SB 690 Is on the Governor's Desk: What Changes for CIPA Website Claims

SB 690 has not become law. It passed both chambers of the California Legislature on a concurrence vote on August 28, 2026, was enrolled and presented to Governor Newsom on September 4, 2026, and now sits on his desk. He has until September 30, 2026 to act. If he signs it, it becomes a statute. If he vetoes it by returning it to the Senate, it does not. If he does neither by that date, it becomes a statute without his signature: under Cal. Const. art. IV, § 10(b)(2), a bill passed before September 1 of the second year of the biennium and held past September 30 becomes a statute unless it is returned. Inaction enacts this bill rather than killing it. None of that has happened yet, so today the bill has no legal effect.

That distinction matters because an earlier summary of this bill circulated as though it had already gutted CIPA website-tracking claims, as if the change were in force. It is not. What follows is what the bill's text actually does, what it leaves untouched, and what changes for a business under each of the three ways this can end.

What the bill would change

CIPA is not one statute for website-tracking purposes. It is two, and SB 690 touches only one of them. Section 631 is the wiretapping provision: it covers the interception of communication content, and a claim built on it alleges that a tracker captured what a visitor typed, clicked, or submitted. Section 638.51 is the pen register and trap-and-trace provision: it covers a device or process that records routing or addressing information rather than content, and it is the provision under which an advertising pixel gets described as recording where a visitor's traffic went. SB 690 was introduced in response to the volume of CIPA suits against ordinary businesses over their website trackers, and the version now on the Governor's desk narrows that exposure for only the second of those two provisions.

As passed, the bill would remove the private right of action for section 638.51 claims tied to conduct occurring on an internet website. A consumer would no longer be able to sue a business directly under that provision for that conduct; enforcement would run through the California Attorney General instead. Section 631 is not touched by anything in the bill. A wiretapping claim built on the same underlying tracker would be exactly as available after the bill as it is today.

Per reporting from Norton Rose Fulbright and Zwillgen, the bill also carries a retroactivity provision, reaching back two years from its proposed operative date of January 1, 2027 if signed. That detail comes from law-firm reporting on the bill rather than from a reading of the enrolled text itself, so treat it as reported rather than independently confirmed.

The distinction that matters

Everything else in this bill follows from one split. Read it once and the rest of this page, and any coverage of SB 690 you come across elsewhere, gets easier to sort.

• Section 638.51 pen register and trap-and-trace claims tied to website conduct. If SB 690 is signed, the private right of action for these claims ends. A consumer could not bring one directly. Enforcement would sit with the Attorney General alone. The bill's text limits this to conduct occurring on an internet website; nothing in it suggests section 638.51 changes outside that context.
• Section 631 wiretapping claims. Untouched, regardless of what the Governor does. A private plaintiff keeps the same right to sue directly under section 631 that exists today, and the statutory damages in Penal Code section 637.2, the greater of $5,000 per violation or three times actual damages, still apply to a claim brought under it.

What each outcome means

This page does not predict how the deadline will resolve. It describes what each of the three endings would do.

If he signs it, the private right of action for section 638.51 website-conduct claims ends on the bill's operative date, proposed as January 1, 2027, with the retroactive reach described above. A business would still face Attorney General enforcement under that provision, just not a private lawsuit. Section 631 exposure would be unaffected.

If he does nothing by September 30, the result is the same as a signature. The bill becomes a statute without one, on the same operative date and with the same retroactive reach. This is the ending a business is most likely to miss, because no signing announcement marks it. A reader who checks only for news of a signature and finds none should not conclude the bill died.

If he vetoes it, section 638.51 keeps its private right of action exactly as it exists today, and nothing about a business's CIPA exposure changes as a result of this bill. Section 631 exposure would, again, be unaffected, because the veto changes nothing about a provision the bill never touched.

Neither outcome resolves a separate, unrelated question that already splits the trial courts: whether section 638.51 reaches website tracking conduct at all. That question sits with the courts, not the Legislature, and this bill does not touch it either way.

What to re-check, regardless of how this lands

None of this touches the CCPA, which is a separate statute from CIPA and is not affected by SB 690 in any way. The CCPA already gives a consumer the right to direct a business not to sell or share personal information, under section 1798.120, and a mechanism for signaling that opt-out automatically, the opt-out preference signal in section 7025. A business that already treats pixel and pen-register-style reporting as a sale or share for CCPA purposes, and suppresses it on signal under section 7025, has a separate and independent reason those same requests should not be firing before a visitor's consent choice registers. SB 690's fate does not change that obligation, and it does not change what a network capture of your own site shows.

What stays worth measuring is the same thing regardless of which way the Governor goes: which third-party requests your site makes before a visitor interacts with your consent interface, and which domain each one contacts. A scan of a site's live network traffic can show which trackers fired before that first interaction, the domain each one reached, and the timing relative to it. That measurement does not change based on how SB 690 ends, because it is a question about section 631 as much as it is about section 638.51, and section 631 is not part of this bill under any of the three outcomes.

This page was published on September 4, 2026 and last updated on September 6, 2026, while SB 690 was still pending before the Governor. It will be revised once the September 30 deadline resolves, whether by signature, veto, or the lapse that enacts it.