Legislature and Appellate Court Bring Clarity to California Invasion of Privacy Act
In Short
The Background: Plaintiffs have generated thousands of lawsuits relying on the California Invasion of Privacy Act's ("CIPA") pen register provision, Cal. Penal Code § 638.51, to target businesses using cookies, pixels, and analytics tools. Courts are split on whether the provision applies to these routine website tracking technologies.
The Result: On August 28, 2026, the California Legislature passed SB 690, which would eliminate the private right of action for Section 638.51 claims arising from websites and apps, with a retroactivity provision. One week earlier, the California Court of Appeal issued a tentative ruling in Variety Media, LLC v. Superior Court suggesting that CIPA's pen register definition could extend to internet communications.
Looking Ahead: Governor Gavin Newsom has until the end of September 2026 to sign or veto SB 690. Even if enacted, the bill would not amend Sections 631 or 632, so plaintiffs are expected to pivot to those provisions and other privacy theories.
What SB 690 and Variety Media Mean for Businesses
The most consequential development is SB 690. A broader bill stalled last year after labor leaders and domestic violence victims' advocates raised concerns about removing public enforcement tools. The amended version that passed both chambers focuses narrowly on Section 637.2, CIPA's civil-remedies provision, stripping the private right of action only for Section 638.51 claims involving websites and apps. Under current law, Section 637.2 allows private plaintiffs to seek $5,000 per violation—a powerful incentive behind the recent wave of demand letters, many from self-represented claimants. The bill cleared both chambers on August 28, 2026, and now heads to Governor Newsom, who has until the end of September to sign or veto it.
Section 638.51 became plaintiffs' preferred vehicle because they argued that it presented a lower bar than CIPA's other provisions. Unlike claims under Sections 631 and 632, a Section 638.51 claim focuses on whether a device captures routing or addressing information, without an express confidentiality requirement. That distinction fueled the surge in pen register litigation and explains why SB 690 targets this provision specifically.
The tentative ruling in Variety Media addresses the scope of Section 638.51. Assuming the court does not deviate from its tentative ruling, the court adopted a technology-neutral reading of CIPA's pen register definition, rejecting the argument that the provision was limited to traditional telephone equipment. But the ruling would not be a blanket win for plaintiffs: the court found that because an IP address identifies the device that initiated a communication rather than the communication's destination, the plaintiff's claim failed.
Even if SB 690 is signed, it will not end website privacy litigation. Plaintiffs have always pursued tracking claims under Sections 631 and 632, and plaintiffs are expected to make a swift pivot back to those theories as well as to other privacy statutes and common-law causes of action. But that return restores the higher pleading burdens—including the contents requirement for Section 631 and the confidentiality requirement for Section 632—that plaintiffs tried to sidestep by turning to Section 638.51.
Businesses that rely on cookies, pixels, or similar tracking technologies should not wait for the governor's signature or a final court opinion before evaluating their exposure. They should assess current tracking practices, identify where specific legal risks exist, and prepare to respond regardless of which legal theory plaintiffs pursue next.
Four Key Takeaways
- SB 690 would eliminate the private right of action for Section 638.51 claims arising from website, online application, or mobile application activity, with a retroactivity provision covering claims filed within two years before the operative date. Governor Newsom has until the end of September 2026 to sign or veto the bill.
- The Variety Media tentative ruling indicates that the court believes CIPA's pen register definition is technology-neutral and can reach internet communications, but that a website visitor's IP address alone does not satisfy the statute because it identifies the source—not the destination—of a communication. Companies should watch for the final ruling in the Variety Media.
- Section 638.51 became the preferred avenue for website tracking claims because plaintiffs argued that, unlike Sections 631 and 632, it does not carry certain elements that can be difficult to plead in this context. If SB 690 forces a pivot back to those provisions, plaintiffs will face higher pleading burdens, but litigation risk will not disappear.
- Businesses should proactively review their web tracking practices and assess exposure under multiple legal theories rather than waiting for legislative or judicial resolution.
