SB 690 Signed Into Law: What the California CIPA Change Does
Independently fact-checked against primary sources (last audited September 2, 2026). · 8 primary sources cited on this page. How we verify our legal content
California's CIPA Pen-Register Bill SB 690 Is Now Law: What It Changes
California Senate Bill 690, which limits who can sue businesses under the state's pen-register and trap-and-trace privacy law, was approved by the Governor on September 30, 2026 and chaptered by the Secretary of State the same day as Chapter 976, Statutes of 2026. It is now law, and it takes effect January 1, 2027. Our fuller report on the signing is at SB 690 signed: private CIPA pen-register suits barred.
Information last verified on October 1, 2026.
Update, October 1, 2026: The Governor signed SB 690 on September 30, 2026 and the Secretary of State chaptered it the same day as Chapter 976, Statutes of 2026. This article has been updated from its original September 7, 2026 version, which reported the bill as pending before the Governor.
Status: Signed by the Governor and chaptered as Chapter 976, Statutes of 2026 on September 30, 2026; operative January 1, 2027. The Legislature's bill history log for SB 690 records "09/30/26 Approved by the Governor." followed by "09/30/26 Chaptered by Secretary of State. Chapter 976, Statutes of 2026." The bill had passed both houses on August 28, 2026, when the Senate concurred in the Assembly's amendments (Ayes 39, Noes 0), and it was enrolled and presented to the Governor at 2 p.m. on September 4, 2026. SB 690 is now law. The chaptered text carries no urgency clause and the Legislative Counsel's Digest records it as a majority-vote measure, so under article IV, section 8(c)(1) of the California Constitution the amendment to Penal Code Section 637.2 takes effect January 1, 2027 rather than on the date of signature.
Jurisdiction: California state law only, specifically the California Invasion of Privacy Act (Penal Code Sections 630 through 638.53). This article does not address federal wiretap law, other states' recording or privacy statutes, or non-CIPA theories used in the same lawsuits.
What Happened
SB 690, titled "Crimes: invasion of privacy" and introduced by Sen. Anna Caballero (coauthored by Senators Niello and Valladares and Assembly Members Irwin, Macedo, and Blanca Rubio), was introduced February 21, 2025. It was amended in the Senate three times before its first passage, then passed the Senate on June 3, 2025 by a vote of 35 to 0 and moved to the Assembly.
The bill sat with limited movement through most of 2025 and into 2026, then advanced through the Assembly Privacy and Consumer Protection Committee and the Appropriations Committee, where it was amended again on July 2, 2026 and placed on the suspense file August 5, 2026. The Assembly Appropriations Committee passed it 15 to 0 on August 13, 2026, and it moved to third reading.
The Assembly passed SB 690 and ordered it to the Senate on August 28, 2026. The Senate then took up the Assembly's amendments the same day: it went into concurrence status, and the full Senate concurred in the Assembly amendments by a vote of 39 to 0. The bill was then ordered to engrossing and enrolling. The Legislature's bill-text system lists the resulting print as the "Enrolled" version, dated August 31, 2026.
The action log has since closed out. On September 4, 2026 the Legislature's history record for SB 690 added the entry "Enrolled and presented to the Governor at 2 p.m." On September 30, 2026 it added two more: "Approved by the Governor." and "Chaptered by Secretary of State. Chapter 976, Statutes of 2026."
The bill's target is a specific litigation pattern. CIPA's pen-register and trap-and-trace provision, Penal Code Section 638.51, was written for telephone-era surveillance devices but has been read by plaintiffs' firms to reach website analytics scripts, live-chat widgets, and session-replay tools that log visitor identifiers or behavior without a court order. That theory has driven a wave of class actions against ordinary websites, a pattern this site has covered in reporting on a vexatious CIPA litigant's case and on a suit targeting an AI meeting notetaker over its use of similar recording and transcription technology.
What SB 690 Changes
SB 690 amends exactly one statute: Penal Code Section 637.2, CIPA's private civil-action and damages provision. It does not touch Section 638.51's underlying prohibition on installing or using a pen register or trap and trace device without a court order, and it does not touch Sections 631 or 632.
The enrolled bill text adds a new subdivision (d) to Section 637.2, reading in relevant part:
"(d) (1) An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General."
