California Lawmakers Pass Bill to Curb Website Tracking Lawsuits: What Businesses With Pending Claims Should Do Now
The California Legislature unanimously passed a bill on Friday that would block plaintiffs from suing businesses for certain website tracking claims under the main state wiretapping law, sharply narrowing a legal theory that has generated thousands of demand letters and lawsuits against average businesses over the past two years. If Governor Gavin Newsom signs the bill as expected, the California Invasion of Privacy Act (CIPA) would no longer allow private rights of action for website and app-based pen register and trap-and-trace claims – and it would stretch back in time to retroactively apply to actions commenced over the past two years. Unfortunately, the bill wouldn’t kill a common form of digital wiretapping litigation, but it would be a big step in the right direction. Here’s what actually changed (and what didn’t), what it means if you have a pending claim or demand letter, and what businesses should do while the bill awaits the Governor’s signature.
Explainer: Why Was This Bill Needed?
CIPA is a California law passed in 1967 written to stop people from tapping phone lines. But in recent years, plaintiffs’ lawyers have argued that the same law also applies to ordinary website technology, like the cookies, pixels, analytics tools, and chat widgets that power most modern websites. Plaintiffs have asserted multiple theories of CIPA violations, including:
- wiretapping claims under CIPA section 631;
- eavesdropping of confidential communications under CIPA section 632; and
- unlawful use of a pen register or trap and trace device or process under CIPA section 638.51.
Plaintiffs’ theory is that if a tool captures information about how a visitor navigates a site, that tool is functioning like a “pen register” or trap-and-trace device (the same kind of device once used to track which numbers a phone dialed) and that using it without the visitor’s consent violates CIPA section 638.51.
The big problem with this theory is that CIPA allows for statutory damages of at least $5,000 per violation with no need to prove actual harm, and can apply per visitor, per session. That means the potential legal exposure can add up fast, even if you’re using widely available analytics tools in good faith.
The result has been a wave of demand letters and lawsuits filed against businesses of every size and industry. Fisher Phillips tracks this litigation on our Digital Wiretapping Litigation Map, which shows just how widespread and costly this problem has become. Our recent testimony in front of state lawmakers also highlighted the extent of the issue.
Out of over 4,000 lawsuits that have been filed alleging CIPA violations based on use of ordinary website technology, about one third allege only a pen register or trap and trace claim and no other CIPA violation, and about one third allege both a pen register or trap and trace claim and another CIPA violation such as wiretapping under CIPA section 631.
SB 690 Does Two Big Things
The bill as originally introduced back in February 2025 would have broadly eliminated all private lawsuits based on CIPA’s wiretapping and eavesdropping provisions. The amended version passed by lawmakers last week doesn’t go that far, instead targeting a single, specific slice of CIPA:
- It eliminates the private right of action for website and app-based pen register claims. Under Penal Code Section 638.51, individuals will no longer be able to sue businesses over the “pen register” and “trap and trace” technology used on websites, online applications, or mobile apps. The California Attorney General would instead have exclusive authority to take action for such violations, which would dramatically reduce exposure concerns for businesses.
- It reaches back two years. The bill would apply retroactively to any pending claim in an action commenced within two years before its operative date. Since the operative date would be January 1, 2027, that lookback covers claims filed since roughly the start of 2025 – including cases and demand letters that are active right now.
What SB 690 Would Not Do
🚫 Section 631 wiretapping claims would be untouched. This is the provision behind the bulk of current CIPA activity, including many of the demands and claims by certain serial plaintiffs. SB 690 does nothing to limit those claims, and businesses that have received a Section 631 demand would not receive any relief.
What’s Next?
The bill now sits with Governor Newsom, who has three options: sign it, veto it, or take no action and let it become law without his signature. He has until September 30 to decide.
Given the bill cleared both houses without a single “no” vote, we expect Newsom is more likely than not to sign it. Bills that pass by such lopsided margins in the Legislature are rarely vetoed. But nothing is final, and businesses should proceed with cautious optimism until things are finalized.
What Should You Do Right Now?
As we await the Governor’s action on SB 690, here are some actions steps to consider:
- If you have a pending pen register claim or demand letter under Section 638.51: Talk to counsel about how the retroactivity provision could affect your matter if the bill is signed. The two-year lookback was written specifically to reach claims already in the pipeline, but the practical effect on any individual case, including active litigation, arbitration demands, and demand letters will depend on its specific procedural posture.
- If you have received a demand or are facing a lawsuit under Section 631 (wiretapping): This bill will not help you. That exposure remains exactly as it was, and plaintiffs who have paired pen register and wiretapping claims, a common pairing, will likely continue pursuing the wiretapping theory even after SB 690 takes effect.
- Everyone with a consumer-facing website or app: Don’t treat this as a reason to stop reviewing your tracking technology. Litigation in this space has already been shifting toward session replay tools, chat features, form data collection, and questions about whether consent was obtained before third-party technologies fired. Work with your FP Privacy counsel to discuss your Section 631 exposure and CCPA compliance obligations.
- Track ongoing court proceedings. The California Court of Appeal is about to issue a key ruling that will further define this area of law, which you can read about here. The best way to stay up to speed on this case, and Governor Newsom’s final decision on whether to approve SB 690, is to subscribe to Fisher Phillips’ Insights.
Conclusion
If you have questions about a pending CIPA matter or your website’s tracking technology, reach out to your Fisher Phillips attorney, the authors of this Insight, or any member of the firm’s Consumer Privacy Team or Digital Wiretapping Litigation Team.
Related People
