California SB 690: New Rules for Website Tracking Litigation and Data Governance

Source news: "California Enacts New Privacy Legislation Affecting Consumer Rights, Data Brokers, and Website Tracking Litigation" (Inside Privacy) · Search original The following is original commentary written by AI based on facts verified from 2 real news reports (not a translation or copy of the original). See sources at the end.

California Governor Gavin Newsom signed Senate Bill 690 on September 30, 2026, fundamentally altering the landscape of website tracking litigation by eliminating the private right of action under California Penal Code Section 638.51. This legislative move, which takes effect on January 1, 2027, shifts enforcement authority to the California Attorney General and removes the previous statutory damages of $5,000 per violation or treble actual damages that had exposed businesses to significant financial risk.

For in-house counsel, this development necessitates an immediate reassessment of data governance and vendor management strategies, particularly regarding the mitigation of exposure in ongoing or future tracking-related claims. While the new law restricts specific civil actions for personal pen register and trap and trace violations, it does not limit lawsuits based on other statutes such as California Penal Code Sections 631 and 632, meaning legal teams must continue to monitor compliance across the broader spectrum of privacy and data access laws.

Why This Legislative Shift Matters Now

The enactment of California Senate Bill 690 marks a definitive turning point in the landscape of digital privacy litigation, effectively terminating the era of private pen register lawsuits. Governor Gavin Newsom signed the bill into law on September 30, 2026, following its unanimous passage by the state legislature on August 28, 2026. The House of Assembly approved the measure with a 66-0 vote, and the Senate subsequently agreed to the House amendments by unanimous consent. This swift and unified legislative action underscores the state's commitment to curbing what the Governor’s signing statement described as excessive litigation that disproportionately burdens small businesses.

For legal teams, this development necessitates an immediate strategic reassessment of their litigation portfolios and risk management frameworks. The bill explicitly prohibits private civil actions for invasion of privacy under Section 638.51 of the California Invasion of Privacy Act, which previously allowed individuals to sue for unauthorized recording of communications on websites and applications. By removing the private right of action, the legislation eliminates the primary vehicle for consumer-driven pen register and trap and trace claims. Consequently, legal departments can no longer rely on or defend against these specific private suits, shifting the enforcement paradigm entirely toward the state.

The financial implications of this shift are substantial, as the bill abolishes the previous statutory remedy that permitted plaintiffs to recover the greater of $5,000 per violation or three times the actual damages. With this private enforcement mechanism removed, the authority to enforce Section 638.51 is now vested solely in the California Attorney General. This transition requires organizations to pivot their compliance strategies from managing individual class action risks to ensuring alignment with state-level regulatory oversight.

Enforcement Shift: Private civil lawsuits under Section 638.51 are banned, with enforcement authority transferred exclusively to the California Attorney General.
Financial Remedy Removal: The statutory right to claim $5,000 per violation or triple actual damages for private plaintiffs has been eliminated.
Legislative Consensus: The bill passed the Assembly 66-0 and the Senate unanimously, signaling strong bipartisan support for limiting private litigation.
Strategic Impact: Legal teams must immediately cease preparations for private pen register suits and refocus on state regulatory compliance.

Core Legal Changes to Section 638.51

The most significant structural change introduced by Senate Bill 690 is the elimination of the private right of action for violations of California Civil Code Section 638.51. Previously, individuals could file private civil suits alleging that their pen register or trap and trace data was intercepted through website or application tracking. Under the new framework, this individual enforcement mechanism is removed, and the authority to enforce Section 638.51 is transferred exclusively to the California Attorney General. This shift effectively ends the era of private litigation based solely on this specific statutory provision, consolidating enforcement power within the state’s executive branch.

This legislative move also abolishes the specific statutory damages that previously incentivized private claims. Under the old regime, plaintiffs could seek the greater of $5,000 per violation or three times the actual damages incurred. With the removal of the private right of action, these individual remedies are no longer available for Section 638.51 violations. The law takes effect on January 1, 2027, but it includes a retroactive provision that applies to claims pending in lawsuits filed on or after January 1, 2025. This means that ongoing cases relying on Section 638.51 as a basis for private recovery will be subject to these new restrictions, potentially forcing plaintiffs to pivot to other legal theories or face dismissal of those specific counts.