The existing subdivisions (a) through (c), which give an injured person the right to sue for the greater of $5,000 per violation or three times actual damages, and to seek an injunction, remain in place for CIPA claims generally. What changes is narrower: for a Section 638.51 claim specifically, against a private (non-governmental) defendant, arising from website, app, or mobile-app conduct, subdivision (d)(1) removes the private right of action and leaves only the Attorney General able to sue.
A second clause, subdivision (d)(2), addresses pending cases directly:
"(2) The amendments to this section by Senate Bill No. 690 of the 2025-26 Regular Session apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation."
The bill's existing subdivision (d), which states that Section 637.2 does not affect a separate Civil Code provision, is renumbered to subdivision (e) without substantive change. The bill also declares its provisions severable, meaning that if a court strikes one part, the rest is written to survive independently. The Legislative Counsel's Digest, which summarizes the bill for lawmakers, describes the change the same way: existing law lets an injured person sue for a pen-register violation, and "this bill would instead authorize only the Attorney General to bring that action" for the website-and-app subset of claims described above. Nothing in the enrolled text defines or references a "commercial business purpose" exception; the operative mechanism is the Attorney-General-only carve-out quoted above.
What the Law Actually Says Today
Until the SB 690 amendment takes effect on January 1, 2027, the current, unamended CIPA controls every pending and future case.
Section 638.51 currently bars installing or using a pen register or trap-and-trace device without first obtaining a court order under Sections 638.52 or 638.53, subject to exceptions for communication service providers performing routine operational, protective, or fraud-prevention functions, or acting with user consent. A violation is a crime, punishable by a fine, by county jail time, or by imprisonment under Penal Code Section 1170(h), and, separately, remains civilly actionable today under Section 637.2 by anyone the conduct injured, without the Attorney-General limitation SB 690 adds on January 1, 2027.
Section 631 is CIPA's wiretapping provision. It makes it a crime to tap a telephone or telegraph line, or otherwise intentionally intercept the contents of a communication in transit, without authorization, and separately bars using or disclosing information obtained that way.
Section 632 is CIPA's eavesdropping provision, and it is the section most often cited alongside 638.51 in these lawsuits. It prohibits intentionally recording or eavesdropping on a "confidential communication" using an electronic recording or amplifying device, without the consent of all parties. California's two-party (all-party) consent rule is why the state's recording law is stricter than the federal one-party standard; this site's California recording law overview covers how that consent requirement applies to calls and in-person conversations. Section 637.2 today lets an injured party sue for a violation of any of these sections, including 632, and SB 690's narrower routing reaches only 638.51 website and app claims.
None of these sections has been amended by SB 690 as chaptered. Businesses operating a California-facing website today remain subject to Section 638.51 exposure, including private lawsuits, exactly as the statute currently reads, alongside California's broader privacy framework covered in this site's overview of California's data privacy laws.
What Happens Next
The Governor acted on the last day of his constitutional window. Because SB 690 was passed by the Legislature before September 1, 2026, Article IV, Section 10(b)(2) of the California Constitution applied: a bill passed before September 1 of the second year of a two-year legislative session, and in the Governor's possession on or after September 1 of that year, "becomes a statute" automatically if the Governor does not return it by September 30 of that year. He signed SB 690 on September 30, 2026 instead, and the Secretary of State assigned it Chapter 976, Statutes of 2026 the same day, so the automatic-enactment path never came into play.
The official record of that is two lines in the Legislature's own bill history log, "Approved by the Governor." and "Chaptered by Secretary of State. Chapter 976, Statutes of 2026.", both dated September 30, 2026. The chapter number is the stable identifier for the enacted text.
What remains is the operative date, which is governed by Article IV, Section 8(c)(1) of the California Constitution: a statute enacted at a regular session goes into effect on "January 1 next following a 90-day period from the date of enactment," unless the bill carries an urgency clause taking effect immediately. The chaptered SB 690 text contains no urgency clause, and its Legislative Counsel's Digest records it as a majority-vote measure. Under that rule, SB 690 takes effect January 1, 2027, not on the date it was signed.
Analysis: Why This Matters
The following is analysis from the Recording Law Editorial Team.
SB 690 is narrowly drafted. It does not repeal Section 638.51, redefine what a pen register or trap-and-trace device is, or create a new exemption for analytics, chat, or session-replay tools as such. What it does is move enforcement of one specific claim, a private-actor 638.51 violation tied to a website, online application, or mobile application, out of private plaintiffs' hands and into the Attorney General's. That is a venue-and-plaintiff change, not a substantive redefinition of what conduct is lawful.
