SB 690 Amended: California Moves to Strip Private Right of Action for Pen Register Claims

Key Point

Amendments to California Senate Bill (SB) 690 would foreclose private rights of action for pen register and trap and trace law and apply to cases brought within previous two years.

The Privacy and Consumer Protection Committee of the California State Assembly heard testimony on support and opposition to SB 690 late Wednesday, July 1.

The History of SB 690’s Attempt to Curtail Abusive Privacy Litigation

As a quick reminder, when it was originally introduced in early 2025, SB 690 would have amended Sections 631, 632, 632.7, and 638.50/.51 to preclude liability when the technology was used in a manner consistent with “a commercial business purpose”. These sections are part of California’s Invasion of Privacy Act (CIPA), and broadly prohibit the unauthorized interception, eavesdropping on, or recording of telephone and electronic communications. Section 631 targets the wiretapping of communications in transit; Section 632 prohibits the confidential recording of in-person conversations; and Section 632.7 extends those protections to cellular and cordless telephone communications. In recent years, plaintiffs’ firms have applied these statutes aggressively to website technologies, alleging that industry standard tools such as session replay software, live chat widgets, and third-party analytics pixels, violate the law.

Sections 638.50 and 638.51 are California’s pen register and trap and trace (PR/TT) statutes. A “pen register” captures outgoing electronic addressing information (such as URLs a user navigates to), while a “trap and trace device” captures incoming addressing information. These provisions were originally designed to prevent covert government surveillance of communications routing data, but plaintiffs have repurposed them to challenge the same categories of website tracking technology targeted under CIPA. Critically, both CIPA and the pen register statutes provide a private right of action, meaning any individual — not just a government regulator — can sue directly for an alleged violation, often seeking statutory damages that quickly aggregate into significant class-wide exposure.

Testimony during Wednesday’s committee session explained that the California Legislature estimates lawsuits alleging violations of California’s PR/TT law make up approximately two-thirds of active privacy litigation. These lawsuits are especially problematic because they typically do not involve the sharing of sensitive information, lack any harm, and are the result of routine web tools such as those that collect users’ IP addresses.

SB 690’s Most Recent Amendments

As introduced, the bill would have applied retroactively to any case pending as of January 1, 2026, but that language was struck before it passed out of the California Senate. The California State Assembly moved the bill to a two-year track after receiving opposition that “commercial business purpose” was too broad and would allow companies to infringe on consumers’ privacy so long as they could tie it to a “commercial business purpose.”

After hearing from several key stakeholders, the bill’s sponsor, Senator Anna Caballero, again amended the bill Wednesday. As amended, the bill: (1) applies only to California’s pen register and trap and trace statute, California Penal Code §§ 638.50 and 638.51, and (2) removes the private right of action for a violation of these statutes. The amended bill instead provides the California attorney general with the authority to bring claims.

Most critically, the amended SB 690 again applies retroactively, going back two years. Caballero defended the retroactive provision, noting that when the bill was introduced she knew of approximately 600 cases asserting claims under California’s § 638.51, but that number has since exploded to more than 4,000 cases, many of which came from one of four law firms and used repeat plaintiffs. Caballero explained that, although this bill has been in print and law firms and plaintiffs knew there was an effort to curtail these types of claims since early 2025, plaintiffs reacted by filing a flurry of lawsuits “to get in before the deadline.” Caballero and others reiterated that the retroactive provision was necessary to avoid rewarding that behavior.

The amended bill received significant support from a variety of people, including small business owners and affiliation groups. It received some opposition, mostly from individuals who had opposed the bill before the amendments were announced. Most of these oppositions noted that they would review the amended language and reflect on whether they supported or opposed the statute.

What’s Next?

The July 1 amendments are merely an amendment to an existing bill, and SB 690 still has several steps remaining before it can become law. With the support of the senators who spoke in favor of the bill Wednesday, however, SB 690’s chances of becoming law increased significantly.

Those same senators and others noted that the amended SB 690 leaves much undone as well, including addressing plaintiffs’ assertions that the same industry-standard website tools violate CIPA § 631. The California Legislature’s attempt to address even some of these issues through the amended SB 690, however, is a welcome step for thousands of website owners.