It is crucial to note that this restriction is narrowly tailored to Section 638.51 and does not create a blanket immunity for data tracking practices. The bill explicitly preserves the ability for individuals to pursue litigation under other provisions of the California Invasion of Privacy Act, specifically Sections 631 and 632. Furthermore, claims based on federal statutes, such as the Electronic Communications Privacy Act, or other state laws like the California Comprehensive Computer Data Access and Fraud Act, remain fully intact. Therefore, while the specific private remedy for Section 638.51 is gone, the broader legal landscape for privacy litigation remains active under alternative statutory grounds.

Exclusive Enforcement: The California Attorney General is now the sole entity with the authority to enforce Section 638.51.
Damages Abolished: The statutory provision allowing private plaintiffs to claim $5,000 per violation or triple actual damages for Section 638.51 breaches has been repealed.
Retroactive Application: The law applies to pending claims in lawsuits filed on or after January 1, 2025, despite its effective date of January 1, 2027.
Alternative Claims Preserved: Private rights of action under Civil Code Sections 631 and 632, as well as federal and other state computer fraud laws, are not affected by this change.

Scope of Protection and Remaining Risks

Although California SB 690 eliminates the private right of action for violations of Section 638.51 of the California Invasion of Privacy Act, this legislative change does not create a blanket immunity for data collection practices. The law specifically targets personal pen register and trap-and-trace suits based on that single statute, leaving other legal avenues open for plaintiffs and regulators. Consequently, organizations cannot assume that compliance with the new restrictions on Section 638.51 litigation will shield them from all privacy-related claims. A comprehensive risk review is necessary to identify where exposure remains under other state and federal frameworks.

Significant liability persists under Sections 631 and 632 of the California Invasion of Privacy Act, which are not restricted by SB 690 and remain fully actionable. Furthermore, claims based on the federal Electronic Communications Privacy Act and the California Comprehensive Computer Data Access and Fraud Act are unaffected by this new legislation. Because these statutes continue to provide grounds for litigation, companies must evaluate their tracking and data governance practices against these broader legal standards. The removal of the specific private remedy for Section 638.51 violations, which previously allowed for damages of $5,000 per violation or triple actual damages, shifts the enforcement landscape but does not eliminate the underlying obligation to protect consumer privacy.

Unrestricted State Claims: Litigation under California Invasion of Privacy Act Sections 631 and 632 remains possible and is not limited by SB 690.
Federal and Other State Laws: Claims under the federal Electronic Communications Privacy Act and the California Comprehensive Computer Data Access and Fraud Act are maintained.
Enforcement Shift: While private suits for Section 638.51 are banned, enforcement authority for that specific section is granted to the California Attorney General.
Ongoing Risk: The absence of a private right of action for Section 638.51 does not negate liability for violations of other privacy statutes.

Impact on Ongoing and Future Litigation

Strategic Adjustments for Active Litigation

The enactment of SB 690 introduces a critical procedural hurdle for legal teams managing active website tracking cases. Because the legislation applies retroactively to claims filed on or after January 1, 2025, attorneys must immediately audit their dockets to identify which matters are subject to the new restrictions. For cases initiated during this period, the removal of the private right of action under Section 638.51 means that plaintiffs can no longer pursue individual civil suits based solely on that statutory provision. Consequently, litigation strategies that previously relied on the threat of private enforcement must be restructured, as the ability to seek damages from individual defendants for these specific violations has been eliminated.

This shift fundamentally alters the risk landscape for both plaintiffs and defendants. While the law removes the private remedy for Section 638.51 violations, it does not create a blanket immunity for all data privacy issues. Legal teams should note that the statute explicitly preserves the ability to bring claims under other provisions of the California Invasion of Privacy Act, specifically Sections 631 and 632, as well as under federal laws like the Electronic Communications Privacy Act. Therefore, the immediate strategic adjustment involves pivoting from Section 638.51-based claims to these remaining viable causes of action. Defendants in ongoing litigation should also prepare to argue that any Section 638.51-based claims filed after the effective date are barred, while plaintiffs must consolidate their arguments around the surviving statutory frameworks to maintain their cases.

Key considerations for adjusting litigation strategy include:

Docket Audit: Review all cases filed after January 1, 2025, to determine if Section 638.51 claims are now subject to dismissal or amendment.
Claim Pivoting: Shift focus to claims under Sections 631 and 632 of the California Invasion of Privacy Act or applicable federal statutes, which remain unaffected by SB 690.
Enforcement Shift: Acknowledge that enforcement of Section 638.51 is now exclusively the domain of the California Attorney General, removing the leverage of private civil litigation for that specific statute.
Damages Recalculation: Adjust settlement calculations and damage models, as the previous statutory damages of $5,000 per violation or treble actual damages for Section 638.51 are no longer available in private actions.

