California has enacted Senate Bill 690, significantly narrowing who can bring lawsuits under the California Invasion of Privacy Act relating to online tracking claims.
The new law takes effect January 1, 2027, and includes a two-year look-back period covering pending lawsuits that were commenced before the law was enacted.
Under SB 690, only the California Attorney General may bring an action against a private actor for an alleged Section 638.51 violation arising from conduct on an internet website, online application, or mobile application.
Private plaintiffs can no longer sue businesses directly under Section 638.51 for deploying tracking pixels, analytics tags, or similar technologies on their websites and apps.
CIPA, originally enacted in 1967, allows private parties to enforce the law and recover at least $5,000 per violation, making it an attractive vehicle for litigation.
In recent years, plaintiffs have invoked California’s pen register and trap and trace statutes to challenge website tracking technologies, including those alleged to collect IP addresses and other electronic addressing information.
In his signing statement, Governor Newsom characterised this litigation wave as involving the “vexatious use of CIPA lawsuits and demand letters” to extract settlement money from small businesses.
Crucially, SB 690 does not make the underlying website-tracking conduct lawful, and businesses should be cautious about characterising the bill as having legalised tracking technologies.
The law does not address other CIPA provisions such as wiretapping under Section 631 and eavesdropping under Section 632, which plaintiffs frequently use to target common internet tracking technologies.
The limitation also applies retroactively to pending claims in actions commenced during the two years preceding the law’s operative date, meaning some existing cases could be affected immediately.
Governor Newsom specifically called on the California Legislature to address CIPA again next year to tackle “other decades-old statutes that are also susceptible to abuse by overly aggressive litigants.”
He emphasised the need to ensure a fair balance between protecting private information and preventing what he described as rapacious litigation targeting California businesses.
Plaintiffs frequently allege a range of privacy violations related to the same internet tracking technologies, including federal law, other state laws, common law, and constitutional violations.
Legal experts advise that businesses audit their website and app tracking technologies now, particularly given that privacy programmes and notices should be updated on an annual basis.