On August 28, both houses of the California Legislature passed Senate Bill 690, sending the first meaningful California Invasion of Privacy Act (CIPA) reform in decades to Governor Gavin Newsom’s desk. The Assembly took up the bill on the floor and the Senate concurred in the Assembly’s amendments the same day, clearing the final legislative hurdles with just days left before the Legislature adjourns on August 31.
For a bill that many observers had written off in July — and that plenty of people considered a long shot when it was introduced in early 2025 — this is a genuine milestone. It happened because a broad coalition of business owners, nonprofits, healthcare providers, local news outlets, farmers, and public agencies kept showing up, kept telling their stories, and kept making the case that a 1967 wiretapping law is being weaponized in ways the Legislature never intended.
EIA is proud to have been part of that effort, and proud of the members who wrote letters, signed on, and shared what these demand letters have cost them.
What SB 690 Would Do
The bill that passed is narrower than the version introduced in 2025, but it strikes directly at the single largest source of abusive CIPA claims.
It ends private lawsuits over pen register and trap and trace claims. SB 690 amends Penal Code Section 637.2 — CIPA’s private right of action provision — so that private plaintiffs can no longer bring claims under the pen register and trap and trace (PR/TT) provisions, Sections 638.50 and 638.51. Those provisions were written to prevent covert government surveillance of communications-routing data. Plaintiffs’ firms repurposed them to attack routine website tools that capture basic addressing information like an IP address. By the Legislature’s own estimate, PR/TT claims account for roughly two-thirds of active privacy litigation of this kind.
Enforcement shifts to the Attorney General. The conduct remains regulated; what changes is who can sue over it. The California Attorney General retains enforcement authority, which removes the private-plaintiff engine driving the demand-letter economy without stripping away the underlying protection.
It reaches backward. As passed, the bill applies retroactively to qualifying claims filed in the two years preceding enactment, including pending matters within its scope. Senator Anna Caballero defended that provision by pointing to the numbers: roughly 600 cases asserting Section 638.51 claims when the bill was introduced, more than 4,000 today, many traced to a small handful of firms using repeat plaintiffs racing to file before reform could take effect. The retroactive reach is designed so that behavior isn’t rewarded. (If you have a pending PR/TT matter, the exact scope of the retroactivity provision is a conversation to have with your attorney.)
The Timing: What Happens Now
The Governor likely has until the end of September. While it is not exactly clear when the final text will make it to the Governor, under the California Constitution, bills passed before September 1 that are in the Governor’s possession on or after September 1 must be signed or vetoed by September 30. Governor Newsom has not taken a public position on SB 690. Therefore, we assume that roughly the next month is when advocacy matters most for ensuring that he signs the bill into law.
If signed, SB 690 takes effect January 1, 2027. The coalition pushed for an urgency clause that would have made the bill effective immediately on signature. The bill that passed does not appear to include one, which means it would carry the standard effective date. Businesses currently facing PR/TT demand letters should plan around that calendar rather than assuming immediate relief.
The Work Is Not Finished
We want to be clear-eyed about the gap that remains.
SB 690 does not touch Section 631, CIPA’s wiretapping-in-transit provision — the other pathway plaintiffs use to challenge the same industry-standard website technologies, including session replay software, live chat widgets, and third-party analytics pixels. Throughout the legislative process, the coalition pressed for a comprehensive fix covering both provisions. That fix did not survive.
The practical consequence is straightforward: closing the PR/TT door removes what has been the most-used theory, but it does not end this litigation. Plaintiffs’ firms are adaptable, and many are already pleading Section 631 alongside or instead of PR/TT claims. Expect the filings to migrate rather than stop. Many California small businesses, nonprofits, and public agencies will remain exposed.
That is where the next phase of this work goes.
Why This Fight Matters
More than 4,000 CIPA lawsuits have been filed in the last four years, on top of tens of thousands of demand letters. Individual demands typically run from roughly $10,000 to $25,000 and often higher, and by some estimates plaintiffs’ firms pressing these theories have collected over half a billion dollars in settlements. Because defending these cases costs more than settling them, businesses pay — even when no actual harm has been alleged.
The targets are not the surveillance operations the law was written to stop. They are plumbers, solar installers, restaurants, rural healthcare providers, local news outlets, food banks, and public schools running appointment scheduling, payment processing, and website chat.
What You Can Do in the Next 30 Days
The bill is on the Governor’s desk. This is the window where member voices carry the most weight.
- Urge Governor Newsom to sign SB 690. A short note from a California business describing what a CIPA demand letter cost you is more persuasive than any policy memo.
- Visit StopCIPAShakedowns.com for background on the bill and current calls to action.
- Follow Stop CIPA Shakedowns on LinkedIn, X, Facebook, and Instagram and help amplify.
- Share your story. If your business received a demand letter or was sued, your experience moves lawmakers — and even if your matter settled or is covered by an NDA, you may still be able to describe it in general terms.
- Talk to your attorney about pending matters. Retroactivity, scope, and the January 1 effective date all affect strategy on claims you are facing right now.
We thank Senator Anna Caballero for her leadership on this bill, Assemblymember Bauer-Kahan for her engagement in moving it through the Assembly, and coalition partners — including the Alliance for Legal Fairness, the California Chamber of Commerce, the National Federation of Independent Business, the California Retailers Association, TechNet, the California Farm Bureau, and the Civil Justice Association of California — for two years of sustained work.
EIA will report back as soon as the Governor acts.
To get involved or learn more, visit StopCIPAShakedowns.com. Help strengthen and shape policies that affect all ecommerce businesses by joining the EIA today . Together, we can continue to create the future of ecommerce. Subscribe to EIA email updates to stay informed on key developments and their impact on your business.
Ecommerce Innovation Alliance provides members with analysis of litigation and regulatory developments affecting online commerce and digital marketing. This post is for informational purposes only and does not constitute legal advice. Members with questions about their specific practices should consult counsel.
