SB 690 Passes California Legislature: What the CIPA Bill Changes

California's CIPA Pen-Register Bill SB 690 Clears the Legislature: What It Would Change

California Senate Bill 690, which would limit who can sue businesses under the state's pen-register and trap-and-trace privacy law, passed both the Senate and the Assembly by August 28, 2026, and was enrolled August 31, 2026. It is not law. It now awaits action by the Governor.

Information last verified on September 2, 2026.

Status: SB 690 has passed both houses of the California Legislature. The Senate concurred in the Assembly's amendments on August 28, 2026 (Ayes 39, Noes 0) and the bill was ordered to engrossing and enrolling that same day. The Legislature's own enrolled bill text carries a version date of August 31, 2026. As of September 2, 2026, the official Legislature bill history log shows no entry for presentment to the Governor, a signature, a veto, or chaptering. SB 690 is not law.

Jurisdiction: California state law only, specifically the California Invasion of Privacy Act (Penal Code Sections 630 through 638.53). This article does not address federal wiretap law, other states' recording or privacy statutes, or non-CIPA theories used in the same lawsuits.

What Happened

SB 690, titled "Crimes: invasion of privacy" and introduced by Sen. Anna Caballero (coauthored by Senators Niello and Valladares and Assembly Members Irwin, Macedo, and Blanca Rubio), was introduced February 21, 2025. It was amended in the Senate three times before its first passage, then passed the Senate on June 3, 2025 by a vote of 35 to 0 and moved to the Assembly.

The bill sat with limited movement through most of 2025 and into 2026, then advanced through the Assembly Privacy and Consumer Protection Committee and the Appropriations Committee, where it was amended again on July 2, 2026 and placed on the suspense file August 5, 2026. The Assembly Appropriations Committee passed it 15 to 0 on August 13, 2026, and it moved to third reading.

The Assembly passed SB 690 and ordered it to the Senate on August 28, 2026. The Senate then took up the Assembly's amendments the same day: it went into concurrence status, and the full Senate concurred in the Assembly amendments by a vote of 39 to 0. The bill was then ordered to engrossing and enrolling. The Legislature's bill-text system lists the resulting print as the "Enrolled" version, dated August 31, 2026.

That is the complete official action log as of this article's verification date. No later entry, such as presentment to the Governor, a signature, a veto, or a chaptered-by-the-Secretary-of-State notation, appears in the Legislature's history record for SB 690.

The bill's target is a specific litigation pattern. CIPA's pen-register and trap-and-trace provision, Penal Code Section 638.51, was written for telephone-era surveillance devices but has been read by plaintiffs' firms to reach website analytics scripts, live-chat widgets, and session-replay tools that log visitor identifiers or behavior without a court order. That theory has driven a wave of class actions against ordinary websites, a pattern this site has covered in reporting on a vexatious CIPA litigant's case and on a suit targeting an AI meeting notetaker over its use of similar recording and transcription technology.

What SB 690 Would Change

SB 690 amends exactly one statute: Penal Code Section 637.2, CIPA's private civil-action and damages provision. It does not touch Section 638.51's underlying prohibition on installing or using a pen register or trap and trace device without a court order, and it does not touch Sections 631 or 632.

The enrolled bill text adds a new subdivision (d) to Section 637.2, reading in relevant part:

"(d) (1) An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General."

The existing subdivisions (a) through (c), which give an injured person the right to sue for the greater of $5,000 per violation or three times actual damages, and to seek an injunction, remain in place for CIPA claims generally. What changes is narrower: for a Section 638.51 claim specifically, against a private (non-governmental) defendant, arising from website, app, or mobile-app conduct, subdivision (d)(1) removes the private right of action and leaves only the Attorney General able to sue.

A second clause, subdivision (d)(2), addresses pending cases directly:

"(2) The amendments to this section by Senate Bill No. 690 of the 2025-26 Regular Session apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation."

The bill's existing subdivision (d), which states that Section 637.2 does not affect a separate Civil Code provision, is renumbered to subdivision (e) without substantive change. The bill also declares its provisions severable, meaning that if a court strikes one part, the rest is written to survive independently. The Legislative Counsel's Digest, which summarizes the bill for lawmakers, describes the change the same way: existing law lets an injured person sue for a pen-register violation, and "this bill would instead authorize only the Attorney General to bring that action" for the website-and-app subset of claims described above. Nothing in the enrolled text defines or references a "commercial business purpose" exception; the operative mechanism is the Attorney-General-only carve-out quoted above.

What the Law Actually Says Today

Until SB 690 (or any bill) is signed, the current, unamended CIPA controls every pending and future case.

Section 638.51 currently bars installing or using a pen register or trap-and-trace device without first obtaining a court order under Sections 638.52 or 638.53, subject to exceptions for communication service providers performing routine operational, protective, or fraud-prevention functions, or acting with user consent. A violation is a crime, punishable by a fine, by county jail time, or by imprisonment under Penal Code Section 1170(h), and, separately, remains civilly actionable today under Section 637.2 by anyone the conduct injured, without the Attorney-General limitation SB 690 would add.

