California SB 690 Ends Private Pen-Register Suits: What Changed for Your Analytics Stack, and What Did Not

Companies running analytics on a consumer-facing site have spent three years receiving demand letters built on a wiretap statute written for telephone equipment. California changed part of that on September 30, 2026, and the part it changed is narrower than the relief headlines suggest.

Knowing which half moved tells you whether to keep the consent banner, the vendor audit, and the retention policy you built last year. The answer is yes, and the reason is one section number.

What SB 690 Actually Does

SB 690 amends Penal Code section 637.2, the provision that creates a private right of action for invasion-of-privacy violations. After the amendment, an action against a private actor for violating section 638.51, the pen register and trap-and-trace provision, “alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.”

Two consequences follow. Private plaintiffs lose standing on website and app pen-register theories. The Attorney General keeps enforcement authority, so the exposure moves from a plaintiff’s bar to a regulator with a different volume and a different motive.

The bill also reaches backward. Its retroactivity clause states that the amendments “apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation.” Pending pen-register claims inside that window lose their private vehicle.

Section 638.51 carried a large share of the demand-letter wave because it required no content interception. A plaintiff argued that a cookie, pixel, or analytics script functioned as a device capturing routing and addressing information, which made ordinary web instrumentation look like telephone surveillance equipment. That theory now belongs to the Attorney General.

What Survives, Which Is Most of It

Other violations under the chapter retain private standing, and section 631, the interception provision, sits among them. Section 631 claims allege that a third party read the contents of a communication in transit, which describes the legal theory behind the pixel, session-replay, chat-widget, and embedded-SDK cases that make up the rest of the docket.

So the practical reading runs like this. A claim framed around capturing who visited and which pages they requested lost its private path. A claim framed around a vendor receiving the contents of what a visitor typed, clicked, or submitted did not.

Nothing in the bill touches the California Consumer Privacy Act and its amendments, the California Privacy Protection Agency’s authority, the Attorney General’s independent enforcement, or any other state’s privacy statute. A company that treated the CIPA wave as its only privacy risk had the wrong model before the amendment and still has it.

The Controls That Keep Earning Their Place

Four pieces of work survive this change intact, because section 631 theories and privacy regulators both target the same behavior: a third party receiving content a visitor typed.

A current inventory of what loads on the page. Tag managers accumulate scripts that nobody owns. The inventory answers a demand letter, a regulator question, and an engineering question about page weight in the same document.

Consent and placement for anything that reads form input or replays a session. Session replay and chat sit closest to the content line. Treat masking of input fields as a configuration requirement rather than a vendor default, and verify it rather than assuming it.

Contract terms describing what each vendor receives. Service-provider and processor terms decide whether a vendor acts for you or for itself, and the distinction shapes both the statutory analysis and the regulatory one.

Attribution you own rather than attribution you rent. A measurement stack that depends on third-party collection to answer a basic revenue question stays fragile to every change of this kind. Our affiliate attribution engineering guide covers building the first-party version, and our state privacy law framework covers the enforcement landscape this amendment leaves standing.

Where the Marketing Stack Meets the Statute

Three categories of tool put content in front of a third party, which makes them the ones to review first.

Chat and support widgets. A widget that transmits what a visitor typed to a vendor in real time sits squarely in section 631 territory. Vendors differ in architecture and in what they retain. Tidio and comparable platforms document data handling and retention controls worth reading before deployment rather than after a letter arrives, and our AI customer support tools guide covers the category on capability.

Email and lifecycle platforms. Open and click tracking attaches identifiers to behavior across sessions, and the data lands in whichever platform sends the message. Campaign Monitor and Transpond both expose tracking and consent settings at the campaign level, which is the right place to make the decision once instead of per send. Our email marketing tools guide covers the selection question.

Ad creative and conversion pipelines. Platforms that generate and test creative also receive conversion signals, and the signal path crosses the boundary. AdCreative.ai handles generation and performance scoring, which leaves the conversion plumbing as your design decision rather than its default.

The common thread: every one of these decisions sits in a configuration screen rather than in a statute, and the statute decides what the configuration costs you when it goes wrong.

What to Do This Quarter

Pull the pending-litigation question first. Counsel reviews any open CIPA matter against the two-year retroactivity window, because a pen-register count inside it now lacks a private plaintiff.

Then separate your script inventory into two lists: scripts that observe navigation, and scripts that can read what a visitor enters. The first list got quieter. The second list did not, and it deserves the consent, masking, and contract work you may have been planning to retire.

Keep the first-party measurement project funded. Relief in one statute is not a strategy, and the next change arrives from a different direction.

Frequently Asked Questions

Does SB 690 end CIPA website litigation? No. It removes private standing for website and app claims under section 638.51. Section 631 interception claims continue.

Can a plaintiff still sue over a tracking pixel? Under an interception theory, yes. Under the pen-register theory, only the Attorney General can bring it.

Does the change reach cases already filed? The retroactivity clause applies to pending claims in actions commenced within two years before the operative date.

Does this affect the California Privacy Protection Agency’s authority? No. Regulatory enforcement under the consumer privacy statutes sits outside this amendment.

Should we remove our consent banner? Not on the strength of this bill. Consent supports the interception analysis and the privacy-statute analysis, both of which survive.

Quotations here come from the amended section as the Legislature wrote it, linked above. A privacy docket moves faster than any article about it, so litigation strategy belongs with counsel who can read your own script inventory. Some vendor links on this page pay a commission, which has no bearing on which section number governs your exposure.