Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 14 JANUARY 2026

CIPA Reform In 2026: What Website Operators Need To Know

Ballard Spahr LLP
Ballard Spahr LLP
Contributor
Ballard Spahr LLP

Ballard Spahr LLP

Ballard Spahr LLP, an AmLaw 100 law firm with 19 US offices, serves clients in more than 50...

View firm profile
Explore more from Ballard Spahr LLP

Over the last few years, businesses, nonprofits, and other website operators have seen thousands of lawsuits and arbitrations filed under the California Invasion of Privacy Act (CIPA) alleging that the use of ubiquitous...

United StatesPrivacy
Alexia "Lexi" Chapman
Alexia "Lexi" Chapman
Matt Thornton
Matt Thornton
Gregory Szewczyk
Gregory Szewczyk
Author LinkedIn connections

Over the last few years, businesses, nonprofits, and other website operators have seen thousands of lawsuits and arbitrations filed under the California Invasion of Privacy Act (CIPA) alleging that the use of ubiquitous cookies and pixels on websites violates CIPA's wiretap and pen register provisions. The California legislature considered curbing that explosion of litigation with SB 690, which was introduced in the 2025 session with some enthusiasm but ultimately stalled.

Thus, although there is some hope of relief as the legislative session picks back up in 2026, organizations are left in the same situation as before—balancing business needs and value with risk mitigation.

SB 690 at a Glance

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

SB 54 Is In Effect: What California’s New Packaging Law Means For Your Business

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.
United StatesPrivacy
Wilson Elser Moskowitz Edelman & Dicker LLP
Wilson Elser Moskowitz Edelman & Dicker LLP
Article

California’s 2026 Legislative Session Wraps: A Wave Of Privacy And AI Bills Reaches The Governor, With Key Child Safety And AI Measures Signed Into Law

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?
United StatesPrivacy
Kelley Drye & Warren LLP
Kelley Drye & Warren LLP
Article

California's Fall 2026 Privacy Roundup: Expanded CCPA Deletion Rights And More

California Governor Gavin Newsom has signed several significant privacy bills that will reshape how businesses handle consumer data, including expanded deletion rights under the CCPA, shortened data broker response cycles, and sweeping new insurance sector privacy requirements. While one landmark bill banning the sale of sensitive personal information was vetoed, the approved legislation requires companies to update their deletion workflows...
United StatesPrivacy
McDermott Will & Schulte
McDermott Will & Schulte
Article

The Data Breach Brief: Week Of September 30th, 2026

Multiple organizations have recently disclosed significant data breaches affecting thousands of individuals, with compromised information ranging from basic contact details to highly sensitive medical records and financial data. The incidents span various sectors including healthcare, insurance, and professional services, raising questions about the scope of exposure and potential remedies for affected individuals.
United StatesPrivacy
Morgan & Morgan
Morgan & Morgan
Article

Emerging Enforcement Trends In Digital Health Data Privacy: Lessons From Washington’s My Health My Data, FTC vs. Hims & Hers And UCHealth Enforcement Actions

Federal and state regulators are intensifying scrutiny of healthcare and digital health companies over tracking technologies that share sensitive patient data with advertising platforms. Recent enforcement actions against major telehealth providers and healthcare systems reveal how common marketing practices can trigger significant legal liability under privacy laws, even for organizations not covered by HIPAA.
United StatesPrivacy
Benesch, Friedlander, Coplan & Aronoff LLP
Benesch, Friedlander, Coplan & Aronoff LLP
Article

Eleventh Circuit Developments: Decisions On Florida And Georgia Social Media/Minor Laws And New Alabama Law

Legal risk intensifies for companies offering online interactive features to minors across Georgia, Florida, and Alabama as the Eleventh Circuit vacates preliminary injunctions against state social media laws. With Florida's HB 3 and Georgia's SB 351 now enforceable and Alabama's HB 161 set to take effect January 1, 2027, businesses face divergent compliance requirements including age verification, parental consent mechanisms, and account deletion protocols.
United StatesPrivacy
Taft, Stettinius & Hollister LLP
Taft, Stettinius & Hollister LLP
Article

FinCEN Proposes To Designate Banque Misr UAE As A Primary Money Laundering Concern And Revoke Correspondent Banking Access

The Financial Crimes Enforcement Network has proposed revoking Banque Misr UAE's correspondent banking access to U.S. financial institutions, designating it as a financial institution of primary money laundering concern. This action stems from Treasury's Operation Economic Outcast, which aims to sever financial channels Iran uses to evade sanctions and fund terrorist activities through shadow banking networks.
GlobalGovernment, Public Sector
Ballard Spahr LLP
Ballard Spahr LLP
Article

AI Learning Or AI Copying? Ninth Circuit Weighs In

The Ninth Circuit held that GitHub Copilot's AI-generated code did not violate DMCA's copyright management information (CMI) removal provisions, even when output resembled source code, because the system generated new works through probabilistic patterns rather than retrieving and stripping information from existing copies. This decision establishes a critical distinction between AI systems that learn and generate versus those that retrieve and reproduce, with significant implications for how courts evaluat
United StatesIntellectual Property
Ballard Spahr LLP
Ballard Spahr LLP
Article

Senate Banking Committee Advances Brian Johnson’s Nomination To Lead CFPB

The Senate Banking Committee has advanced Brian Johnson's nomination to lead the Consumer Financial Protection Bureau in a party-line vote, setting the stage for a full Senate confirmation. With the Senate's pre-election recess looming and Mark Paoletta currently serving as Acting Director, the timing of Johnson's potential confirmation could determine whether the CFPB has Senate-confirmed leadership before the November midterm elections.
United StatesGovernment, Public Sector
Ballard Spahr LLP
Ballard Spahr LLP
Article

New York City’s Proposed POWER Act Would Create An Expansive Municipal Private Right Of Action For Unfair And Abusive Business Practices, Unfair Methods Of Competition, And Unlawful Acts

New York City's proposed POWER Act would create one of the most expansive municipal consumer-protection regimes in the country, introducing a sweeping private right of action that permits injured persons and nonprofit organizations to sue businesses for unfair, deceptive, abusive, or unlawful practices. The legislation has sparked intense debate between business groups warning of litigation exposure and consumer advocates arguing it fills critical enforcement gaps left by resource-constrained agencies. The
United StatesConsumer Protection
Ballard Spahr LLP
Ballard Spahr LLP
Article

Revised Draft Rules For The Colorado ADMT Act And Conversational AI Act Released

Colorado's Department of Law has released a revised draft of its Automated Decision-Making Technology and Conversational AI Service Rules, introducing significant changes to the state's AI regulatory framework. The updated rules address critical definitions around material influence and establish new standards for consumer rights, adverse outcomes, and reviewer qualifications. Organizations operating under the Colorado AI Act face important compliance considerations as the public hearing approaches.
United StatesCorporate/Commercial Law
Ballard Spahr LLP
Ballard Spahr LLP
Article

CSBS Releases Artificial Intelligence Supervisory Framework For State Examiners

The Conference of State Bank Supervisors (CSBS) on September 16, 2026 released an Artificial Intelligence Supervisory Framework designed to help state financial examiners identify and understand how the bank and non-bank institutions they regulate are using artificial intelligence, assess the associated risks, and determine when a more in-depth review may be appropriate.
United StatesCorporate/Commercial Law
Ballard Spahr LLP
Ballard Spahr LLP