California’s Governor signed SB 690 on 30 September 2026. It does one thing: a claim that a website or app ran an illegal “pen register” under Penal Code Sec. 638.51 can now be brought only by the Attorney General, not by private plaintiffs — and that applies to pending claims filed within two years before the law takes effect. It takes effect on 1 January 2027. It does not touch Sec. 631, the wiretap theory behind most session-replay and chat-widget suits. If your exposure came from pixels that collect IP addresses, it shrinks. If it came from scripts that record what visitors type, nothing has changed.
We covered SB 690 while it sat on the Governor’s desk, in what SB 690 changes, and what it doesn’t. The bill history now has its last entry: “Approved by the Governor”, dated 30 September 2026 — the final day he had under the California Constitution. This is the short version of what became law.
What the statute says
The bill is, in its own title, “An act to amend Section 637.2 of the Penal Code” — the section that gives private parties a right to sue under the California Invasion of Privacy Act. It adds a subdivision (d). Paragraph (1):
“An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.”
Paragraph (2) makes it reach backwards: the change applies “retroactively to any pending claim in an action commenced within two years before the operative date”. Nothing else in CIPA is amended. Earlier drafts of the bill carried a broader “commercial business purpose” exemption for the wiretap and eavesdropping sections; the version that was signed does not.
When it applies
The text has no urgency clause, so the default rule in the California Constitution, Article IV, Section 8(c)(1) governs: a statute “shall go into effect on January 1 next following a 90-day period from the date of enactment”. Ninety days from 30 September 2026 lands on 29 December, so the operative date is 1 January 2027.
On our reading, “within two years before the operative date” covers actions commenced from 1 January 2025 onward. That is our arithmetic, not a court’s: how “pending claim” is applied to cases already mid-litigation — or already settled, or on appeal — is exactly the kind of question defendants and plaintiffs will now argue about.
What it changes
Sec. 638.51 is the “pen register and trap and trace” provision. The theory behind the recent wave of demand letters was that an analytics or advertising script that collects a visitor’s IP address or device data is a trap-and-trace device, and that running it without a court order entitles each visitor to statutory damages under Sec. 637.2. Courts had already split on that theory in 2026, as our earlier post set out. From 1 January 2027, a private plaintiff cannot bring it at all for website and app conduct. The Attorney General still can.
What it does not change
- Sec. 631 wiretap claims. The theory that a session-replay tool or chat widget “intercepts” the contents of a visitor’s communication — the basis of the Los Angeles Times settlement this year — is untouched. Private plaintiffs can still bring it.
- Sec. 632 and 632.7. Not amended.
- The conduct itself. SB 690 changes who may sue over pen-register claims. It does not make collecting identifiers before consent lawful under anything else, and it says nothing about GDPR, the CCPA’s opt-out rights, or other states’ wiretap statutes.
- The Attorney General. Enforcement of Sec. 638.51 against websites now sits with the AG alone — which concentrates it rather than ending it.
What to do with this
If your site’s exposure was analysed as “the Meta Pixel or a similar tag collects IP addresses before consent”, the private-litigation risk from that specific theory drops from 2027. If it was “our session-replay or chat tool records keystrokes and page interactions from the first page load”, nothing in SB 690 helps, and the fix is the one it has always been: load those scripts only after the visitor agrees. Our pre-consent tracking checklist and the Playwright script for detecting it show how to check what actually loads first.
Nothing here is legal advice. It is what the enacted text and the Constitution say, as of 1 October 2026.
Whether a claim is a pen-register theory or a wiretap theory depends on what a script captured, and when. Get an independent, timestamped record of what loaded before consent with CookieInspector.