Did Newsom sign SB 690?

Yes. Governor Newsom approved SB 690 on September 30, 2026, and it was chaptered the same day as Chapter 976, Statutes of 2026. Its operative date is January 1, 2027.

What does SB 690 change?

It amends Penal Code section 637.2 so that a claim against a private actor under Section 638.51, the pen register and trap and trace provision, arising from a website, online application or mobile application can be brought only by the California Attorney General.

Does SB 690 affect pending CIPA lawsuits?

Yes, for pen register claims. The new subdivision applies retroactively to any pending claim in an action commenced within two years before the operative date, so roughly suits filed from January 1, 2025. Defendants' lawyers expect the retroactivity clause itself to be challenged.

Does SB 690 end session replay and chat lawsuits?

No. SB 690 amends only section 637.2 and only for Section 638.51 claims. Wiretapping claims under Section 631 and eavesdropping claims under Section 632 can still be brought by private plaintiffs, and firms report plaintiffs are already recasting their complaints under them.

California SB 690 signed: which CIPA lawsuits survive

Image: Unsplash.

California just took the CIPA section behind the recent wave of cookie and tracker suits away from private plaintiffs. It didn't take the others. If your exposure comes from cookies and pixels that log IP addresses and page visits, SB 690 is real relief. If it comes from a chat box, a search bar or session replay that captures what people type, your risk is the same as it was in August, and probably a little higher, because that's where plaintiffs' firms are moving.

What happened

Governor Gavin Newsom approved SB 690 on September 30, 2026, and the Secretary of State chaptered it the same day as Chapter 976, Statutes of 2026. The bill's last stretch was quick: the Assembly passed it 66-0 on August 28, the Senate concurred 39-0 the same day, and it reached the governor's desk on September 4. An earlier version of this page, written when the bill had just cleared the Legislature, said Newsom hadn't acted yet. He has.

California Legislative Information history page for SB-690: approved by the Governor and chaptered by the Secretary of State on 09/30/26, Chapter 976, Statutes of 2026; Assembly passage 66-0 and Senate concurrence 39-0 on 08/28/26

Screenshot: SB-690 bill history, California Legislative Information.

The enacted bill does one thing. It amends Penal Code section 637.2, the section that gives CIPA its private right of action, and adds a new subdivision (d):

(1) An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.

Section 638.51 is the pen register and trap and trace provision, added to CIPA in 2015, according to Crowell & Moring. Plaintiffs used it to argue that a tracker collecting IP addresses, device identifiers and browsing data is a "pen register" installed without a court order. Courts split on that. The statutory damages that made those suits worth filing are unchanged for everything else in the chapter: the greater of $5,000 per violation or three times actual damages.

SB 690 chaptered text: Section 1 amends Penal Code 637.2; new subdivision (d)(1) limits Section 638.51 actions over websites and apps to the Attorney General, and (d)(2) makes the change retroactive to pending claims in actions commenced within two years before the operative date

Screenshot: SB 690 chaptered text, Chapter 976, California Legislative Information.

Newsom's signing message is short and pointed. He wrote that the measure "addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses," then asked for more: "CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants. I urge the Legislature to take this on next year." Read that as a signal, not a law. Nothing about Sections 631 or 632 changed on September 30.

Governor Newsom's signing message for SB 690, dated September 30, 2026, to the members of the California State Senate, urging the Legislature to address other decades-old CIPA statutes next year

Screenshot: signing message for SB 690, Office of the Governor of California.

How the bill got narrower

The 2025 version carried a "commercial business purpose" exception that reached beyond Section 638.51. It stalled in the Assembly, became a two-year bill and was cut down to the one subdivision above, Morgan Lewis explains. That history matters because this page first said SB 690 amends Sections 631, 632, 632.7, 637.2 and 638.50. The enacted bill touches section 637.2 only.

Who it helps, and from when

Question	Answer under the enacted text
Whose suits are barred	Private plaintiffs suing a private actor under Section 638.51
Over what conduct	Conduct on an internet website, online application or mobile application
Who can still sue under 638.51	The California Attorney General
Operative date	January 1, 2027 (no urgency clause)
Pending cases	Any pending claim in an action commenced within two years before the operative date
Sections not amended	631 (wiretapping), 632 (eavesdropping) and the rest of CIPA

The retroactivity line is the one defendants will lean on. Count back two years from the operative date and the window opens on January 1, 2025. Crowell flags that the retroactivity provision "itself may be challenged," so don't treat a pending case as dismissed until a court says so.

What still gets sued

Section 631 survives, and so does Section 632. Morgan Lewis reports that plaintiffs "have already signaled their intent to recast Section 638.51 claims as claims under Sections 631 and/or 632," along with computer-access and intrusion theories. Those claims are harder to plead: Section 631(a) needs the "contents of a communication," read or attempted to be read by a third party while "in transit." An IP address isn't content. A message typed into a chat widget is.

That's why the same firm expects "search bars and chat boxes" to feature more prominently in the next wave. Holland & Knight, asked whether SB 690 will end the flood of demand letters, answered "Not likely," because a single motion to dismiss often costs more than the typical individual settlement.

ABC10 covered the fight in July, before the vote, through a Dixon small business that was sued under CIPA:

What to do now

Sort pending matters by section. For each complaint or demand letter, list the CIPA sections it pleads and the date the action was filed. A pure 638.51 claim over your website or app, filed inside the retroactivity window, is the case to raise with counsel first.
Inventory what captures content. Chat widgets, AI support bots, site search, form tools and session replay that records keystrokes are Section 631 territory. Pixels and analytics that only log routing data were the 638.51 risk.
Fix consent where content flows to a third party. Morgan Lewis's advice is to fire cookies only after an explicit opt-in in litigation-heavy states and to give clear notice where a chat or search box sends what users type to a vendor. That's where we'd spend the next sprint.
Keep the Attorney General in mind. The Attorney General can still bring Section 638.51 cases over websites and apps. Expect fewer, more deliberate cases rather than none.
Watch 2027. Newsom asked the Legislature to take up the rest of CIPA next year. A broader fix may come, but nothing in the current text protects a chat widget.

If your chat or support bot runs on a third-party AI model, the state chatbot disclosure laws and California SB 942 add their own duties on top of CIPA. For the wider privacy picture, see the AI data privacy guide for small teams.

What we could not confirm

We read the chaptered text and bill history on California Legislative Information, the governor's signing message, and client alerts from Morgan Lewis, Crowell & Moring and Holland & Knight. We didn't find a count of pending Section 638.51 cases that would fall inside the retroactivity window, and we didn't find any court ruling yet that applies SB 690 to a pending case.

Correction, October 15, 2026: an earlier version said SB 690 was awaiting the governor's signature (he signed it on September 30, 2026) and that it amends Penal Code sections 631, 632, 632.7, 637.2 and 638.50; the enacted bill amends section 637.2 only. It also said about two-thirds of California privacy litigation involves the pen register theory, a figure we could not source.