California limits private lawsuits over website tracking in SB 690

The California Legislature has passed Senate Bill 690, a measure designed to protect businesses from a wave of expensive litigation regarding digital privacy. The law restricts the ability of individuals to sue over specific types of data collection, shifting enforcement power to the state.

Authored by State Senator Anna Caballero (D-Merced), SB 690 targets lawsuits based on the California Invasion of Privacy Act (CIPA). Originally enacted in 1967 to prevent landline wiretapping, CIPA has recently been applied to modern website tools. The new legislation, which passed with bipartisan support in August 2026, removes the private right of action for specified claims under Section 638.51—specifically those involving pen-registers and trap-and-trace devices used in websites, online applications, and mobile applications. Under the new rules, enforcement authority for these claims is vested exclusively in the California Attorney General.

The Rise of Nuisance Suits

The bill was introduced to address a sharp increase in what lawmakers describe as "abusive" or "nuisance" litigation. These lawsuits typically target routine website technologies, such as chatbots and analytics tools, alleging they violate CIPA's wiretapping rules. According to data cited during the bill's progression, the number of such lawsuits grew from approximately 600 to nearly 4,000 since the legislation was first introduced. For many small business owners, these suits often result in blindsiding legal demands for tens of thousands of dollars, regardless of whether a meaningful privacy breach occurred.

Industry Implications

By narrowing the scope of who can bring a lawsuit, SB 690 significantly reduces the legal liability for companies operating digital storefronts and apps in California. While the primary intent was to shield "Main Street" businesses from shakedown litigation, the law effectively provides a broader safe harbor for any entity using standard tracking and communication tools. This shift removes the threat of class-action settlements driven by private plaintiffs, who previously used the 1967 statute to challenge modern data collection practices.

The Privacy Trade-off

Despite the relief for business owners, the legislation has sparked a debate over the erosion of consumer protections. Privacy advocates argue that removing the private right of action limits the ability of citizens to hold companies accountable for unauthorized data collection. While the Attorney General now holds the sole power to enforce these specific CIPA provisions, critics suggest this creates a bottleneck that may leave many privacy violations unaddressed. Observers will now watch how the Attorney General's office prioritizes these cases and whether the reduction in private litigation leads to a decrease in corporate transparency regarding website tracking.