What SB 690 Changes for Website Tracking Lawsuits

SB 690, which California's Governor approved on September 30, 2026, lets only the Attorney General sue a private actor under the California Invasion of Privacy Act, CIPA, for a section 638.51 pen register violation arising from a website or app. It takes effect on January 1, 2027, reaches pending claims in actions commenced within two years before that date, and leaves section 631 wiretap claims unchanged.

What SB 690 changes in the California Penal Code

SB 690 amends one section of the Penal Code, section 637.2, which is where CIPA lets a private person sue. It does not amend section 631 or section 638.51. The text on leginfo adds a new subdivision (d) with two paragraphs.

The first paragraph reads: "An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General." Subdivisions (a) and (b), which let a person sue for money and for an order to stop a violation, now open with "Except as provided in subdivision (d)".

Section 638.51 is the pen register section. It says a person "may not install or use a pen register or a trap and trace device without first obtaining a court order", and section 638.50 defines a pen register as a device or process that records "dialing, routing, addressing, or signaling information", "but not the contents of a communication". Website complaints under this section argue that a tracking script which collects a visitor's IP address and device details works as one. Suitcast's CIPA demand letter guide explains that theory and the wiretap theory side by side.

The Legislative Counsel's digest on the bill page states the effect in one sentence: the bill "would instead authorize only the Attorney General to bring that action" when the violation "is alleged to arise from conduct occurring on an internet website, online application, or mobile application." The bill's second section makes its provisions severable.

When SB 690 takes effect and which pending cases it reaches

SB 690 passed the Assembly 66 to 0 and the Senate concurred 39 to 0 on August 28, 2026. It was presented to the Governor on September 4 and, according to the bill history, approved on September 30, 2026. The bill has no urgency clause and sets no date of its own.

The California Constitution, article IV, section 8(c)(1) says a statute from a regular session "shall go into effect on January 1 next following a 90-day period from the date of enactment". Ninety days from September 30, 2026 ends in late December, so SB 690 takes effect on January 1, 2027. Until that day, section 637.2 reads as it did before.

The second paragraph of the new subdivision reaches back: "The amendments to this section by Senate Bill No. 690 of the 2025–26 Regular Session apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation." Read as written, the new rule covers a pending section 638.51 website or app claim in an action commenced within the two years before the operative date. Whether a particular case fits that window, and what happens to its other claims, is for the lawyers and the court in that case.

The text says nothing about demand letters; it speaks of claims and actions. If a letter has already arrived, the CIPA demand letter guide covers the first week, and a lawyer can say how the new law bears on it.

What SB 690 leaves as it was

Most of CIPA's civil side is unchanged. Section 637.2(a) still lets "a person who has been injured by a violation of this chapter" sue for the greater of five thousand dollars per violation or three times actual damages, and subdivision (c) still says actual damages are not a prerequisite. The only carve out is the one in subdivision (d).

Section 631(a) is the wiretap section. It reaches anyone who, "willfully and without the consent of all parties to the communication", reads or attempts to learn the contents or meaning of a communication in transit, and anyone who aids or employs someone to do so. Website complaints use it to describe a vendor's script reading what a visitor does or types on a page, with the site owner as the one who let it in. SB 690 does not touch it.

Section 638.51 is not amended either. Subdivision (c) still makes a violation punishable by a fine of up to two thousand five hundred dollars, up to a year in county jail, or both, and the Attorney General can still bring a civil action over a website. Pen register claims that do not arise from a website or an app stay open to private plaintiffs.

Read the table by its first column. Only the middle row changed, and nothing in the new subdivision mentions section 631.

What the court data shows on October 1, 2026

Suitcast's dataset page counts 402 verified website tracking filings nationally in the 12 months to October 1, 2026, from federal court records and sourced state filings. The California page attributes 90 of them to California businesses, 14 in the last 90 days. Tracking cases are attributed to the defendant's state, so filings against businesses elsewhere count under their own states.

The scripts named most in those complaints have not changed with the bill. On the tracker catalog, Google Analytics 4 is named in 160 verified complaints in the same 12 months, the Google Ads tag in 155, the Meta Pixel in 136 and the TikTok Pixel in 114. The firm ranking lists Bursor & Fisher first among tracking firms, with 47 dockets in the 12 months and none in the last 90 days.

Suitcast does not count filings by the statute section they plead, so it cannot say how many of the 402 rest on section 638.51 and how many on section 631. A complaint names its sections in its text, and every filing on the live pages links to its court record, where a reader can check. The methodology page says how a case is counted as a tracking case.

These counts move daily, and the pages linked here always show the current number.

What a website owner can check before and after January 1

What a website tracking complaint describes is a sequence: a script on the site sends a visitor's activity to an ad or analytics vendor before the visitor agreed, or after the visitor said no. SB 690 changes who may sue over one theory built on that sequence. It does not change the sequence itself, and the same check answers whether a site has it.

A check takes five minutes on any page, as the cookie banner test guide shows step by step:

1. Open the page in a private window with the browser's network panel recording, and do not touch the banner.
2. Filter the requests by the vendors the site uses: facebook, google, tiktok, pinterest, clarity. Every request listed was sent before any choice.
3. Click reject, reload, and look again. A request that still appears ignores the choice.
4. Fix the script where it lives, in the consent tool, Google Tag Manager or the platform's app settings, and repeat steps 1 to 3.

Suitcast's free scan runs the same sequence across several pages and writes down what it saw. The card below comes from a Suitcast report on a reserved example address: a California linen store running Pinterest ads, whose Pinterest Tag fired on three pages before any choice and kept firing after reject on the cart.

The scan records requests from the moment a page starts loading until the network goes quiet or 8 seconds pass, without clicking anything, and matches them against the 43 scripts in its catalog. It then presses reject when a banner offers it, never accept, and watches 3 more seconds. It reports what fired and when; it does not say which section a complaint would cite. The scanner policy describes what it loads.

Keeping the check current after the new law

A site's scripts change more often than the law does. A new ad campaign adds a pixel, an app update brings back an old tag, an agency adds a chat widget, and none of it asks the banner first. SB 690 does not change that, and the wiretap section it leaves in place speaks of consent.

A free scan is one dated snapshot of 5 pages. Suitcast's Monitor plan scans up to 100 pages every week, keeps every report with its PDF, and sends a weekly email naming the scripts that are new, the fixes that did not hold, and the new filings that match the site by state, industry or script. It costs $39 a month or $390 a year, less than one hour of a privacy lawyer's time. A Shopify store running Pinterest and Meta ads, or a dental practice in San Diego whose marketing agency adds tags, gets the same check every week with a dated record of what changed. An agency with client sites in California covers five of them on Pro for $79 a month or $790 a year, with its own name on each PDF. The pricing page compares the plans.

Limitations

This guide quotes the enrolled text of SB 690, its bill history, California Penal Code sections 631, 637.2, 638.50 and 638.51, and the California Constitution, article IV, section 8, all read on leginfo.legislature.ca.gov on October 1, 2026. The bill history did not yet show a chapter number. It describes what the text says. How courts apply the new subdivision, including to pending cases and to complaints that plead several sections, will come from rulings that do not exist yet. Nothing here is legal advice; the not legal advice page says what a score and a count mean.

The counts are verified federal filings plus state filings with a public source, so they are floors: demand letters are not counted, and state-court coverage is partial, as the dataset explains. A browser scan sees only what leaves a visitor's browser, so data a site sends from its own server is invisible to it.