On August 21, 2026, the California Court of Appeal issued a tentative ruling in Variety Media, LLC v. Superior Court (Case No. B350578), tackling a question businesses have been asking for years: does the California Invasion of Privacy Act’s (CIPA) pen register provision reach everyday website tracking tools like cookies and pixels?
At nearly the same moment, the California Legislature was finalizing Senate Bill 690, which would eliminate the private right of action under that same provision. Together, these developments might look like relief for businesses. They aren’t—at least not fully.
The Status of Senate Bill 690
The most significant of the two developments is the unexpected rise of amended SB 690. A broader bill was sidelined last year, but after a wave of demand letters—often from self-represented (pro se) claimants—threatening businesses with lawsuits over alleged pen register violations, the Legislature introduced an amended bill that would eliminate private lawsuits