California Limits Private Lawsuits Over Certain Online Tracking Claims

California has enacted Senate Bill (SB) 690, which narrows the circumstances under which private parties may bring lawsuits under the California Invasion of Privacy Act (CIPA), Cal. Penal Code Section 638.51.

The new law takes effect January 1, 2027, and notably includes a two-year look-back period for pending lawsuits commenced before the law was enacted.

Brief History

CIPA, enacted in 1967, includes civil and criminal provisions and, importantly, allows private parties to enforce the law. The law also allows those private parties to recover at least $5,000 per violation. CIPA generally prohibits the interception and use of the contents of a communication without the consent of all parties to the communication. Subject to narrow exceptions, the law also prohibits the installation or use of a “pen register” or “trap and trace device” without a court order or consent of all parties whose communication might be captured by those devices.