Our readers know that we have been tracking developments with California Senate Bill 690 (“CIPA Bill”), legislation aimed at curtailing the unintended uptick in California Invasion of Privacy Act private enforcement actions. Mere days before California’s Legislature was scheduled to adjourn, both houses of California’s Legislature passed the CIPA Bill, which now awaits the governor’s signature. Below, we discuss the CIPA Bill in detail, its effects on CIPA itself, and the future of CIPA private rights of action.
Much Narrower CIPA Bill Scheduled to Become Law
When it was initially introduced in early 2025, the CIPA Bill sought to exempt e-commerce companies from all CIPA claims arising out of internet communications used for a “commercial business purpose.” After undergoing several iterations, the CIPA Bill that passed on August 28, 2026 differs significantly from the one first introduced nearly two years ago. As amended, the CIPA Bill would put an end to pen register (“PR”) and trap and trace (“TT”) non-governmental enforcement actions by removing the private right of action from CIPA. Assuming that the CIPA Bill is signed into law, prosecution of PR/TT-related claims will rest solely with California’s Attorney General. Importantly, the CIPA Bill applies retroactively to PR/TT claims in the two years preceding enactment. As of this writing, the CIPA Bill is slated to become effective on January 1, 2027; therefore, any PR/TT claims arising from January 1, 2025 to the effective date will be precluded from private enforcement actions under CIPA.
CIPA Bill Closes One Door But Leaves Another Open
Over the last few years, thousands of PR/TT CIPA cases have been filed (which does not include the scores of pre-lawsuit demand letters companies have received). As such, passage of the CIPA Bill certainly is a win for e-commerce businesses. Unfortunately, amendments to the CIPA Bill resulted in the removal of any application of the CIPA Bill to its non-PR/TT wiretapping provisions. Consequently, CIPA wiretapping claims involving the use of third-party tracking tools (which is one of the other theories that the plaintiffs’ bar has been pursuing) will continue to rise in the foreseeable future.
CIPA and other consumer data privacy laws continue to provide the plaintiffs’ bar with avenues for litigation. The experienced attorneys at Klein Moynihan Turco (“KMT”) have assisted numerous companies with CIPA-related proceedings and other consumer data privacy-related matters. In addition, the KMT litigation team has successfully defended many businesses in CIPA website tracking lawsuits and federal and state regulatory proceedings. If your company employs third-party tracking software or has been served with a CIPA-related claim, please email us at info@kleinmoynihan.com or call us at (212) 246-0900.
The material contained herein is provided for informational purposes only and is not legal advice nor is it a substitute for seeking legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.
Attorney Advertising
Photo by Sasun Bughdaryan on Unsplash
Similar Blog Posts:
Can’t Teach An Old Dog New CIPA Claim Tricks
