California modified its California Invasion of Privacy Act (CIPA) with SB 690, which was signed on September 30, 2026, and its changes to CIPA take effect January 1, 2027. The change, though, is narrow.
By way of background, Section 638.51 of CIPA prohibits installing or using pen registers or trap-and-trace devices without first obtaining a court order, subject to certain exceptions. Section 637.2 permitted private plaintiffs to seek an injunction or monetary damages. Those damages being either $5,000 per violation or three times actual damages, whichever is greater.
Senate Bill 690 has amended Section 637.2 to limit who can sue over alleged pen register and trap-and-trace violations in this digital space. As revised, only the Attorney General may bring an action for alleged 638.51 violations that arise from “conduct occurring on” a website or app. Private plaintiffs, beginning January 1, 2027, will no longer be able to bring these Section 638.51 claims. The change will apply retroactively to pending claims made between January 1, 2025 and December 31, 2026.
Putting It into Practice: This requirement does not change the underlying law. This includes not changing Section 631, a provision used for many tracking claims. While this change does not go into effect until January 1, the retroactive nature can create some leverage for parties currently dealing with pending Section 638.51 claims. We also anticipate seeing fewer demands given the provision’s retroactivity.