"This measure addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses that unwittingly install software on their websites..." Gov. Gavin Newsom wrote in his signing statement, summarizing why he backed the bill.
SB 690 and the California Invasion of Privacy Act
A bipartisan update to the California Invasion of Privacy Act (CIPA) has narrowed civil remedies tied to internet-era surveillance. CIPA, first passed in 1967, required a court order for wiretapping, eavesdropping, interception or recording of telephone calls. In 2015 the statute was expanded to cover most internet-based communications and added a provision allowing residents to sue over unauthorized use of certain internet-tracking technologies — with penalties up to $5,000 per violation plus treble damages.
Last week, Gov. Gavin Newsom signed SB 690 into law. The bill, as enacted, removes a private right to sue in the context targeted by the update and narrows the exemption language so that the change applies specifically to pen registers and trap-and-trace devices, according to versions of the legislation described in the public record.
What pen registers and trap-and-trace devices do, and who uses them
The statute change centers on tools long used in law enforcement investigations. The report describes pen registers as devices investigators use to log outgoing metadata — dialed phone numbers, IP addresses and timestamps — while trap-and-trace devices record incoming contacts. Those tools, the story notes, are primarily used by local police, the FBI, the DEA and national security organizations during active criminal and counterintelligence investigations, and are authorized through a court order rather than content interception.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildNumbers, lawsuits and demand letters: the dispute in plain figures
How extensive the private litigation under the 2015 addition has been is a central point of contention. The Alliance for Legal Fairness, a Virginia-based lobbying firm that backed the legislative update, reported roughly 600 lawsuits under the provision in 2025 and told lawmakers that number has “exploded” to more than 4,000 today. Privacy attorneys at Pillsbury, Shruti Bhutani Arora and Christine Mastromonaco, said plaintiffs and prospective litigants have “sent tens of thousands of demand letters to businesses threatening class-action suits under the CIPA’s pen-register and trap-and-trace provisions for using everyday website tools like cookies, analytics software and pixels.”
The California Assembly Committee on Privacy and Consumer Protection labeled the pen register provision “the poster child for abusive lawsuits,” saying plaintiffs’ attorneys have exploited it at scale to target businesses using third-party advertising software. The committee report added that because potential liability can be “staggering,” businesses generally settle quickly, which in turn encourages more demand letters.
Supporters, opponents, and their arguments
Business and labor groups split predictably. The law received widespread support from business organizations; the Chamber of Commerce was one of hundreds of California groups that signed in support. Backers framed the update as protection for small businesses from an outdated statute that courts and plaintiffs' lawyers have weaponized.
Opposition came from major California labor unions and a coalition of privacy and civil-rights organizations, including the American Civil Liberties Union, the Consumer Federation of California, the Privacy Rights Clearinghouse and the Electronic Privacy Information Center. The Electronic Frontier Foundation, which fought the bill for years, criticized the signing. Hayley Tsukayama, director of state affairs at EFF, said the bill “never should have been signed” and argued that it “harms privacy by making it impossible for ordinary people to sue companies engaged in unlawful metadata surveillance.”
Attorneys at Kelley Drye offered a different view of the 2015 change, telling lawmakers that the pen-register and trap-and-trace language had been intended to clarify how law-enforcement agencies could obtain court orders for phone metadata without violating CIPA — a technical, procedural purpose rather than an invitation to wide private litigation, according to their account.
How small businesses, privacy advocates, and law enforcement are positioned
- Small businesses: Gov. Newsom and bill sponsors say the law protects small businesses from “overzealous lawsuits” and settlement demands tied to common website tools; proponents argue the change curbs vexatious claims that extract settlements from firms that “unwittingly install software.”
- Privacy advocates and civil-rights groups: Organizations including EFF and the ACLU view the exemption as a rollback of individual enforcement power, warning it will make it harder for ordinary people to sue companies over metadata surveillance and could ease pathways for companies to collect and sell consumer data.
- Law enforcement and national-security entities: The statutory language and earlier commentary frame pen registers and trap-and-trace tools as established investigative techniques used under court order by police, federal agencies and national-security organizations during active investigations.
California already has a prominent state privacy architecture: the report notes the state created the California Privacy Protection Agency in 2018 and enforces some of the nation’s strictest data-broker rules, including registration and universal opt-out obligations. The clash over SB 690 narrows one route for private plaintiffs while leaving intact a broader landscape of consumer-facing privacy rules enforced by regulators and other laws.
The result is a sharply drawn trade-off: backers say the law reduces costly, abusive litigation that ensnares small businesses; critics say it removes a direct legal remedy for consumers and weakens private enforcement of digital privacy limits. Which of those outcomes will dominate in practice is the central tension set to shape California’s privacy environment in the months ahead.
Source: CyberScoop — Wiretapping change sparks big privacy fight in the Golden State
