Direct Answer: SB 690 removes the private right of action for pen register claims under CIPA involving website or mobile app tracking, leaving enforcement to the Attorney General. If signed, it takes effect January 1, 2027.
A law office in Monterey gets a letter from a firm in Los Angeles. It claims the chat widget on their website is an illegal tracking device under California law, and it wants money to make the problem go away.
That scenario has played out across California for the last few years, and plenty of small businesses on the Central Coast have been caught by it. Most of them never chose the tracking tools by name. A web designer installed Google Analytics, a Meta ad pixel, and a chat box years ago, and nobody looked again.
California SB 690 could shut down a big chunk of that litigation starting January 1, 2027. But it does not close every door, and the parts it leaves open are the parts most local businesses have never checked.
What SB 690 actually does, and the dates that matter
On August 28, 2026, the California Legislature passed SB 690 unanimously. The bill eliminates the private right of action for pen register claims under the California Invasion of Privacy Act (CIPA) when the violation arises from website or mobile app tracking technologies, leaving enforcement solely to the Attorney General.
In plain English: private plaintiffs and their lawyers lose the ability to sue your business over that specific theory. The state can still enforce it.
Here are the dates to write down:
- August 28, 2026 – the Legislature passed the bill
- September 30, 2026 – the deadline for Governor Newsom to sign or veto
- January 1, 2027 – the operative date if it is signed
- Retroactive reach – the bill applies retroactively to claims filed after January 1, 2025, described elsewhere as pending claims filed within two years before the bill’s operative date
The legal analysis behind these details comes from law firm commentary published by The Legal 500 in September 2026 and by Venable LLP. We are an IT company, not a law firm, so treat this article as background for a conversation with your attorney, not as legal advice.
The practical read for a 40 person business in Salinas or Watsonville is simple. The demand letter risk tied to analytics and ad pixels may narrow sharply, and the cost of that narrowing is zero for you. You do not have to file anything.
What SB 690 does not touch
This is where businesses will get into trouble if they read the headline and stop.
SB 690 does not limit claims under California’s wiretap statute (Penal Code 631) or the call recording statute (Penal Code 632). Those remain fully available to private plaintiffs.
That matters more than it sounds for local operations:
- VoIP call recording. If your phone system records calls for training or quality review, your consent notice and recording settings are still squarely in scope.
- Session replay and chat transcripts. Plaintiffs have pushed wiretap theories at these tools, not only pen register theories.
- CCPA duties are unchanged. Your privacy policy, opt out link, and data sale and sharing disclosures still apply.
The same end of session package also sent CCPA amendment bills (SB 923 and AB 1542) plus data broker and AI bills forward, so the broader California privacy picture is still moving.
The Attorney General’s office remains the enforcement authority here, and the state publishes plain language guidance on consumer privacy obligations at the California Attorney General’s privacy page. Worth a bookmark for whoever owns compliance at your company.
Covered, not covered: a quick reference
Here is how the main claim types line up if SB 690 is signed. Confirm anything specific to your situation with counsel.
| Claim type | Private lawsuits after January 1, 2027 | What it means for your website or phones |
|---|---|---|
| CIPA pen register / trap and trace, from website or app tracking tech | Removed; Attorney General enforcement only | Analytics, ad pixels, and similar tracking claims lose their main private hook |
| Wiretap (Penal Code 631) | Still available to private plaintiffs | Session replay, chat transcripts, and third party script data flows still need review |
| Call recording (Penal Code 632) | Still available to private plaintiffs | VoIP recording consent notices and settings stay in scope |
| CCPA obligations | Unchanged by SB 690 | Privacy policy, opt out, and vendor data sharing terms still apply |
The SB 690 timeline at a glance
Four dates decide whether this bill changes anything for your business, and what window it reaches back into.
The audit most Monterey County businesses still need to do
Almost every business we talk to on the Peninsula and in the Salinas Valley has the same underlying problem. Nobody currently at the company knows everything that is running on the company website.
We saw a version of this last summer with a small inn on the coast. The person who had managed their wireless network was no longer available, they had the login to the equipment, and no one on staff knew what had been configured or why. Website scripts are the same story with worse legal consequences.
Before January 1, 2027, walk through this list with whoever manages your site:
- Inventory every third party script. Open your tag manager and list what fires on each page. Analytics, ad pixels, heat mapping, chat, booking engines, review widgets.
- Find the orphans. Old pixels from a marketing agency you stopped using three years ago still collect and send data.
- Check your consent banner behavior. Many banners display a notice but load every script before the visitor clicks anything.
- Pull your vendor agreements. Know who receives visitor data and what they are allowed to do with it.
- Review call recording settings and notices on your phone system, since those claims are untouched by SB 690.
- Confirm your privacy policy matches reality. A policy that describes tools you no longer use, or omits ones you do, is its own problem.
Budget a few hours of internal time plus whatever your attorney charges for a policy review. Costs vary widely by how many tools you run, and a business with a booking engine and three ad platforms will take longer than a professional office with a contact form.
Why this lands differently on the Central Coast
Most companies here are between 10 and 200 people. There is no general counsel down the hall and no full time IT director watching the marketing stack.
A Monterey hotel runs a booking engine, a chat widget, and retargeting pixels. A Salinas grower runs a customer portal. A law office in Monterey County collects intake forms with personal detail in them. All three have tracking exposure they never consciously chose.
The fix is the same discipline that prevents most technology surprises: know what you are running, know who can access it, and check it on a schedule. That is the same reason we push clients to review firewall rules and what most small businesses get wrong, and the same reason end of support dates like the Windows Server 2016 deadline sneak up on people.
One local client put the value plainly in a review, saying their provider “provides peace of mind with reliable system security.” That peace of mind comes from documentation and regular review, not from luck.
If the Governor vetoes SB 690, none of this audit work is wasted. Current exposure simply continues, and you will be in better shape than the business next door that never looked.
Frequently Asked Questions About California SB 690 and CIPA Website Tracking Claims
Can we remove our cookie banner once SB 690 takes effect?
No. SB 690 addresses pen register claims under CIPA only. Your CCPA obligations are unchanged, and wiretap claims under Penal Code 631 are still available to private plaintiffs. Consent tooling stays.
We already received a demand letter. Does this help us?
Possibly. The bill applies retroactively to claims filed after January 1, 2025, also described as pending claims filed within two years before the operative date. The exact reach in your case is a question for your attorney, not your IT provider.
Does this cover our recorded phone calls?
No. SB 690 specifically does not limit claims under California’s wiretap statute (631) or call recording statute (632). If your VoIP system records calls, review your consent notice and your recording settings this quarter.
Who should handle the website audit, our IT provider or our marketing agency?
Usually both, with your attorney reviewing the output. Marketing knows why a pixel was added. IT can see what is actually installed, where data goes, and which vendors have access. Legal decides what the disclosures need to say.
What happens if the Governor does not sign by September 30, 2026?
The bill does not take effect, and the current CIPA litigation landscape continues as it is. That is a good argument for doing the tracking inventory now rather than waiting on a signature.
Want a clear picture of what is running on your systems?
Most Monterey County businesses find at least one tool they forgot about the first time they inventory their website and phone systems. Our team at Adaptive Information Systems works with organizations across Salinas, Monterey, Watsonville, and Hollister on that kind of documentation and ongoing review. If you would like to talk it through, we are reachable at (831) 644-0300 or adaptiveis.net.
