Before the new act, businesses throughout the state were subjected to lawsuits citing violations of CIPA. The act was passed in 1967 to criminalize wiretapping, but has been expanded over the years to include digital privacy concerns. 

As reported by Capradio earlier this year, among the businesses that were sued was Folsom Lake Heating & Air in Granite Bay, California. The lawsuit sought to issue a $5,000 fine per visit to the company website — not the number of visitors, but all visits. 

“We’re not IT people. It’s totally out of our spectrum of things that we know about,” Tami Goldsmith, co-owner of Folsom Lake Heating & Air, told Capradio. 

Plaintiffs have reaped five-figure settlements from businesses, and not just those in California. According to Alexandra Samofalova, a senior associate with law firm Spencer Fane, CIPA’s protection follows the California resident, not the business. When a California resident visits a site and tracking technology captures that visit, the statute attaches to the California-side communication, regardless of where the business is located. 

Most websites trigger CIPA claims, from chat functions to tracking pixels and tools like Google Analytics, Meta Pixel, and HubSpot. 

Looking for quick answers on air conditioning, heating and refrigeration topics? Try Ask ACHR NEWS, our new smart AI search tool. Ask ACHR NEWS

“Any business operating a website should assume CIPA exposure,” Samofalova wrote. “Disclaiming California intent in the privacy policy or terms of service is not a defense to a claim.” 

As such, a wave of lawsuits has been filed related to CIPA violations. More than 800 claims were filed in 2025, and pen register and trap-and-trace claims made up about two-thirds of active California privacy litigation as of July 2026. It’s to the point where individuals send pre-litigation packets to companies across the country that are engineered to look like ready-to-be-filed lawsuits. 

Trent Cotney, partner at Adams & Reese LLP, said SB 690 eliminates private lawsuits under CIPA’s pen register and trap-and-trace provision for website and app activity. The legislation dictates that, instead of private lawsuits, any violations related to section 638.51 must be brought forth by the Attorney General. 

The amendment takes effect Jan. 1, 2027, and will be applied retroactively to pending claims filed within two years before that date. For example, a trap-and-trace claim filed in 2025 or 2026 that is pending as of Jan. 1, 2027, is covered by the amendment. 

As Cotney noted, SB 690 doesn’t eliminate exposure to other portions of CIPA, such as those dealing with wiretapping and communication interception. 

“SB 690 significantly reduces one major source of these lawsuits, but it does not eliminate website privacy exposure,” Cotney said. 

With the change, law experts believe demand letters will shift their emphasis to section 631, where consent and party-exception defenses are still in play. 

“For contractors, I would still recommend a basic website privacy audit: identify all third-party tracking tools, make sure the privacy policy accurately discloses them, review consent practices, and periodically confirm what website and marketing vendors have installed,” Cotney said.