California bill would limit website-tracking lawsuits under the Invasion of Privacy Act
This is a bill, not current law. SB 690 passed the California Legislature on August 28, 2026 and is awaiting action by the Governor. It is not currently an operative compliance requirement. If enacted, it would limit private lawsuits for alleged pen-register or trap-and-trace violations arising from conduct on a website or app, leaving those actions to the Attorney General.
- Official source
- California Legislative Information ↗
- Jurisdiction
- California
- Publication date
- August 28, 2026
- Legacy Core review
- September 2, 2026 · Christopher Green
- Source checked
- September 2, 2026
- Affected sectors
- Accounting and Tax, Medical and Dental, Legal, Financial Services, Insurance, General Professional Services
Summary
This is a bill, not current law. SB 690 passed the California Legislature on August 28, 2026 and is awaiting action by the Governor. It is not currently an operative compliance requirement. If enacted, it would limit private lawsuits for alleged pen-register or trap-and-trace violations arising from conduct on a website or app, leaving those actions to the Attorney General.
Why it matters
Small businesses that use ordinary website analytics, chat widgets, or advertising pixels have been named in California Invasion of Privacy Act claims. If enacted, this bill would narrow one legal theory used in those suits. It would not, by itself, change CCPA duties or other privacy claims, and it is not a general tracking safe harbor.
Recommended action
Do not treat the bill as enacted. Read the current text on the California Legislature site, and review with qualified counsel which tracking tools are on your site and what current California law requires.