The Conventional Wisdom
Many privacy lawyers are advising clients that if SB 690 passes, concerns about CIPA pen register claims will diminish. The California legislative committee labeled these lawsuits as "abusive," and you might have received demand letters yourself. The reasoning seems straightforward: remove the private right of action, let the Attorney General handle enforcement, and the lawsuit frenzy will end.
Your team might already be adjusting your 2027 budget accordingly. Why invest in website tracking audits or consent infrastructure when the legislation will retroactively apply to claims filed within two years of its operative date? If you're defending a pen register claim, you're likely counting on dismissal once the bill takes effect on January 1, 2027.
Why This View Is Incomplete
This narrative overlooks three critical realities about regulatory enforcement.
First, the Attorney General doesn't need a flood of lawsuits to spot patterns worth investigating. A single well-documented complaint about your session replay tool or analytics pixel can lead to an enforcement action examining your entire digital portfolio. Unlike plaintiff's attorneys seeking statutory damages, the AG's office can demand systemic changes across all your websites and apps. You're trading multiple $5,000 settlements for the risk of a consent decree that restructures your data collection practices.
Second, retroactive application creates a compliance gap, not a shield. The bill applies to claims started within two years before January 1, 2027. This means your tracking practices from 2025 through 2026 remain under scrutiny. If the AG's office inherits a backlog of dismissed claims, they'll have a ready-made list of potential enforcement targets, complete with documentation of alleged violations.
Third, SB 690 leaves CIPA's wiretapping (Section 631) and confidential recording (Section 632) provisions untouched. The Legislature may consider broader solutions for these in the future. Your chat widgets, voice interfaces, and customer service recordings still face litigation risk. Plaintiff's attorneys won't disappear; they'll shift focus to these remaining areas.
The Evidence
The bill's legislative history shows the enforcement dynamics you should prepare for. SB 690 passed the California Senate 35-0 on June 3, 2025, but the Assembly Committee on Privacy and Consumer Protection rejected the original draft as "overly broad." The final version targets only website-based pen register claims.
This precision matters. The committee didn't conclude businesses were compliant and lawsuits frivolous. They found the private enforcement mechanism was causing settlements driven by "staggering" liability rather than proportionate remediation. Businesses settle quickly because exposure is severe, encouraging "vexatious litigants" to continue sending demand letters.
Notice what's preserved: the Attorney General retains full authority to pursue alleged violations and seek remedies. California's AG has shown a willingness to use privacy enforcement strategically. They don't need volume; they need precedent. A single enforcement action against a major platform's session replay could set technical standards affecting your entire industry.
What to Do Instead
Treat SB 690 as a shift in enforcement risk, not a reduction in compliance obligation.
Start by auditing your website and app data collection against pen register claim elements: are you recording or decoding electronic impulses that identify communications? Review your marketing pixels, analytics tags, session replay tools, and heatmapping software. Document what data you're collecting, how you process it, and whether you have adequate notice and consent mechanisms. If the AG's office investigates, you'll need evidence of your compliance efforts during 2025-2026.
Next, assess your remaining CIPA exposure under Sections 631 and 632. Your chat platforms, voice features, and customer service recording practices need the same scrutiny as pen register risks. Plaintiff's counsel with CIPA expertise will redirect their focus to these areas.
Finally, monitor how the Attorney General uses its enforcement authority once SB 690 takes effect. The first six months will reveal their priorities: do they target high-volume consumer complaints, or focus on novel technologies with broad impact? Your 2027 compliance roadmap should adapt based on observed enforcement patterns, not assumed relief.
When the Conventional Wisdom Is Right
The conventional wisdom holds if you're defending a website-based pen register claim filed after January 1, 2025, and SB 690 becomes operative on January 1, 2027. The retroactivity provision should apply to your pending claim, offering relief from immediate litigation exposure.
The conventional wisdom also identifies a real problem. The committee's view of CIPA pen register lawsuits as abusive isn't baseless. When statutory damages create settlement pressure exceeding actual privacy harm, the enforcement mechanism distorts compliance incentives. You might settle a questionable claim rather than spend six figures defending it, which doesn't improve data practices or protect consumers.
But relief from abusive litigation isn't the same as relief from compliance obligations. The conduct triggering those lawsuits remains problematic under California privacy law. The Attorney General's office now holds that enforcement authority exclusively. If you're treating SB 690 as permission to defer privacy investments, you're misreading both the legislation and the enforcement landscape it creates.
The bill still requires Assembly passage, Senate concurrence in any amendments, and the Governor's signature. Even if enacted, your tracking practices from the past two years remain subject to scrutiny. Plan accordingly.
