The Privacy Rule Survived. The Private Lawsuit Did Not.

A narrow amendment can move a large amount of money

CIPA was enacted long before pixels, session-replay software, and advertising identifiers became ordinary parts of a website. Section 638.51 generally prohibits installing or using a pen register or trap-and-trace device without a court order, subject to specified exceptions. California law also gives a person injured by certain CIPA violations a civil action for the greater of $5,000 per violation or three times actual damages. Actual damages are not required. In website litigation, that statutory structure turned a disagreement about whether a digital tool fits an old surveillance definition into a potentially large damages claim.

SB 690 amends only the civil-remedy provision. For conduct on an internet website, online application, or mobile application, an action against a private actor for violating section 638.51 may now be brought only by the attorney general. The bill does not rewrite the definition of a pen register. It does not create a universal commercial-purpose exception. It does not say that the disputed conduct was always lawful. It removes the private plaintiff from that particular enforcement path.

That distinction matters because early versions of the bill were broader. The enacted text is the relevant law. Businesses should not turn a narrow litigation defense into a press release claiming immunity from California privacy rules. Plaintiffs' lawyers should not describe the amendment as if nothing changed. The legal duty and the enforcement vehicle are different questions, and SB 690 gives them different answers.

The legislature changed pending litigation, not just future conduct

The most consequential language is temporal. The amendment becomes operative January 1, 2027, but it expressly applies retroactively to a pending claim in an action commenced within the two years before that date. Read literally, the window reaches actions filed on or after January 1, 2025. A qualifying section 638.51 website or app claim does not escape the amendment merely because the plaintiff filed while private enforcement was still available.

The clause changes settlement leverage before the operative date arrives. A claim valued yesterday as a statutory-damages exposure may be worth far less if the named plaintiff will lose the authority to pursue it. Defense counsel will preserve the new statutory argument. Plaintiffs' counsel will examine filing dates, the precise defendant, the alleged conduct, and whether other pleaded claims stand independently. Courts may have to address how the provision applies to procedural postures that the bill does not discuss in detail.

Precision is especially important at the edges. The final text refers to actions commenced during the two-year period. It does not expressly say that an older pending action is covered. Nor does it adjudicate every constitutional or vested-right argument that litigants may raise about retroactive application. The bill contains a severability clause, which lets unaffected provisions survive if a court invalidates part of the act. That anticipates the possibility of line-drawing litigation; it does not tell us how a court will resolve it.

Lawyers evaluating an existing portfolio should resist categorical advice based on a headline. The useful unit of analysis is the claim: when the action began, which CIPA section it invokes, what medium produced the alleged data, whether the defendant is a private actor, and whether the plaintiff has a separate theory that does not depend on section 638.51.

Private enforcement produced scale. Public enforcement will produce selection.

Reuters reported that California businesses have faced roughly 4,700 digital-wiretap suits since 2022, citing an estimate from Fisher Phillips, and that about two-thirds included a pen-register claim. The legislature was responding to a litigation market, not an academic ambiguity. The combination of statutory damages, unsettled technology definitions, and inexpensive claim replication made section 638.51 useful in both serious privacy cases and aggressive demand campaigns.

There is a legitimate policy case for narrowing that market. A small business should not face ruinous aggregate exposure merely because ordinary analytics software was characterized, without meaningful injury, as a surveillance device. Legal uncertainty can reward filing volume more than proof. Governor Gavin Newsom said the bill addresses vexatious use of CIPA against small businesses while acknowledging that more work is needed to balance innovation and privacy.

But transferring authority to the attorney general does not create a smaller version of the same system. It creates a different system. A private lawyer can pursue a claim because one client was affected and the economics justify the case. A public office must choose among privacy violations, antitrust matters, consumer fraud, environmental enforcement, charitable oversight, and every other demand within its jurisdiction. Selection is unavoidable. The attorney general may reserve section 638.51 for large, repeated, or especially intrusive practices. Many technically viable claims may never be filed.

That may be the legislature's intended result. If so, it should be described honestly. SB 690 trades decentralized volume and its abuses for centralized discretion and its gaps. The question is not whether one system has friction and the other does not. It is which errors California prefers: too many marginal private cases, or too few public cases to reach lower-profile misconduct.

The claims will migrate

Section 638.51 was never the whole field. SB 690 does not amend CIPA sections 631 or 632, which address wiretapping and recording confidential communications. It does not amend the California Consumer Privacy Act. Contract, consumer-protection, common-law privacy, and federal theories may apply depending on the facts. Morgan Lewis and Baker Donelson both note that the enacted bill leaves those routes in place even as it removes this private pen-register claim.

Expect pleading to move toward the remaining theories. That migration will not necessarily succeed. A tracker is not automatically a wiretap, a disclosure is not automatically an interception, and a privacy-policy sentence is not automatically a contract. The elements, consent rules, standing requirements, remedies, and defenses differ. Replacing one statutory citation with another does not preserve a case if the alleged facts do not satisfy the new theory.

The same caution applies on the defense side. A company that wins dismissal under SB 690 has not received judicial approval for its data practices. It may have defeated one plaintiff's authority to sue under one provision. The underlying deployment can still attract another claim, an attorney-general investigation, a regulatory inquiry, or reputational scrutiny. Litigation exposure and privacy governance overlap, but they are not interchangeable.

A tracker inventory is still more valuable than a litigation slogan

For businesses, the practical response is not to stop caring about web tracking. It is to know what is actually running. Marketing teams add pixels, chat tools, video players, session replay, attribution scripts, and embedded forms because each promises a measurable benefit. The legal department often sees a vendor name rather than the event stream. A defensible inventory should identify what data each tool receives, when it activates, which third parties receive the data, how long they retain it, what consent signal controls it, and whether the public disclosure matches the product's behavior.

For litigators, SB 690 is a reminder that statutory enforcement design can change the value of a case without changing the factual record. Pending matters need claim-specific analysis and updated reserves. Settlement communications should distinguish a theory that will lose its private enforcer from surviving theories supported by the facts. Clients should understand that a change in leverage is not the same as a merits ruling.

California chose a targeted correction after a surge of website-tracking litigation. The correction may curb opportunistic claims. It may also leave real but diffuse privacy harms below the attorney general's enforcement threshold. Both consequences can be true. The useful legal judgment is to say exactly what the statute changed: not the existence of every privacy duty, and not the lawfulness of every tracker, but the identity of the plaintiff who may ask a court to enforce one rule.

Changing who may sue is not the same as deciding that nothing unlawful happened.