California Amends SB 690, Removes Key CIPA ‘Commercial Business’ Exemption
California removes the ‘commercial business purpose’ exemption from CIPA in SB 690 amendments.
Why it matters: This rollback means businesses face continued compliance challenges under CIPA’s wiretapping rules, affecting litigation exposure. Legal advisers must reassess strategy as the amendment limits private enforcement for specific privacy claims while preserving most CIPA provisions.
- SB 690 amendments on July 2, 2026, eliminated the ‘commercial business purpose’ exemption from CIPA.
- The amendment limits private enforcement of Penal Code section 638.51 to the Attorney General only for internet, app-based claims.
- Retroactive effect applies to Section 638.51 claims filed after January 1, 2025, covering pending cases.
- Amended SB 690 takes effect January 1, 2027, with possible further changes before August 31, 2026.
On July 2, 2026, California’s Legislature amended Senate Bill 690, removing the long-debated ‘commercial business purpose’ exemption from the California Invasion of Privacy Act (CIPA). The original bill sought to exempt communications intercepted or recorded for a commercial business reason from CIPA’s strict wiretapping prohibitions, potentially easing compliance burdens for businesses that rely on common tracking and monitoring technologies.
This amendment maintains most existing CIPA provisions, continuing significant litigation risk for businesses that use technology subject to wiretapping laws. Puja J. Amin, an attorney at Troutman Amin, LLP, noted that the amendment “removes nearly every provision that originally generated excitement among businesses facing CIPA litigation.”
The amendment does, however, introduce limits on enforcement of California’s pen register and trap and trace law (Penal Code section 638.51). It restricts private lawsuits under these provisions related to internet websites, online applications, or mobile apps, allowing only the state Attorney General to bring such actions. This enforcement limitation applies retroactively to claims filed from January 1, 2025, and to all pending claims under Section 638.51.
The amended SB 690 is set to become effective on January 1, 2027. Legal experts warn that further amendments could be proposed and potentially added before the legislative deadline of August 31, 2026, aiming to address other facets of CIPA litigation. The evolving landscape requires businesses and their legal counsel to monitor developments closely to evaluate ongoing and future privacy compliance and litigation risks.
By the numbers:
- July 2, 2026 — Date of SB 690 amendment removing ‘commercial business purpose’ exemption
- January 1, 2027 — Effective date of amended SB 690
- January 1, 2025 — Retroactive start for limiting private enforcement under Penal Code section 638.51
Yes, but: While the removal of the exemption preserves most CIPA restrictions, the new enforcement limits on Section 638.51 claims reduce private litigation opportunities in specific areas, partially easing pressures on businesses.
What's next: Further amendments to SB 690 could be proposed before August 31, 2026, potentially expanding limits on private CIPA enforcement.