SB 690 and website tracking claims: what changes on January 1, 2027, and what your site still has to answer for
California has changed who can bring one kind of privacy claim over website and app tracking. Here's what the new law changes, what it leaves alone, and the questions about your site that are still open.
The short answer
Governor Newsom signed SB 690 on September 30, 2026, and it takes effect on January 1, 2027. After that date, only the California Attorney General can bring a CIPA pen register claim against a business over tracking on a website or app. The law doesn't change which tags your site runs, what they send, or whether they follow each visitor's choice.
On this page
What the law changes
Governor Newsom signed SB 690 on September 30, 2026, and it takes effect on January 1, 2027. The bill amends one section of the California Invasion of Privacy Act (CIPA), Penal Code section 637.2, which lets a person sue over a CIPA violation.
CIPA defines a pen register as a device or process that records the routing or addressing information of a communication, without its content. Demand letters and lawsuits have applied that idea to tracking scripts on websites, and how those demands work is in a separate note.
Under the text of SB 690, a claim against a private business under section 638.51, CIPA's section on pen registers and trap and trace devices (their counterpart for incoming information), that arises from conduct on a website, online application or mobile application can be brought only by the Attorney General. The chaptered text also applies the change to any pending claim in a lawsuit filed within two years before it takes effect.
What it leaves alone
- Wiretapping and eavesdropping claims. Sections 631 and 632, CIPA's wiretapping and confidential recording provisions, aren't changed, and private plaintiffs can still bring claims under them.
- The pen register section itself. The signed version amends only section 637.2. Section 638.51 reads as it did, and the Attorney General can still bring claims under it.
- A wider exemption that didn't pass. An earlier version of the bill would have added a broad "commercial business purpose" exemption reaching beyond the pen register section. That language isn't in the signed law.
Whether any of this applies to your site, or to a demand you've received, is a question for your counsel.
What stays technical
None of this changes what your site sends. These are the questions I answer for any site, with or without a demand letter.
- What fires before a visitor makes a choice.
- What changes after Accept, after Reject, and with Global Privacy Control turned on.
- Which tags and vendors are on the site, and who added them.
The banner test covers the first two. Ad pixels and opt-outs covers Meta, LinkedIn and other pixels, and Global Privacy Control covers the browser signal. The audit checklist lists the four consent states I test.
If you're working with counsel
Your counsel handles the legal questions. I give them the technical record, meaning a list of every tag on the site and what each one sends before a choice, after Accept, after Reject and with Global Privacy Control on. That record describes what the site does. It can't predict how a claim will turn out.
Questions about SB 690
When does SB 690 take effect?
On January 1, 2027. Governor Newsom signed it on September 30, 2026.
Does it apply to claims already filed?
The law says the change applies to any pending claim in a lawsuit filed within two years before it takes effect. Whether a specific claim is affected is a question for your counsel.
Do I still need a consent banner that works?
That's your counsel's call on the law. The technical fact I can state is that SB 690 doesn't change which tags run on your site or what they send before and after a visitor chooses.
