SB 690 and Website Tracking Suits: What LA Businesses Should Know

If you run a website for a Los Angeles business, there is a fair chance you have received, or know someone who has received, a demand letter claiming that ordinary analytics or ad pixels violate a 1960s-era California wiretapping law. A new state law trims part of that litigation wave starting Jan. 1, 2027. It does not end it, and the details matter for any shop, studio, clinic or startup with a tracking script on its site.

This article is general information, not legal advice. If you have received a demand letter or lawsuit, talk to a privacy attorney.

The background: CIPA and the "pen register" theory

The California Invasion of Privacy Act, or CIPA, was written to address phone tapping and eavesdropping. Over the past few years, plaintiffs' firms have used it against websites, arguing that cookies, pixels, chat widgets and analytics tools amount to illegal surveillance devices. CIPA allows statutory damages of $5,000 per violation or three times actual damages, with no proof of injury required, which made it attractive for mass demand letters.

One popular theory relied on Penal Code Section 638.51, which bars using a "pen register" or "trap and trace" device without a court order. Those terms originally described tools that capture the numbers dialed to and from a phone. Plaintiffs argued that trackers capturing IP addresses and device data serve the same function.

What SB 690 changes

Gov. Gavin Newsom signed SB 690 on Sept. 30, 2026. The law makes one targeted change to CIPA's civil remedy section: a lawsuit against a private business under Section 638.51 that arises from conduct on a website, online application or mobile application can be brought only by the Attorney General. Private plaintiffs can no longer sue on that theory.

Key points, as summarized by firms including Benesch and Baker Donelson:

• Effective date: Jan. 1, 2027.
• Retroactivity: The bill text says it applies to pending claims in actions commenced within two years before that date, which reaches cases filed since about Jan. 1, 2025. Defendants in those cases may be able to seek dismissal of the pen register claims.
• Demand letters: Baker Donelson notes that the retroactivity language covers pending claims in a lawsuit, not unfiled demand letters, though the change removes much of their leverage on this theory.

What SB 690 does not do

This is where small businesses should pay attention. The final law is much narrower than earlier versions, which would have exempted data processing for a "commercial business purpose." That broader exemption was dropped before passage.

As a result:

• Wiretapping claims under Section 631 remain available to private plaintiffs, along with eavesdropping claims under Sections 632 and 632.7, at the same $5,000-per-violation exposure. Several firms expect plaintiffs to reframe pen register claims as wiretapping claims, often targeting chat tools, session replay and third-party pixels that see page content.
• The underlying conduct is not made lawful. Section 638.51 still prohibits the practice; SB 690 changes only who can enforce it.
• Regulators can still act. The Attorney General and the California Privacy Protection Agency retain their enforcement powers.
• Federal and other states' laws still apply, including the federal Electronic Communications Privacy Act.

Baker Donelson also reports that the Reform CIPA coalition told lawmakers the bill would fully relieve only 27% of organizations facing CIPA litigation.

A related change: broader deletion rights

A separate 2027 law, SB 923, expands the California Consumer Privacy Act's right to delete so it covers personal information collected "from or about" a person, not only data collected directly from them, according to CDF Labor Law. The CCPA applies only to businesses that meet its thresholds, but those that do should confirm their deletion process can reach data held by vendors and data partners.

A practical website checklist

For a small LA business, the goal is not to strip out every tool. It is to know what is running and why.

1. Inventory your tags. List every analytics script, ad pixel, chat widget, session replay tool, embedded video and form plugin on your site. Agencies and past developers often leave old tags behind.
2. Remove what you do not use. Fewer third parties means less exposure and a faster site.
3. Look hardest at tools that see content. Chat widgets, session recording and pixels on pages with forms, health information or account details are the most common targets for wiretapping theories.
4. Tighten consent. Consider a consent banner that actually blocks non-essential trackers until a visitor opts in, and make sure the privacy policy matches what the site does.
5. Check vendor contracts. Know which vendors can use visitor data for their own purposes; that is often central to wiretapping claims.
6. Keep demand letters in perspective. Do not ignore one, and do not pay one automatically. A lawyer can assess whether the claim relies on the pen register theory SB 690 addresses.

SB 690 is real relief on one front, but it is a carve-out, not a safe harbor. A tidy, documented tracking setup remains the best protection for an online business in California.