Over the past few years, a provision of California’s decades-old wiretapping statute has become one of the busiest fronts in privacy litigation. Relying on the California Invasion of Privacy Act (“CIPA”), plaintiffs have filed thousands of lawsuits claiming that tracking tools embedded in commercial websites are illegal “pen registers” or “trap and trace” devices. That theory exposes businesses to statutory damages that can multiply quickly across a site’s visitors. On September 30, 2026, Governor Newsom signed Senate Bill 690, which amends Section 638.51 CIPA to eliminate private enforcement of that provision.
SB 690 brings real relief to companies, but that relief is narrow. This article explains what pen registers and trap and trace devices are, how plaintiffs have applied those concepts to website tracking, what SB 690 does and does not change, and what steps businesses should consider now.
Pen Registers and Trap and Trace Devices
Section 638.51 prohibits the installation or use of a pen register or a trap and trace device without a court order or unless the use falls into a handful of narrow exceptions, chiefly for service providers protecting their networks and users, and otherwise where the user has consented.
The definitions of “pen register” and “trap and trace device” under Cal. Penal Code § 638.50 encompass tools that capture or record “dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” These terms were initially used in the context of telephones. In simple terms, a pen register records outgoing information, e.g. the phone numbers dialed from your phone line. A trap and trace device records incoming information, e.g. the phone numbers of people who call you. Neither device listens to or records the conversation itself; they can only capture who is calling whom and when.
Application of CIPA to Gathering of Website User Data
In the last several years, litigants have pushed for an expansion of this definition to encompass common website tracking tools such as tracking pixels, web beacons, and other internet data collection technologies, which are generally used for advertising purposes. In this context, an individual’s visit to a website is the communication. That person’s IP address and device details are like the “caller ID” that identifies where the communication came from. A tracker that captures this data and passes it to an outside
company, such as an analytics provider, advertising platform, or customer support and chat vendor, is therefore capturing identifying, non-content information.
While some federal courts have agreed that this definition applies to devices that record or decode user metadata (including IP addresses, clicks, or URL paths),i California state courts are still split on the matter. Some lower courts have dismissed suits, reasoning that the legislature never intended the pen register provision to apply outside of telephonic communications.ii However, the California Court of Appeal in Variety Media recently decided in a tentative ruling that CIPA’s pen register definition extends to online communications.iii The Court reasoned that the Legislature had added the pen register provisions to CIPA in 2015 expressly to create a state-law mechanism that would align California law with federal law, which already extended to internet communication, while affording California’s heightened probable cause standards and that excluding internet communications would defeat this purpose. A hearing took place on August 25, 2026, and the final ruling remains pending at the time of this writing.
While the issue remains unsettled, plaintiffs have continued to file suits in large numbers. As of July 1, 2026, over 4,000 CIPA website tracking and pen register lawsuits had been filed against California businesses, arguing that data collection tools violate Section 638.51. This is where Senate Bill 690 comes in.
Impacts of Senate Bill 690
Some of the key takeaways for companies lie in what this bill does not do.
First, SB 690 does not extend beyond the pen register/trap and trace provision of CIPA. It changes only who may sue over pen register and trap and trace violations. It leaves untouched the other provisions of CIPA that plaintiffs have long used to challenge online data practices, most notably Section 631, which prohibits wiretapping and the unauthorized reading of communications while they are in transit, and Section 632, which prohibits eavesdropping on or recording confidential communications. Those provisions have long been the basis for suits targeting website tracking tools, and a private cause of action is still available for violations of those sections. Some plaintiffs may attempt to reframe claims that would previously have been brought under Section 638.51 as wiretapping claims under Section 631. Because Section 631 generally requires interception of a communication’s contents, that shift will not work in every case, but tools that capture what users type, search for, or select may remain vulnerable.
Second, SB 690 does not make pen registers and trap and trace devices lawful. The prohibition in Section 638.51 remains on the books, as do its exceptions, and a violation is still a criminal offense punishable by a fine of up to $2,500 per violation. What changes is
who can enforce it. Now, rather than facing suits from individual website visitors seeking statutory damages, companies will face exposure under this provision only from public prosecutors. Whether prosecutors will pursue these cases against ordinary website analytics remains to be seen, and the answer may depend in part on whether the Court of Appeal finalizes its tentative ruling in Variety Media to confirm that the statute reaches online tracking technologies.
Third, it does not impact lawsuits brought prior to January 1, 2025. Actions filed before that date proceed under prior law, and defendants in those cases cannot rely on SB 690 to end them. Actions filed on or after that date, which include a substantial share of the thousands of suits noted above, are directly affected, and defendants in those cases can be expected to promptly seek dismissal. Plaintiffs, in turn, may challenge the retroactive application of the bill to claims that were already pending when it was signed. If such a challenge were to succeed, SB 690 has a built-in severability clause designed to ensure that the bill’s prospective elimination of private enforcement survives. The practical stakes of that fight are therefore limited to cases filed between January 1, 2025 and the bill’s effective date.
Practical Takeaways for Business
SB 690 offers meaningful relief, but it is not a reason for companies to stop paying attention to what their websites collect. Several steps remain prudent.
First, companies should inventory the tracking technologies running on their websites and apps and should understand what data each one collects and where that data goes. This process often reveals tools that marketing teams or vendors deployed without the knowledge of legal and compliance teams. Knowing which tools capture only identifying information and which capture the substance of user interactions will help a company gauge its remaining exposure under Section 631.
Second, consent remains valuable. User consent is one of the enumerated exceptions under Section 638.51 and is also a defense to claims under Sections 631 and 632. A well-designed consent mechanism, one that informs users about tracking before it begins and gives them a genuine choice, strengthens a company’s position against both the private claims that survive SB 690 and any public enforcement of Section 638.51. Companies should also confirm that their privacy policies accurately describe their use of these technologies, since the California Consumer Privacy Act imposes its own notice and opt-out obligations for sharing personal information for cross-context behavioral advertising, regardless of how CIPA litigation unfolds.
Third, companies facing pending litigation should determine where their cases fall relative to the January 1, 2025 cutoff and discuss with counsel whether SB 690 provides a basis for dismissal. They should also watch the courts. The final decision in Variety Media will shape how California courts read Section 638.50’s definitions in pre-2025 cases and in any public enforcement actions, and it may influence how courts approach related questions under other CIPA provisions.
Conclusion
SB 690 addresses the most immediate driver of the recent wave of CIPA litigation by taking pen register and trap and trace claims out of the hands of private plaintiffs. But the bill is a targeted fix rather than a comprehensive overhaul. Companies that treat the bill as an occasion to review and strengthen their data collection practices, rather than as a signal that those practices no longer matter, will be best positioned for whatever comes next.
This article is for informational purposes only and does not constitute legal advice. If you have questions regarding SB 690 or its application to your business, please contact our office.