Section 631 is CIPA's wiretapping provision. It makes it a crime to tap a telephone or telegraph line, or otherwise intentionally intercept the contents of a communication in transit, without authorization, and separately bars using or disclosing information obtained that way.

Section 632 is CIPA's eavesdropping provision, and it is the section most often cited alongside 638.51 in these lawsuits. It prohibits intentionally recording or eavesdropping on a "confidential communication" using an electronic recording or amplifying device, without the consent of all parties. California's two-party (all-party) consent rule is why the state's recording law is stricter than the federal one-party standard; this site's California recording law overview covers how that consent requirement applies to calls and in-person conversations. Section 637.2 today lets an injured party sue for a violation of any of these sections, including 632, without the narrower routing SB 690 would impose only on 638.51 website and app claims.

None of these sections has been amended by SB 690 as enrolled. Businesses operating a California-facing website today remain subject to Section 638.51 exposure, including private lawsuits, exactly as the statute currently reads, alongside California's broader privacy framework covered in this site's overview of California's data privacy laws.

What Happens Next

SB 690's next step is action by the Governor, and the California Constitution sets a specific clock for it. Because SB 690 was passed by the Legislature before September 1, 2026, Article IV, Section 10(b)(2) of the California Constitution applies: a bill passed before September 1 of the second year of a two-year legislative session, and in the Governor's possession on or after September 1 of that year, "becomes a statute" automatically if the Governor does not return it by September 30 of that year. In practice, that means the Governor must sign or veto SB 690 by September 30, 2026, or it becomes law without a signature.

The trigger event that converts this story from "pending" to "enacted" is therefore one of three official actions: the Governor signing the bill, the Governor vetoing it (which sends it back to the Legislature, where a two-thirds vote in each house could override the veto), or the September 30, 2026 deadline passing without a return. Any of the three will generate a new entry in the Legislature's own bill history log, which is the authoritative record this article relied on.

If SB 690 is enacted, either by signature or by the Governor taking no action, its effective date is separately governed by Article IV, Section 8(c)(1) of the California Constitution, which provides that a statute enacted at a regular session goes into effect on "January 1 next following a 90-day period from the date of enactment," unless the bill carries an urgency clause taking effect immediately. The enrolled SB 690 text contains no urgency clause. Under that rule, an SB 690 enacted in September 2026 would take effect January 1, 2027, not immediately.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

SB 690 is narrowly drafted. It does not repeal Section 638.51, redefine what a pen register or trap-and-trace device is, or create a new exemption for analytics, chat, or session-replay tools as such. What it does is move enforcement of one specific claim, a private-actor 638.51 violation tied to a website, online application, or mobile application, out of private plaintiffs' hands and into the Attorney General's. That is a venue-and-plaintiff change, not a substantive redefinition of what conduct is lawful.

The retroactivity clause in subdivision (d)(2) is the provision doing the most work for businesses currently facing suit. By its own terms it reaches "any pending claim in an action commenced within two years before the operative date" of the bill, which is why the wave of website-analytics CIPA suits, including the pattern behind cases like the one covered in this site's reporting on a CIPA vexatious-litigant ruling, has been watched closely as SB 690 moved through the Legislature. Whether and how a court applies that retroactivity language to a specific pending case is a legal question this article does not resolve; the bill's text is quoted above so readers can evaluate it directly.

It is also worth being precise about what SB 690 leaves untouched. Sections 631 and 632, the core wiretapping and eavesdropping provisions that anchor most consumer-recording claims in California, are unamended. A business's obligations around cookie banners, consent disclosures, and other privacy-facing tools, the kind covered in this site's overview of cookie banner requirements, are governed by separate statutes and are not affected by this bill.

How This Affects You

If you operate a website or app that serves California visitors, SB 690's status today changes nothing about your compliance obligations. Section 638.51, Section 631, and Section 632 all remain in force exactly as written, and Section 637.2's current private right of action still applies to all of them, including 638.51, until an amendment actually takes effect. Treat any claim that CIPA "now" exempts website tools, or that private CIPA suits over 638.51 are "banned," as premature until this bill is signed, vetoed, or allowed to become law by the constitutional deadline described above.

If you are involved in a pending CIPA lawsuit as a plaintiff or defendant, the retroactivity language in SB 690's subdivision (d)(2) may eventually be relevant to your matter, but only once the bill has actually been enacted and taken effect. This article describes the bill's text; it does not evaluate any individual claim.

This is general legal information about the status of pending legislation, not an assessment of any specific case, and it is not a substitute for advice from a licensed California attorney about your particular situation.

This article provides general legal information about the status of pending California legislation. It is not legal advice and does not address any specific case or claim. Laws and bill status can change; this article reflects the official Legislature record as verified on September 2, 2026. Consult a licensed California attorney for advice about a specific situation.

Related articles

• California recording laws overview
• California recording laws for phone calls
• California data privacy laws
• California CIPA vexatious litigant case
• Otter.ai notetaker wiretap class action
• Cookie banner requirements

Last updated: 2026-09-02. This is a developing story; details verified as of 2026-09-02.