California bill would limit website-tracking lawsuits under the Invasion of Privacy Act
This is a bill, not current law. SB 690 passed the California Legislature on August 28, 2026 and is awaiting action by the Governor. It is not currently an operative requirement. If enacted, it would limit private lawsuits for alleged pen-register or trap-and-trace violations arising from conduct on a website or app, leaving those actions to the Attorney General.
- Official source
- California Legislative Information ↗
- Jurisdiction
- California
- Publication date
- August 28, 2026
- Legacy Core review
- September 2, 2026 · Christopher Green
- Source checked
- September 2, 2026
- Affected sectors
- Accounting and Tax, Medical and Dental, Legal, Financial Services, Insurance, General Professional Services
Summary
This is a bill, not current law. SB 690 passed the California Legislature on August 28, 2026 and is awaiting action by the Governor. It is not currently an operative requirement. If enacted, it would limit private lawsuits for alleged pen-register or trap-and-trace violations arising from conduct on a website or app, leaving those actions to the Attorney General.
Why it matters
Small businesses that use ordinary website tools have been named in California Invasion of Privacy Act claims. Those tools include analytics, pixels, session replay, chat, embedded forms, CRM scripts, and advertising tags. If enacted, this bill would narrow one legal theory used in those suits. It would not, by itself, change CCPA duties or other privacy claims. It is not a general website-tracking safe harbor. Those tools remain privacy and readiness considerations whether or not the bill is signed.
Recommended action
Do not treat the bill as enacted. Read the current text on the California Legislature site, and review with qualified counsel which tracking tools are on your site and what current California law requires.