Two major developments in California are reshaping how businesses face legal exposure over common website tracking technologies like cookies and pixels.
On August 21, 2026, the California Court of Appeal issued a tentative ruling in Variety Media, LLC v. Superior Court, addressing whether the California Invasion of Privacy Act’s pen register provision applies to everyday tracking tools.
At nearly the same moment, the California Legislature was finalising Senate Bill 690, which would eliminate the private right of action under that same CIPA provision.
Together, these developments might look like clear relief for businesses facing a wave of costly demand letters, but legal experts warn the picture is far more complicated.
In recent years, a small number of pro se plaintiffs and plaintiffs’ firms have sent tens of thousands of demand letters to businesses threatening class action lawsuits under CIPA.
Those demands typically assert claims arising from businesses’ alleged use of common tracking technologies, with settlements averaging between $10,000 and $25,000 per case.
Senate Bill 690, as amended in July, would give the California Attorney General exclusive authority to bring pen register and trap-and-trace claims arising from websites and online or mobile applications.
As of August 21, 2026, SB 690 had been ordered to a third reading in the Assembly, still requiring final legislative approval before the Legislature’s August 31 deadline.
The tentative ruling in Variety Media held that CIPA’s pen register definition is technology-neutral, meaning it can extend beyond telephone equipment to internet communications, which is a setback for businesses.
However, the ruling was not entirely unfavourable to businesses, as the plaintiff still lost on the specific claim brought before the court.
The court held that a pen register must capture information about where a communication is headed, not where it originated, which caused the specific claim to fail as pleaded.
The tentative decision would grant Variety’s petition in part and direct the trial court to sustain Variety’s demurrer with leave to amend, leaving room for plaintiffs to refile.
Plaintiffs may attempt to reframe source-identifying allegations under CIPA’s separate trap-and-trace definition, though the tentative ruling does not decide whether trackers here would satisfy that standard.
Before pen register theories gained popularity, plaintiffs pursued website tracking claims under a different CIPA provision, Section 631(a), and legal observers expect a swift return to that theory if SB 690 becomes law.
Businesses should also watch for new claims emerging under other privacy statutes and common-law theories, as the legal label may change but the underlying exposure will not disappear.
There is no current fix proposed to the remaining traditional wiretapping sections of CIPA, and significant uncertainty remains over the law’s applicability to third-party cookies, pixels, and other tracking technologies.
The official appellate docket scheduled oral argument for August 25, 2026, and other courts are already pausing CIPA cases while awaiting guidance from the Variety Media decision.