California Legislature passes SB 690 to limit pen register lawsuits under CIPA

What happened

On August 28, 2026 the California Legislature passed SB 690, a bill that would eliminate private lawsuits for website-based pen register claims under the California Invasion of Privacy Act. The bill would restrict such claims to actions brought only by the Attorney General and apply retroactively to pending claims filed on or after January 1, 2025. The measure now heads to Governor Newsom for signature, with an effective date of January 1, 2027 if signed.

Why it matters for trust and compliance

• Its status is passed. It is not law yet. Track it, but do not treat it as an obligation.
• The bill removes private rights of action for website pen register claims, potentially affecting many pending lawsuits.
• Takes effect January 1, 2027.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.