On September 30, 2026, Governor Newsom signed Senate Bill 690 (SB 690) into law. This shuts down a wave of lawsuits accusing California businesses of illegally “wiretapping” their own websites. Here’s the deal: if your business runs a website with cookies, pixels, chat tools, or analytics software, and you’ve gotten a demand letter or lawsuit under the California Invasion of Privacy Act (CIPA), this law affects you directly. Business owners in West Covina, Los Angeles, Anaheim, San Bernardino, Riverside, Ontario, and Pomona need to understand what changed, what didn’t, and what to do next.
Background: What This Means
For years, thousands of California businesses — small retailers, big companies, everyone in between — got sued or hit with demand letters under Penal Code Section 638.51. That’s part of CIPA’s “trap-and-trace” provisions, written decades ago to deal with devices that record phone numbers dialed from a landline. Sound outdated? It was. But plaintiffs’ lawyers got creative. They argued that everyday website tools — session-replay software, chat widgets, tracking pixels — counted as illegal “trap-and-trace” devices because they captured visitor data without consent.
Here’s where it got messy. Section 638.51 allowed a private right of action. That means any website visitor could sue without proving real financial harm. So plaintiffs’ firms filed claim after claim against California businesses of every size. Many businesses settled fast just to avoid the cost of fighting back, even when the claims didn’t hold much water legally. We saw this pattern play out again and again.
SB 690 removes the private right of action under Section 638.51 for conduct related to standard commercial business activities, such as advertising, marketing, and website analytics, when the business has a reasonable relationship with the consumer. The law still allows the California Attorney General and other public enforcers to bring actions, and it does not repeal CIPA itself. You can review the full bill text and legislative history on the California Legislature’s official site at leginfo.legislature.ca.gov. As of October 2, 2026, the law is scheduled to take effect on January 1, 2027, under the standard effective date for California statutes, so businesses should confirm the operative date and any amendments before relying on it in pending matters.
How This Affects Southern California Businesses
This change matters most to:
- Small and mid-size businesses in West Covina, Pomona, Ontario, and other Inland Empire and San Gabriel Valley communities that use common website plug-ins for chat, analytics, or advertising tracking.
- E-commerce and retail companies in Orange County and Los Angeles County that rely on cookies and pixels for marketing campaigns.
- Businesses that already received a demand letter or lawsuit threatening statutory damages under Section 638.51.
- Companies currently defending active CIPA trap-and-trace lawsuits in state or federal court within the Central District of California, which covers Los Angeles, Orange, Riverside, and San Bernardino Counties.
For businesses currently facing a demand letter or lawsuit, SB 690 can provide a strong argument for dismissal, but the application of the new law to pending cases may depend on when the claim was filed and how the court interprets retroactivity. This is a fact-specific legal question, and businesses should not assume a pending case will automatically be dismissed without a court ruling. Companies involved in ongoing business litigation over website tracking claims may want to discuss how this legislative change affects their specific matter.
What You Should Do Now
Even though SB 690 reduces private lawsuit exposure, California and federal privacy laws still apply to business websites. Consider these steps:
- Review any pending demand letters or lawsuits. Determine whether the claim relies solely on Penal Code Section 638.51, and whether SB 690 provides a basis to seek dismissal.
- Audit your website’s tracking tools. Identify which cookies, pixels, and third-party scripts are active on your site, and confirm you have appropriate disclosures, such as a privacy policy and cookie notice.
- Check compliance with the California Consumer Privacy Act (CCPA) and its amendments. SB 690 addresses CIPA’s trap-and-trace provisions; it does not change CCPA obligations regarding consumer data rights, which are separately enforced by the California Privacy Protection Agency.
- Keep records of consent mechanisms. If your website uses a cookie consent banner, keep logs showing when and how visitors provided consent.
- Do not ignore existing demand letters. Even with this change, responding appropriately and on time remains important to protect your legal position.
How Tez Law P.C. Can Help
Tez Law P.C. assists Southern California business owners in reviewing CIPA-related demand letters and lawsuits, evaluating how SB 690 may apply to pending or threatened claims, and assessing general website privacy compliance. The firm can help business owners in West Covina, Los Angeles, Orange, Riverside, and San Bernardino Counties understand their options for responding to a claim or updating website practices going forward. For businesses dealing with broader commercial disputes connected to these claims, the firm’s business litigation practice can support the defense of ongoing cases.
Frequently Asked Questions
What is Penal Code Section 638.51, and why did it lead to lawsuits?
Section 638.51 is part of the California Invasion of Privacy Act (CIPA) and originally addressed devices that record telephone numbers dialed from a phone line. Plaintiffs’ attorneys applied this old “trap-and-trace” language to modern website tools like tracking pixels and session-replay software, allowing private lawsuits with statutory damages even without proof of real financial harm.
Does SB 690 mean businesses can no longer be sued over website cookies?
SB 690 removes the private right of action under Section 638.51 for ordinary business activities like advertising and analytics, when there is a reasonable business relationship with the consumer. It does not eliminate all privacy-related risk, because other laws, such as the CCPA, still apply, and public enforcers like the Attorney General retain authority to bring cases.
Does SB 690 apply to lawsuits that were already filed before the bill was signed?
Whether SB 690 applies to lawsuits filed before its signing or effective date is a legal question that courts will likely need to address case by case. Businesses with pending claims should review the specific procedural posture of their case with legal counsel before assuming automatic dismissal.
When does SB 690 take effect?
As of October 2, 2026, SB 690 is expected to take effect on January 1, 2027, following the standard effective date rule for California statutes unless the bill specifies an urgency clause. Businesses should confirm the final effective date on the California Legislature’s official website before relying on it.
Should my business still have a privacy policy and cookie consent notice?
Yes. SB 690 addresses one specific private lawsuit pathway under CIPA, but businesses operating websites in California generally still need compliant privacy policies and consent practices under laws like the CCPA. Maintaining clear disclosures can reduce overall legal risk beyond just trap-and-trace claims.
If your business in West Covina, Los Angeles, Orange County, San Bernardino, or Riverside County has received a demand letter or lawsuit involving website tracking technology, or if you want to review your website’s privacy practices considering SB 690, Tez Law P.C. invites you to schedule a consultation to discuss your situation.
This article is general information, not legal advice, and reading it does not create an attorney-client relationship. Laws and agency practices change; contact Tez Law P.C. at 626-678-8677 or [email protected] about your situation. Prior results do not guarantee a similar outcome.