California Limits Private CIPA Lawsuits Over Website Tracking Claims
California's SB 690 limits private CIPA lawsuits for website tracking, shifting enforcement to the Attorney General.
Why it matters: This change reduces private litigation risk for online businesses but keeps compliance teams alert for ongoing privacy challenges under CIPA's other provisions.
- CIPA, enacted in 1967 for wiretapping, was increasingly applied to website tracking technologies like cookies and analytics.
- SB 690, passed August 28, 2026, removes the private right to sue for website tracking claims; only the California AG can enforce now.
- SB 690 applies retroactively to claims filed from January 1, 2025, significantly cutting private website tracking lawsuits.
- Other CIPA provisions, including wiretapping rules, remain enforceable by private plaintiffs, so some legal risk persists.
The California Invasion of Privacy Act (CIPA), created in 1967 to address wiretapping, has expanded in recent years to cover website tracking tools such as cookies, session replay, analytics, and chat features. Plaintiffs argue these tools intercept or record user communications without consent, resulting in a surge of lawsuits—from about 600 cases before SB 690 to nearly 4,000 subsequently.Varnum, Sidley Austin LLP
On August 28, 2026, California enacted Senate Bill 690 (SB 690), which removes the private right of action under Penal Code 638.51 specifically for website tracking claims. Under the new law, only the California Attorney General is authorized to enforce CIPA against website, online app, or mobile application tracking violations. This change applies retroactively to lawsuits filed on or after January 1, 2025.Fenwick & West LLP
It's important to note that SB 690’s limits only concern website tracking claims; other parts of CIPA—such as its provisions on wiretapping and eavesdropping—still allow private plaintiffs to pursue lawsuits, keeping some litigation risk alive.Nixon Peabody LLP
CIPA allows for statutory damages up to $5,000 per violation. Plaintiffs have sought to apply these damages per visitor or session, amplifying potential exposure. Legal and compliance teams need to understand these potential liabilities and design user consent and data collection practices carefully.Loeb & Loeb LLP
By the numbers:
- 600 lawsuits — approximate number of CIPA website tracking cases before SB 690 introduction
- ~4,000 lawsuits — number of website tracking cases after SB 690 introduction, before enactment
- $5,000 — statutory damages allowed per CIPA violation
Yes, but: While SB 690 reduces private website tracking lawsuits, private enforcement remains possible under other CIPA provisions like wiretapping, meaning litigation risks persist.
What's next: SB 690 took effect immediately upon Governor Newsom’s signature on August 28, 2026, so businesses should update compliance accordingly.