California Legislature Advances Bill to Reduce Privacy-Related Lawsuits
It has been a rocky road for California Senate Bill 690, a bill designed to limit the scope of California Invasion of Privacy Act (CIPA) claims. But the bill is advancing toward becoming law. As originally drafted, SB 690 would have exempted from CIPA the disclosure of information about communications to a third party for a "commercial business purpose," as defined in the California Consumer Privacy Act of 2018 (CCPA), as amended. That version of the bill stalled in committee last year, and was classified as a two-year bill, meaning that the earliest it could be considered again was in 2026. Now, an amended (and watered-down) version of the bill is again moving toward becoming law and providing relief for businesses from prevalent CIPA lawsuits.
CIPA Background
Originally enacted in 1967, CIPA was a Cold War-era wiretapping law designed to prevent the tapping of telephone and telegraph communications. The law is the reason you hear "this call may be monitored or recorded for quality and training purposes" whenever you call a business. CIPA (in California Penal Code Section 631[a]) prohibits a third party from learning or attempting to learn the content of a confidential communication while it is in transit without consent or from aiding and abetting a third party in doing so.
In 2016, CIPA was amended to add California Penal Code Section 638.51, which prohibits the installation of a pen register (a device or process that decodes dialing, routing, addressing or signaling information about a wire or electronic communication) or a trap and trace device (a device or process that identifies the originating number or other dialing, routing, addressing or signaling information of a wire or electronic communication) without a court order.
CIPA provides for a private right of action and carries statutory damages of $5,000 or three-times actual damages, whichever is higher, for a violation. A plaintiff may also seek injunctive relief, though this is rare. A plaintiff need not have suffered actual damages to bring a lawsuit under CIPA.
CIPA Lawsuits
For decades, CIPA was a privacy afterthought. However, in 2018, the California Legislature passed the CCPA, which provided broad rights to California consumers with respect to their personal information. With a limited exception in the context of data breaches, the CCPA did not provide for a private right of action. This left plaintiffs' attorneys searching for a way to bring privacy-related lawsuits, and they turned largely to CIPA.
CIPA claims challenging the use of common website technologies such as analytics, session replay, interest-based advertising and similar tracking technologies have become ubiquitous in the last five years. Lawsuits assert that these technologies either intercept the content of the plaintiff's confidential communications with the website in question while those communications are in transit without consent, or constitute unlawful pen registers and/or trap and trace devices. Claims against website operators also allege that they aided and abetted the interception of confidential communications in transit without consent. Federal courts, particularly the federal courts in the Northern and Central Districts of California, have been surprisingly receptive to such claims. This has resulted in CIPA creating a de facto opt-in regime with respect to sharing information about website visits with third parties including service providers/processors.
Senate Bill 690
As previously mentioned, the original version of Senate Bill 690 would have exempted from CIPA any disclosure made for a "commercial business purpose" as that term is defined in the CCPA. This exemption likely would have largely eliminated CIPA lawsuits related to the use of common web technologies.
That version of SB 690 passed the California Senate unanimously on June 3, 2025. However, when it advanced to the Assembly, it was classified as a two-year bill in the Committee on Privacy and Consumer Protection, meaning that it could not be considered until 2026. The bill appeared to be dead until July 2026.
On July 1, 2026, as a result of an intense lobbying effort, the bill was amended. This new version of SB 690 eliminates the "commercial business purpose" exemption the prior version would have added to CIPA but adds a provision to CIPA's private right of action to provide that any lawsuit under the pen register/trap and trace device section of CIPA (California Penal Code Section 638.51) "from conduct occurring on an internet website, online application, or mobile application" may only be brought by the California Attorney General. In short, it would eliminate the private right of action for pen register/trap and trace device claims.
SB 690 would be retroactive to any pending lawsuit that was commenced within two years prior to the operative date. While unlike the prior version of SB 690, this version of the bill would not eliminate CIPA litigation entirely, it would likely shift the litigation to Penal Code Section 631(a) claims, for which website operators often have better defenses such as consent, that the disclosed information does not constitute the "content" of the communications, and that the communications were not intercepted "in transit."
Current Status and What's Next?
SB 690 passed the Assembly Committee on Privacy and Consumer Protection on July 1, 2026, by a 14-0 vote and was referred to the Appropriations Committee. On August 5, 2026, the bill was placed in the Appropriations Committee suspense file, from which many bills never emerge. However, on August 13, 2026, the bill was again resurrected when it passed the Assembly Appropriations Committee by a 15-0 vote. The amended bill must now pass the full Assembly and Senate by August 31, 2026, in order to be sent to Governor Newsom's desk for signature. If ultimately passed and signed, the bill would become effective on January 1, 2027.
While passage remains uncertain, the unanimous nature of all votes on SB 690 to date suggests that the California Legislature understands the need for CIPA reform, and that there is a willingness to eliminate the private right of action under at least some provisions of CIPA. We will continue to keep you informed of the bill's progress in the months to come.
For more information on SB 690 and potential changes to CIPA's private right of action, please contact Joe Guzzetta or the Stinson LLP contact with whom you regularly work.