The retroactivity clause in subdivision (d)(2) is the provision doing the most work for businesses currently facing suit. By its own terms it reaches "any pending claim in an action commenced within two years before the operative date" of the bill, which is why the wave of website-analytics CIPA suits, including the pattern behind cases like the one covered in this site's reporting on a CIPA vexatious-litigant ruling, has been watched closely as SB 690 moved through the Legislature. Whether and how a court applies that retroactivity language to a specific pending case is a legal question this article does not resolve; the bill's text is quoted above so readers can evaluate it directly.
It is also worth being precise about what SB 690 leaves untouched. Sections 631 and 632, the core wiretapping and eavesdropping provisions that anchor most consumer-recording claims in California, are unamended. A business's obligations around cookie banners, consent disclosures, and other privacy-facing tools, the kind covered in this site's overview of cookie banner requirements, are governed by separate statutes and are not affected by this bill.
How This Affects You
If you operate a website or app that serves California visitors, the signing of SB 690 changes nothing about your compliance obligations before January 1, 2027. Section 638.51, Section 631, and Section 632 all remain in force exactly as written, and Section 637.2's current private right of action still applies to all of them, including 638.51, until the amendment takes effect. Treat any claim that CIPA "now" exempts website tools as wrong on two counts: SB 690 exempts no tool and makes no conduct lawful, and the plaintiff-routing change it does make is not operative until January 1, 2027.
If you are involved in a pending CIPA lawsuit as a plaintiff or defendant, the retroactivity language in SB 690's subdivision (d)(2) may be relevant to your matter once the amendment takes effect on January 1, 2027. This article describes the statutory text; it does not evaluate any individual claim.
This is general legal information about a newly enacted statute, not an assessment of any specific case, and it is not a substitute for advice from a licensed California attorney about your particular situation.
This article provides general legal information about a newly enacted California statute. It is not legal advice and does not address any specific case or claim. Laws and bill status can change; this article reflects the official Legislature record as verified on October 1, 2026. Consult a licensed California attorney for advice about a specific situation.
Related articles
- California recording laws overview
- California recording laws for phone calls
- California data privacy laws
- California CIPA vexatious litigant case
- Otter.ai notetaker wiretap class action
- Cookie banner requirements
Last updated: 2026-10-01. This is a developing story; details verified as of 2026-10-01.
Frequently Asked Questions
Is SB 690 California law yet?
Yes. The Governor approved SB 690 on September 30, 2026 and the Secretary of State chaptered it the same day as Chapter 976, Statutes of 2026. Because the bill carries no urgency clause, the amendment to Penal Code Section 637.2 takes effect January 1, 2027 rather than immediately.
What does SB 690 actually change?
SB 690 amends only Penal Code Section 637.2, CIPA's civil-remedies statute. It adds a subdivision providing that a private plaintiff can no longer sue a private actor for a Section 638.51 pen-register or trap-and-trace violation arising from conduct on a website, online application, or mobile application; only the California Attorney General may bring that specific claim. It does not change Section 638.51's underlying prohibition, or Sections 631 or 632.
Does SB 690 apply to pending lawsuits?
The bill's text states that its amendments 'apply retroactively to any pending claim in an action commenced within two years before the operative date' of the bill. That provision takes effect with the rest of the amendment on January 1, 2027.
When did the Governor act on SB 690?
On September 30, 2026, the last day of the window Article IV, Section 10(b)(2) of the California Constitution gave him for a bill passed before September 1 and held on or after September 1. The bill history records 'Approved by the Governor.' and 'Chaptered by Secretary of State. Chapter 976, Statutes of 2026.' both dated September 30, 2026.
When does SB 690 take effect?
January 1, 2027. The chaptered bill carries no urgency clause, so under Article IV, Section 8(c)(1) of the California Constitution it goes into effect on January 1 next following a 90-day period from the date of enactment, rather than on the day it was signed.
