California’s SB 690 Limits Private Actions in CIPA Pen Register Cases
California’s SB 690 restricts private CIPA enforcement of pen register violations to the Attorney General.
Why it matters: Legal professionals need to understand SB 690’s new limits to advise clients accurately on privacy litigation under California’s Invasion of Privacy Act.
- SB 690 passed both California Senate and Assembly and awaits Governor Newsom’s signature.
- The bill amends only Section 637.2 of the Penal Code, focusing on pen register and trap and trace statutes.
- Private parties can no longer sue for alleged violations of pen register rules online; only the Attorney General can.
- A retroactive clause applies the limits to claims filed within two years before the law takes effect in 2027.
California Senate Bill 690 has completed legislative approval and is headed to Governor Gavin Newsom for signing. This legislation refines the California Invasion of Privacy Act (CIPA) by amending Section 637.2 of the Penal Code, which governs pen registers and trap and trace devices.
Under the changes, only the California Attorney General retains the authority to bring enforcement actions against private actors for alleged pen register violations related to internet websites, online apps, or mobile applications. This effectively bars private individuals and entities from suing under these specific CIPA provisions.
The bill’s retroactivity provision makes the new restriction applicable to claims filed within two years before the law’s operative date, which is set for January 1, 2027 if signed by the governor.
Notably, SB 690 originally included a broad "commercial business purpose" exemption which would have limited other CIPA provisions, but this was removed in the final version. Legal experts from Norton Rose Fulbright and Troutman Amin LLP emphasize that the change primarily narrows private enforcement rights for pen register claims rather than broadly altering CIPA.
SB 690 saw strong legislative support, passing the Assembly Committee on Privacy and Consumer Protection with a 14-0 vote and later the Assembly Appropriations Committee 15-0 before final passage. The legislation’s focus on limiting private lawsuits aims to reduce privacy-related litigation risks for websites and app developers that use technologies like cookies, pixels, or similar monitoring tools.
By the numbers:
- 14-0 — Vote margin in Assembly Privacy and Consumer Protection Committee on July 1, 2026
- 15-0 — Vote margin in Assembly Appropriations Committee on August 13, 2026
- January 1, 2027 — Effective date if Governor Newsom signs SB 690
Yes, but: SB 690 only restricts private enforcement for pen register and trap and trace provisions related to online activity; other CIPA claims remain unaffected for private plaintiffs.
What's next: Governor Newsom’s decision on SB 690 is expected before the August 31, 2026 deadline for enactment this legislative session.