California Ends Private “Pen Register” Suits Over Website Tracking. Here Is What It Doesn’t End.

On September 30, 2026, Governor Newsom signed SB 690, which removes the private right to sue under one of the most heavily used theories in California’s website-tracking litigation. For companies that have been receiving demand letters over analytics tools and advertising pixels, the law is real relief, though that relief is also narrower than the headlines suggest.

The California Invasion of Privacy Act, or CIPA, is a 1967 criminal wiretapping and eavesdropping statute that also lets individuals sue for $5,000 per violation, without proving they were harmed. In recent years, plaintiffs have used CIPA to argue that now ordinary website tools amount to illegal surveillance. Those tools include analytics scripts, advertising pixels, chat widgets, and session-replay software. With statutory damages counted per violation, the claimed exposure from routine web traffic can be very large, which is what made these claims attractive to consumer protection attorneys and their clients. While