California law restricts pen-register lawsuits under California’s Invasion of Privacy Act, but litigation risk remains

The new law takes effect on January 1, 2027, and will apply retroactively to claims filed on or after January 1, 2025, effectively extinguishing thousands of pending CIPA pen-register claims. While this is certainly welcome news, risk remains: pen-register and trap-and-trace claims are enforceable by the California attorney general, and a host of other CIPA website-tracking theories remain available to private plaintiffs. 

Background on CIPA and the Impact of SB 690

CIPA is a 1967 telecommunications law originally designed to restrict telephone wiretapping. Enticed by CIPA’s $5,000-per violation statutory damages, plaintiffs’ attorneys have filed thousands of individual and class action complaints over the last few years, asserting CIPA violations based on defendants’ alleged unconsented or undisclosed collection of consumer data through website tracking technology like session replay software, chatbots, analytics pixels or contact forms. Now, under SB 690, only California’s attorney general can enforce these claims when an alleged violation arises from conduct on an internet website, online application or mobile application. 

Significantly, however, SB 690 does not extinguish or narrow CIPA claims based on allegations that a defendant’s use of other website tools allows third-party technology vendors to “intercept” contents of a site user’s communication in real time without consent. Other CIPA claims that remain intact are eavesdropping claims (if a business’ technology systems are able to eavesdrop on or record any confidential communications) and cordless/cellular interceptions if there has been any allegedly unauthorized recording or interception and at least one party is using a mobile phone or other cordless device. The law also does not extinguish claims brought under other CIPA provisions or other privacy, consumer-protection, contract or common-law theories. 

Takeaways

Businesses facing CIPA class actions (or those in receipt of pre-suit demands) can leverage SB 690 as a shield and assess whether these claims allege violations of CIPA’s pen-register provision. That said, although SB 690 limits certain claims, it is not a general safe harbor for digital engagement. Whether CIPA exposure arises from a company’s use of website technology remains a fact-specific determination, and proper disclosures and individuals’ consent are still important strategies to mitigate risk. Accordingly, organizations can regularly take stock of their digital engagement tools across public-facing sites to (i) determine whether accompanying disclosures are presented and (ii) ensure that consent managers are properly working before information is tracked.

Michael Bahar | Partner | +1 202 383 0882 | Email
Francis X. Nolan | Partner | +1 212 389 5083 | Email
Leslie C. Bender | Senior Counsel | +1 202 383 0274 | Email
Gabriel Kohan | Senior Associate | +1 202 383 0337 | Email
Claire E. Scavone | Associate | +1 404 853 8558 | Email