Still Tracking, Still Suing: Website Privacy Litigation After SB 690

Key Takeaways

• California SB 690, passed August 28, 2026, eliminates private lawsuits under the California Invasion of Privacy Act (CIPA) based on pen register and trap-and-trace device theories, including claims filed on or after January 1, 2025, but does not affect wiretapping claims, ECPA theories, or claims in other states.
• Plaintiffs will continue to pursue website tracking litigation under federal and state wiretapping statutes, the ECPA’s crime-tort exception, and sector-specific theories targeting healthcare, financial services, and consent mismatch scenarios.
• Businesses can reduce litigation risk by mapping all tracking technologies, aligning privacy disclosures with actual data flows, configuring consent tools to enforce user choices, and testing regularly to confirm that cookie banners, tag managers, and CMPs function as intended.