demand letters and litigation filed against businesses.

The retroactive application to cases brought within the previous two years means this bill would immediately disrupt pending litigation. Rather than merely setting a new standard for future conduct, the legislation threatens to extinguish active lawsuits currently proceeding through the court system. Furthermore, the removal of the commercial business purpose exemption from the bill indicates a shift in how the legislature plans to balance corporate tracking practices against consumer privacy enforcement. By dropping the exemption but eliminating the private right of action, the state retains the authority to regulate commercial tracking without subjecting businesses to mass private litigation.

Who Should Care

For Lawyers

Defense counsel handling privacy class actions and individual tracking claims need to monitor SB 690 (California) closely. If enacted, the retroactive provision covering the previous two years will likely require immediate motions to dismiss in pending pen register and trap and trace cases. Litigators will need to prepare arguments regarding the application of the new statutory language to existing dockets. Plaintiff attorneys will lose a primary statutory vehicle for generating website-tracking demand letters and will need to assess whether alternative legal theories remain viable under the California Invasion of Privacy Act or other state consumer protection laws.

For Consumers and Parties

Consumers who visit business websites will see a shift in how privacy rights are enforced. While the underlying tracking technologies might remain regulated by the state, individuals will lose the direct ability to sue companies for specific types of data collection involving pen registers and trap and trace devices. For businesses facing a barrage of statutory privacy claims, the bill offers a potential path to relief from costly settlements and litigation defense fees. Companies that utilize standard website analytics tools stand to benefit significantly from the reduction in private legal threats.

Legal Background

The California Invasion of Privacy Act was originally drafted decades ago to prevent unauthorized wiretapping and eavesdropping. In recent years, plaintiffs began applying the statute's provisions regarding pen registers and trap and trace devices to modern internet technologies. A pen register or trap and trace device traditionally recorded the outgoing and incoming numbers dialed on a telephone line. Modern litigation argues that website analytics software, which captures user IP addresses and browsing data, functions as the digital equivalent of these devices.

Because the statute provided a private right of action, individuals could sue for statutory damages without proving actual, out-of-pocket harm. This structure created a highly favorable environment for plaintiffs. Consequently, law firms generated a high volume of demand letters and lawsuits against website operators, claiming that routine digital marketing and analytics tools violated the decades-old telephone privacy law. Businesses frequently found themselves pressured to settle these claims to avoid the expense and exposure of class action litigation.

What the Legislature Did

To address this surge in litigation, the California Assembly Committee on Privacy and Consumer Protection advanced SB 690 (California). The committee focused on structural changes to the California Invasion of Privacy Act to relieve the pressure on the court system and the business community.

The primary mechanism the legislature deployed is stripping the private right of action specifically for pen register and trap and trace claims. Additionally, lawmakers altered the bill's initial framework by removing the commercial business purpose exemption. Instead of exempting certain business practices from the law entirely, the current version simply removes the financial incentive for private plaintiffs to enforce the pen register provisions. The legislature also included a lookback provision, ensuring the restriction applies to cases brought within the previous two years, effectively targeting the recent spike in website tracking lawsuits.

How It May Be Applied

If the bill becomes law, courts will immediately face questions regarding the retroactive application to cases filed within the previous two years. Judges will need to determine how to handle cases that are currently in the discovery phase or nearing settlement. Defense attorneys will likely file motions to dismiss en masse, arguing that the court no longer possesses jurisdiction over the private claims.

The removal of the commercial business purpose exemption also leaves open questions about how state regulators might enforce the remaining provisions of the California Invasion of Privacy Act. Without private plaintiffs driving enforcement, the burden will shift to government entities, such as the state attorney general, to monitor and penalize unauthorized digital tracking. It remains to be seen whether state agencies have the resources or the inclination to pursue pen register claims against businesses using standard commercial tracking software.

Statutory Changes

Feature	Current California Invasion of Privacy Act	Proposed SB 690 Amendments
Private Right of Action	Permits individuals to sue over pen register and trap and trace claims.	Eliminates the private right of action for these specific claims.
Enforcement Incentive	High volume of private demand letters and litigation.	Shifts enforcement away from private plaintiffs.
Application Timeline	Applies to current and future filings.	Applies retroactively to cases brought within the previous two years.
Business Exemptions	Subject to judicial interpretation of statutory language.	Removes the proposed commercial business purpose exemption.

The Bottom Line

California lawmakers are attempting to shut the door on a specific type of internet privacy lawsuit. By advancing SB 690 (California), the state wants to stop private individuals from suing companies over website tracking tools under the guise of old telephone wiretapping laws. If the bill passes, it will block future lawsuits of this kind and wipe out cases filed over the last two years, providing significant relief to businesses targeted by these claims.

This article is general legal information and commentary about legal developments. It is not legal advice, does not address your specific situation, and is not a substitute for advice from a licensed attorney. Reading this article and contacting us through this website do not create an attorney-client relationship.

Sources & authorities

SB 690 (California) — source

California Advances SB 690 to Curb CIPA Privacy Litigation

Key takeaways