Adjusting Data Governance and Vendor Management

With the personal right of action under California Civil Code Section 638.51 eliminated and enforcement authority transferred exclusively to the California Attorney General, in-house counsel must fundamentally restructure their approach to vendor relationships and internal data handling. The removal of the statutory private remedy—specifically the ability to claim $5,000 per violation or treble actual damages—does not eliminate the underlying legal obligation to protect consumer privacy, but it does shift the risk profile from direct civil liability to regulatory scrutiny and potential criminal exposure under other statutes. Consequently, legal teams should prioritize the immediate review of existing service agreements with third-party vendors, particularly those involved in website tracking, data brokering, or application development, to ensure that contractual indemnification clauses and compliance warranties align with the new enforcement landscape.

To mitigate residual liability, organizations must update internal data governance protocols to reflect that while Section 638.51 litigation is no longer a direct threat, claims under Sections 631 and 632 of the California Invasion of Privacy Act, as well as federal laws like the Electronic Communications Privacy Act, remain fully intact. This requires a dual-track compliance strategy: first, auditing vendor contracts to confirm that data processing practices explicitly avoid the specific tracking behaviors previously targeted by Section 638.51, and second, reinforcing internal security measures to prevent violations of the broader privacy statutes that still permit private suits. Legal departments should also consider implementing stricter vendor onboarding procedures that require detailed disclosure of tracking technologies used, ensuring that any residual risk is contractually managed and that the organization is prepared for potential state-led enforcement actions.

Contract Review: Audit all vendor agreements to update indemnification and compliance clauses, acknowledging that the Attorney General is now the sole enforcer for Section 638.51 violations.
Risk Reassessment: Shift compliance focus from avoiding private class actions to preventing regulatory penalties and maintaining protection against claims under Sections 631, 632, and federal privacy laws.
Vendor Transparency: Require third-party partners to disclose specific tracking mechanisms and data handling practices to ensure alignment with the new statutory boundaries.
Internal Protocols: Update internal data handling standards to document compliance efforts, which can serve as a defense mechanism in the event of state-led investigations or remaining private litigation under other statutes.

Immediate Compliance Checklist for Legal Teams

With the new statutory framework set to take effect on January 1, 2027, legal departments must immediately initiate a comprehensive audit of current tracking technologies deployed across websites and applications. Since the law retroactively applies to pending claims in lawsuits filed after January 1, 2025, it is critical to review all active litigation to determine if any pending causes of action are based solely on Section 638.51. Legal teams should update litigation hold policies to reflect that personal civil suits under this specific statute are no longer viable, while ensuring that evidence preservation protocols remain robust for claims under other statutes, such as Sections 631 and 632 of the California Invasion of Privacy Act, which remain unaffected by this legislative change.

To align with the new enforcement landscape, organizations should revise their data governance documentation to clarify that enforcement authority for Section 638.51 violations now rests exclusively with the California Attorney General. This shift eliminates the previous private right of action that allowed individuals to seek statutory damages of $5,000 per violation or three times actual damages, whichever was greater. Consequently, internal compliance reviews should focus on mitigating regulatory risk from state enforcement rather than preparing for individual class actions under this specific provision.

Audit Tracking Technologies: Identify all website and application tracking mechanisms to ensure they are documented and compliant with the new statutory boundaries.
Update Litigation Holds: Modify hold notices to exclude Section 638.51 claims while maintaining preservation for Sections 631, 632, and other applicable federal or state laws.
Review Pending Litigation: Assess all cases filed after January 1, 2025, to identify and manage the impact of the retroactive application on pending Section 638.51 claims.
Revise Enforcement Protocols: Shift internal risk assessment strategies to account for exclusive enforcement by the California Attorney General, removing procedures designed for private statutory damages recovery under Section 638.51.

Frequently Asked Questions

What does California SB 690 prohibit regarding website tracking lawsuits?

The law bans individual personal pen register and trap and trace lawsuits under California Penal Code section 638.51 for actions occurring on websites and applications. It removes the private right of civil action for violations of this specific section, transferring enforcement authority to the California Attorney General.

When does California SB 690 take effect and does it apply to existing cases?

The legislation takes effect on January 1, 2027. It applies retroactively to pending claims in lawsuits filed on or after January 1, 2025.

Does SB 690 eliminate all privacy-related legal claims in California?

No, lawsuits based on California Penal Code sections 631 and 632 remain available and are not restricted by this new law. Claims under other statutes, such as the federal Electronic Communications Privacy Act and the California Comprehensive Computer Data Access and Fraud Act, also remain in effect.