Updates
Independently fact-checked against the cited primary sources
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
California Penal Code
§ 631In forcecited in 13 of our articles
(a) Any person who, by means of any machine, instrument, or contrivance, or in any other manner, intentionally taps, or makes any unauthorized connection, whether physically, electrically, acoustically, inductively, or otherwise, with any telegraph or telephone wire, line, cable, or instrument, including the wire, line, cable, or instrument of any internal telephonic communication system, or who willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or who uses, or attempts to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained, or who aids, agrees with, employs, or conspires with any person or persons to unlawfully do, or permit, or cause to be done any of the acts or things mentioned above in this section, is punishable by a fine not exceeding two thousand five hundred dollars ($2,500), or by imprisonment in the county jail not exceeding one year,…
Official text (excerpt) · last checked 2026-09-16 · Read the full text in our law library · Verify at leginfo.legislature.ca.gov
Cited in 202 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Ribas v. Clark (California Supreme Court 1985, 38 Cal. 3d 355)“…iminal statutes prohibiting various forms of eavesdropping (Pen. Code, §§ 631, subd. (a), and 637), as well as for in…”
- Warden v. Kahn (California Court of Appeal 1979, 99 Cal. App. 3d 805)“…not to be found elsewhere among the states of the nation. Penal Code section 631 provides: "Any person who, by means of…”
- Rogers v. Ulrich (California Court of Appeal 1975, 52 Cal. App. 3d 894)“…nowledge the incident amounted to wiretapping as defined by Penal Code section 631; a statutory penalty in the amount of $…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Serial CIPA Website-Wiretap Filer Declared a Vexatious Litigant, California Pixel-Wiretap Rulings Split the Same Week: Blue Shield Claim Dismissed, BlueChew Claims Advance, Otter.ai Faces Consolidated Wiretap Class Action Over Its AI Meeting Notetaker and All-Party Consent
§ 632In forcecited in 55 of our articles
(a) A person who, intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication, whether the communication is carried on among the parties in the presence of one another or by means of a telegraph, telephone, or other device, except a radio, shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500) per violation, or imprisonment in a county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment. If the person has previously been convicted of a violation of this section or Section 631, 632.5, 632.6, 632.7, or 636, the person shall be punished by a fine not exceeding ten thousand dollars ($10,000) per violation, by imprisonment in a county jail not exceeding one year, or in the state prison, or by both that fine and imprisonment.
Official text (excerpt) · last checked 2026-09-23 · Read the full text in our law library · Verify at leginfo.legislature.ca.gov
Cited in 267 court opinions in our collectionLatest citing opinion in our collection: 2026
In the courts (editorial summary, independently checked):Kimmel v. Goland (1990) held the section 47(2) litigation privilege does not bar a damages claim under Section 632 for recording confidential conversations without consent. Lieberman v. KCOP Television, Inc. (2003) held a Section 632 violation is complete the moment the recording is made, whether or not it is disclosed.
Opinions citing this section in our collection:
- Rubin v. Green (California Supreme Court 1993, 4 Cal. 4th 1187)“…f telephone conversations with defendants, an offense under Penal Code section 632. We noted that defendants alleged that…”
- Kimmel v. Goland (California Supreme Court 1990, 51 Cal. 3d 202)✓Mobilehome owners secretly taped phone calls with park management in anticipation of suing; the court held the section 47(2) litigation privilege did not bar the cross-complaint for damages under Penal Code section 632, since the injury came from recording, not publication.
- Shulman v. Group W Productions, Inc. (California Supreme Court 1998, 74 Cal. Rptr. 2d 843)✓A TV producer put a wireless microphone on the flight nurse treating a crash victim. No section 632 claim was before the court, but it called section 632 and the intrusion tort laws of general applicability and said the press may not eavesdrop in violation of section 632.
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: California Recording Laws (2026): All-Party Consent Rules, US Recording Laws by State (2026): All 50 States Explained, Can an Employer Record Conversations Without Consent? (2026)
§ 637.2In forcecited in 24 of our articles
(a) Any person who has been injured by a violation of this chapter may bring an action against the person who committed the violation for the greater of the following amounts: (1) Five thousand dollars ($5,000) per violation. (2) Three times the amount of actual damages, if any, sustained by the plaintiff. (b) Any person may, in accordance with Chapter 3 (commencing with Section 525) of Title 7 of Part 2 of the Code of Civil Procedure, bring an action to enjoin and restrain any violation of this chapter, and may in the same action seek damages as provided by subdivision (a). (c) It is not a necessary prerequisite to an action pursuant to this section that the plaintiff has suffered, or be threatened with, actual damages. (d) This section shall not be construed to affect Title 4 (commencing with Section 3425.1) of Part 1 of Division 4 of the Civil Code.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at leginfo.legislature.ca.gov
Cited in 103 court opinions in our collectionLatest citing opinion in our collection: 2026
In the courts (editorial summary, independently checked):Ribas v. Clark (1985) held the section 637.2 award accrues at the moment of the Privacy Act violation, so the Civil Code section 47 litigation privilege does not bar it, though damages flowing solely from privileged testimony fail. Kimmel v. Goland (1990) applied that reasoning to recordings made in anticipation of litigation.
