What happened
California Governor Gavin Newsom signed SB 690 into law, a bipartisan update to the California Invasion of Privacy Act. The law removes a private right of action that residents have held since 2015 to sue companies over certain internet tracking technologies, including pen registers and trap and trace devices.
CIPA dates to 1967 and originally required a court order for wiretapping, eavesdropping, interception or recording of telephone calls. Courts later extended it to cover most internet communications, such as email and websites. The 2015 amendment let residents sue over the unauthorized use of tracking tools, with penalties up to $5,000 per violation plus triple damages.
Supporters say that provision became a litigation industry. The Alliance for Legal Fairness, a lobbying group backing the update, tracked roughly 600 lawsuits under the provision in 2025 and now says the number has grown past 4,000. Attorneys at Pillsbury describe tens of thousands of demand letters sent over everyday website tools like cookies, analytics software and pixels. The Assembly Committee on Privacy and Consumer Protection called the pen register provision "the poster child for abusive lawsuits," and Newsom framed the signing as relief for small businesses.
Opposition was broad. Most major California labor unions, the ACLU, the Consumer Federation of California, the Privacy Rights Clearinghouse, the Electronic Privacy Information Center and dozens of civil rights groups opposed the bill. The Electronic Frontier Foundation said it should never have been signed. Its state affairs director, Hayley Tsukayama, warned that removing the right to sue makes it harder for ordinary people to challenge metadata surveillance, at a time when federal agencies increasingly seek data from businesses and data brokers.
Why this is a GRC story
A removed remedy does not remove the obligation. SB 690 narrows who can sue, not what the law permits. Companies still carry the duty to know what trackers run on their sites and apps, and the data protection regulator still has its own enforcement tools. Treating the law as permission to stop reviewing pixels and analytics tags would be a costly misreading.
Third party tags are a governance item. The disputes here were mostly about code that marketing teams added through third party vendors, often without a privacy review. That is a supply chain and change management problem dressed up as a legal one. A tracker register, an approval step before tags go live, and a data processing agreement that names what each tool collects are the controls that keep a website defensible.
The legal baseline is now political. Privacy protections that once rested on private litigation can be revised by a single signature. Risk registers that assumed those liabilities existed should be refreshed, because the exposure picture for California web tracking changed when SB 690 was signed.
What to watch
Watch whether other states copy the exemption, because a patchwork of private rights across states is harder to manage than a single baseline. Watch, too, how the California Privacy Protection Agency exercises its own authority now that this private route is closed.
For compliance teams this is a good moment to re-count. Pull the current inventory of tags and pixels on customer facing properties, confirm each has a privacy owner and a documented purpose, and note where consent is collected. That work is cheap to do now and awkward to reconstruct later.
Attribution: Analysis based on CyberScoop and related public reporting. This article is original commentary, not a repost of the source material.