California Reins in CIPA Claims with SB 690

We’ve been following the rise in litigation targeting websites for alleged California Invasion of Privacy Act (CIPA) violations. CIPA is a 1967 wiretapping law designed to protect telephone communications. Its drafters could not have foreseen the advent of the internet. Nevertheless, some plaintiffs have attempted to use the law to target websites engaged in run-of-the-mill metrics gathering. Last month, the California legislature passed a law to exclude websites from private CIPA claims. Now the governor has signed the law, and as of January 1, 2027, such claims will be barred by statute. A recent Hinshaw memo provides key points about the new law:

• “Starting January 1, 2027, private plaintiffs, including class action attorneys, may no longer pursue claims against private businesses under CIPA’s “pen register” and “trap-and-trace” provision (Penal Code Section 638.51) for conduct on a website, online application, or mobile application.
• Only the California Attorney General may bring those claims.
• While SB 690 takes effect January 1, 2027, it also applies retroactively to any pending claim in a lawsuit filed within the two years before that date, meaning any suits filed on or after January 1, 2025. For a copy of the revised law, see here.
• CIPA plaintiffs have signaled that they plan to challenge the retroactivity provision on constitutional grounds, so dismissals of pending cases may be contested. The California Legislature added a severability clause with that in mind: if the retroactivity provision is struck down, the rest of the law still stands.”

While plaintiffs plan to fight the retroactivity provision, they may have a difficult time keeping their cases alive. California courts were already moving toward limiting CIPA claims, so it is possible that absent SB 690, these cases would still have been thrown out. The law preserves some level of protection for website users, ensuring that the Attorney General has the authority to pursue particularly egregious cases. Unless the pending cases are somehow revived, SB 690 gives website owners and operators one less issue to worry about.