Opinions citing this section in our collection:
- Rubin v. Green (California Supreme Court 1993, 4 Cal. 4th 1187)“…asion of privacy and related torts as well as damages under Penal Code section 637.2, granting persons injured by eavesdropp…”
- Ribas v. Clark (California Supreme Court 1985, 38 Cal. 3d 355)✓A wife asked a third party to listen on an extension phone while she called her husband, and that listener later testified about it; the court held the judicial privilege barred damages from the testimony but not Section 637.2's fixed award, which accrues at the violation.
- Kimmel v. Goland (California Supreme Court 1990, 51 Cal. 3d 202)✓Mobilehome residents secretly taped calls with park management to gather evidence for a planned lawsuit; the court held the litigation privilege did not bar management's Section 637.2 claim, because the injury came from the recording itself and not from any publication.
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Can I Sue Someone for Recording Me on Private or Public Property?, How to Detect and Block Listening Devices in Your Home (2026), Is It Illegal to Video Record Someone Without Their Consent? (2026)
§ 638.51In forcecited in 3 of our articles
(a) Except as provided in subdivision (b), a person may not install or use a pen register or a trap and trace device without first obtaining a court order pursuant to Section 638.52 or 638.53. (b) A provider of electronic or wire communication service may use a pen register or a trap and trace device for any of the following purposes: (1) To operate, maintain, and test a wire or electronic communication service. (2) To protect the rights or property of the provider. (3) To protect users of the service from abuse of service or unlawful use of service. (4) To record the fact that a wire or electronic communication was initiated or completed to protect the provider, another provider furnishing service toward the completion of the wire communication, or a user of that service, from fraudulent, unlawful, or abusive use of service. (5) If the consent of the user of that service has been obtained. (c) A violation of this section is punishable by a fine not exceeding two thousand five hundred dollars ($2,500), or by imprisonment in the county jail not exceeding one year, or by imprisonment pursuant to subdivision (h) of Section 1170, or by both that fine and imprisonment.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at leginfo.legislature.ca.gov
Cited in 25 court opinions in our collectionLatest citing opinion in our collection: 2025
Opinions citing this section in our collection:
- Fregosa v. Mashable Inc. (District Court, N.D. California 2025)“…a court order as required by CIPA. Id. ¶¶ 49– 5 56; see Cal. Penal Code § 638.51(a) (“[A] person may not install or use…”
- Garon v. Keleops USA, Inc. (District Court, N.D. California 2025)“…he California Invasion of Privacy Act (“CIPA”), Cal. 16 Penal Code § 638.51(a). Keleops now moves to dismiss the F…”
- Gabrielli v. Haleon US Inc. (District Court, N.D. California 2025)“…631; (4) use of a pen register in violation of 25 CIPA, Cal. Pen. Code § 638.51; (5) common law fraud; (6) unjust enric…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: CIPA: California Invasion of Privacy Act Explained, Five California Privacy Bills: Four Signed Into Law, One Vetoed
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- SB 690 (2025-2026) full enrolled bill text, Penal Code Section 637.2 amendment(leginfo.legislature.ca.gov).gov
- SB 690 (2025-2026) complete bill history and action log, recording 'Approved by the Governor.' and 'Chaptered by Secretary of State. Chapter 976, Statutes of 2026.' both dated 09/30/26(leginfo.legislature.ca.gov).gov
- SB 690 (2025-2026) current bill status(leginfo.legislature.ca.gov).gov
- California Penal Code Section 638.51 (pen register / trap and trace), current text(leginfo.legislature.ca.gov).gov
- California Penal Code Section 637.2 (CIPA civil remedies), current text(leginfo.legislature.ca.gov).gov
- California Penal Code Section 631 (wiretapping), current text(leginfo.legislature.ca.gov).gov
- California Penal Code Section 632 (eavesdropping on confidential communications), current text(leginfo.legislature.ca.gov).gov
- California Constitution, Article IV, Sections 8 and 10 (bill effective dates; Governor's action deadlines)(leginfo.legislature.ca.gov).gov