California Invalidates Private Lawsuits for “Pen Register” Website Claims
On September 30, 2026, California Governor Gavin Newsom signed SB 690 into law, eliminating the private right of action for portions of the California Invasion of Privacy Act (“CIPA”). Starting January 1, 2027, private individuals are barred from bringing claims related to CIPA’s “pen register” and “trap and trace” tracking on websites and apps.1 This change eliminates the central vehicle used by plaintiffs to bring CIPA claims over routine website data collection, such as IP addresses, non-user-generated referral URLs, and cookies. Because this change applies retroactively to any claims brought after January 1, 2025, it is expected to significantly arrest the current state of harassing CIPA litigation.
Background
Originally enacted in 1967 to address traditional telephone wiretapping, CIPA has since become a common basis for plaintiffs’ firms to sue over websites’ routine use of website analytics and advertising. In particular, plaintiffs argue that pixels, cookies, and other third-party tracking technologies are pen registers because they capture user information.
In a typical claim, a plaintiff would allege that third-party internet trackers operated as an unlawful pen register by transmitting a website visitor’s IP address, cookies, browsing information, or referring URL to a third party without a court order or the visitor’s consent. Because this theory did not require plaintiffs to show that the tracker captured the substance of any communication, or any actual harm or financial loss, nearly any website using ordinary analytics or advertising tools could become a target.
This theory proved especially easy for plaintiffs’ firms to exploit at scale. Because the information at the heart of a pen register claim is a routine output of many commercial websites, plaintiffs could identify potential defendants using copycat testing methods and bring claims with nearly identical complaints. Courts evaluating these claims often came to different conclusions, with one federal judge calling CIPA a “total mess,” observing that it is “borderline impossible to determine whether a defendant’s online conduct fits within the language of the statute.”2 Plaintiffs’ firms seized on this ambiguity to file complaints or send demand letters with the hope of securing an early settlement.
Thousands of lawsuits bringing these allegations have been filed in the past two years. With statutory damages of a minimum of $5,000 per violation, the damages plaintiffs could claim under CIPA were often large and out of step with any harm suffered. According to testimony before the California legislature, 4,000 lawsuits have been filed against California businesses under CIPA, with thousands of demand letters sent to businesses from individuals who were not harmed by their website. Some settlements of CIPA claims have been significant, including the Los Angeles Times’s reported $3.85 million settlement of a putative pen register class action.3
But not every court has been friendly to these claims, and some have pushed back on serial filers of CIPA claims. One court recently declared a prolific CIPA claim filer a vexatious litigant based on his pattern of filing a nearly identical complaint against dozens of companies and dismissing his case as soon as the defendant moved to dismiss the claims.4
Against this backdrop, the Legislature passed SB 690 to cut off the pen register claims that had driven much of this frivolous and expensive litigation. It found that CIPA’s pen register provision had become a “poster child for abusive lawsuits” and had enabled “[e]nterprising plaintiffs’ attorneys [to] exploit[] the statute at scale to go after businesses using third-party software to enable advertising on their websites.”
What SB 690 Does and Doesn’t Do
This new law cuts off the main theory plaintiffs used to bring CIPA claims based on a website’s use of a pen register. SB 690 amends Section 637.2 of the California Penal Code, meaning private individuals can no longer sue for pen register violations (Section 638.51). Going forward, only the Attorney General has authority to bring these claims. The law takes effect January 1, 2027, but applies retroactively “to any pending claim in an action commenced within two years” of the effective date. This means private actions filed on or after January 1, 2025, may be subject to dismissal.
However, even the law’s proponents have recognized that the changes do “not mean there are no lingering problems with CIPA.” Private individuals can still sue under CIPA’s wiretapping and eavesdropping provisions. The primary difference between “pen register” or “trap and trace” claims on the one hand, and wiretapping or eavesdropping claims on the other, is in the type of data being collected. If the data collected is mere “dialing,” “address,” or “routing” information, like IP addresses, non-user-generated URL referral headers, and website element identifiers, the data collection is no longer actionable under the change in law. But if the data constitutes the “contents” of a communication a person intends to send to another, like the contents of a website form filled out and submitted by a user, that data collection is still protected by CIPA’s wiretapping and eavesdropping provisions. Plaintiffs may turn to these or other theories of liability, including other state or federal laws, to bring claims based on website tracking. SB 690 also does not resolve whether ordinary website tracking tools can be classified as pen registers, and the government retains full enforcement authority.
Practical Takeaways
SB 690 removes the private right of action for CIPA’s most litigated provisions and should materially change the current state of website-tracking litigation, but it leaves CIPA’s wiretapping and eavesdropping provisions, along with other statutory and common-law theories, available to private plaintiffs. Under SB 690, businesses should:
- Revisit any pending claims or demands brought under CIPA. SB 690’s retroactive application means that claims brought on or after January 1, 2025, may be subject to dismissal. Any pending or recently asserted claims should be reevaluated under the new law.
- Maintain Section 638.51 compliance. Although private individuals can no longer sue for alleged violations of the pen register statute, the Attorney General retains enforcement authority over these claims.
Looking ahead, SB 690 should reduce the number of frivolous CIPA cases and demand letters brought by private individuals, but this kind of litigation is unlikely to disappear. With the Governor calling for further reform to curb “overly aggressive litigants” in 2027, more changes to this statutory scheme, and the theories plaintiffs use under it, should be expected.
2 Doe v. Eating Recovery Ctr. LLC, 806 F. Supp. 3d 1109, 1112 (N.D. Cal. 2025).
3 Mirmalek v. Los Angeles Times Commc’ns, LLC, 2025 WL 3687904, at *1 (N.D. Cal. Dec. 19, 2025).
4 Shah v. Crain Commc’ns, Inc., 2026 WL 2177397, at *5–6 (C.D. Cal. July 20, 2026).
