California businesses received some welcome relief when Governor Gavin Newsom signed SB 690 into law on September 30, 2026.

As CDF previously blogged, the new law eliminates a private right of action under CIPA Section 638.51, which governs pen-register and trap-and-trace devices and has been the basis for one of the most heavily used theories behind recent website-tracking claims. Typically, these claims allege that website tracking tools, including cookies and pixels, constitute third-party surveillance under CIPA because they collect information about users’ interactions with websites without their consent. The law also applies retroactively to claims that accrued within the past two years.

While businesses may welcome this significant development, SB 690 does not eliminate all potential exposure arising from website tracking. Businesses should continue to remain vigilant about how their websites are configured and how tracking technologies are used.

What SB 690 Does Not Do

The new law does not:

• Eliminate all privacy claims under CIPA Section 631, including claims alleging unlawful wiretapping.
• Eliminate the possibility of enforcement by the California Attorney General or the California Privacy Protection Agency (CPPA), and it remains to be seen how aggressively these agencies will pursue website-tracking practices.
• Create a general “commercial business purpose” carve-out, an exemption that many businesses had advocated for during the legislative process.
• Prevent...

Read Full Story: https://news.google.com/rss/articles/CBMiuAFBVV95cUxNbWtEZzZRaVdTclh2M0JxVDk0...