SB 690: what California's new CIPA law changes for your website

What does SB 690 actually say?

SB 690 is short. It changes one section of the California Invasion of Privacy Act (CIPA), Penal Code section 637.2, which is the part that lets people sue. It adds two rules (chaptered bill text, Chapter 976):

1. A lawsuit against a private business under section 638.51, the pen register section, over conduct on a website, online app or mobile app can only be brought by the Attorney General.
2. That rule applies to pending claims in lawsuits filed within two years before SB 690 takes effect.

A "pen register" is a device that records who is communicating with whom. Over the past few years, plaintiffs' firms argued that tracking tools on websites count as one, and that theory was behind thousands of lawsuits over cookies and pixels (Jones Day). SB 690 stops private plaintiffs from bringing that argument over websites and apps.

What doesn't SB 690 change?

• Wiretapping claims (section 631) and eavesdropping claims (section 632) are still open to private plaintiffs. Defense firms say section 631 claims over pixels, session replay and chat tools remain available (Procopio).
• The damages. Section 637.2 still allows $5,000 per violation or three times actual damages, whichever is greater, without proof of actual damages.
• The Attorney General can still bring pen register claims over websites and apps.
• Other laws. One defense firm lists claims plaintiffs have added against the same pixels and cookies, including California's computer fraud law, its Unfair Competition Law and the federal wiretapping law (Thompson Hine).

I already got a letter. Does SB 690 help?

Maybe, for part of it. If the letter or lawsuit relies on section 638.51, SB 690 may matter, including for some pending cases. If it relies on section 631 or 632, SB 690 doesn't change those claims. Only a lawyer who has read your letter can tell you which applies. Our guide to CIPA website tracking letters covers the first steps.

What should a small business do now?

1. Don't treat SB 690 as an all-clear. The wiretapping and eavesdropping theories still cover the same tools.
2. Find out what your site loads before visitors agree. Our free scan includes a privacy check that opens your page without clicking anything and lists the ad pixels, session recorders and analytics that start right away, plus any chat widget, and whether a consent tool or banner is there.
3. Turn off tools you don't use, and ask your web designer to hold the rest back until visitors agree, then test that it works.
4. If you've received a letter, call your business insurer and a California privacy lawyer before you reply or pay.

Run the free scan

The privacy check covers one page on first load. Our scanner visits from the eastern US, and some sites show different banners in different places. It can't see tracking that runs on your own server. It's a risk flag, not a legal finding.

Questions people ask

When does SB 690 take effect?

January 1, 2027. It was signed and filed with the Secretary of State on September 30, 2026, and like most new California laws it starts on the first of January after it's signed.

Does SB 690 apply outside California?

It changes California's law, CIPA. Businesses outside California get CIPA claims too when the claim is brought for California visitors, so the change can matter to them as well.

Does it change ADA website lawsuits?

No. SB 690 is about privacy and tracking. ADA website claims are about whether disabled people can use a site, under a different law. If you got an ADA letter, start with what to do in the first 72 hours.

Due Effort is not a law firm and this page is not legal advice. Law changes and court rulings can affect how SB 690 applies; check with a lawyer.