Overview
- Governor Gavin Newsom signed SB 690 on Sept. 30, 2026, a law that bars private plaintiffs from suing under Penal Code Section 638.51 for conduct on internet websites, online applications, or mobile apps.
- The law takes effect Jan. 1, 2027, and is retroactive to claims filed within two years of that date, which may allow companies to move to dismiss many recently filed cases.
- Pen-register and trap-and-trace devices log outgoing and incoming metadata such as IP addresses, phone numbers, and timestamps, and the 2015 expansion of CIPA led plaintiffs to argue common web tools like cookies and analytics triggered statutory claims.
- Privacy groups including the EFF and ACLU say the change removes an important private remedy for people harmed by metadata surveillance, while business groups and the governor argue it stops abusive demand letters and mass litigation.
- SB 690 is narrow in scope because California still allows private suits under CIPA Sections 631 and 632, common-law claims remain available, and the state attorney general can still bring enforcement actions, so legal risk shifts rather than disappears.