On Aug. 28, the California Legislature passed Senate Bill 690, which will significantly stymie website privacy litigation under the California Invasion of Privacy Act (CIPA). The bill passed both legislative chambers, and Gov. Gavin Newsom is expected to sign it.
Key Provisions
- If signed, SB 690 would eliminate private lawsuits alleging website-based “pen register” and “trap-and-trace” claims, i.e., those that are based on the mere transmission of IP addresses or other transactional data, under California Penal Code Section 638.51.
- For businesses that have received demand letters or are already defending lawsuits premised on routine website tracking technology – such as cookies, pixels and analytics tools – SB 690 would offer relief from certain types of claims asserted under the CIPA.
- The bill would apply retroactively to pending claims in actions commenced within two years before its operative date, which is expected to be Jan. 1, 2027.
- SB 690 includes a severability clause, so if a provision is invalidated, the remainder of the act will remain in effect. That provision may prove important because plaintiffs’ firms are already preparing constitutional challenges to the bill’s retroactive application.
Limitations
Notably, SB 690 does not eliminate the California attorney general’s ability to bring claims under Section 638.51, and the bill leaves Section 631 untouched. Thus, plaintiffs can still bring a private right of action for the alleged interception of the content of communications.
Anticipating the passage of SB 690, plaintiffs have increasingly asserted claims under Section 631 and the Federal Wiretapping Act – presumably to avoid the retroactive provisions of SB 690. Thus, in practice, it is likely that SB 690 will shrink one category of claims yet leave plaintiffs undeterred.
Recommended Next Steps
- Keep an eye on whether Gov. Newsom signs SB 690. He has until Sept. 30 to sign.
- Review any pending Section 635.81 demand letters, suits or claims commenced within two years before the bill’s operative date
- Continue comprehensive reviews of analytics technology on your website and mobile apps to ensure you know what information is collected, when it is collected, whether it goes to third parties and whether your disclosures accurately describe what is happening. Also confirm your data collection practices comply with the California Consumer Privacy Act and any other industry-specific regulations or other privacy requirements.
- Continue evaluating your potential exposure arising from analytics technology under Section 631 and the Federal Wiretap Act.
