Summary
California lawmakers and courts are changing the landscape for lawsuits over website tracking technologies. On August 28, 2026, California lawmakers passed SB 690. If signed into law, it would eliminate private lawsuits alleging violations of the "pen register" and trap-and-trace provisions of the California Invasion of Privacy Act (CIPA), leaving enforcement to the California Attorney General. Complicating matters, shortly before the amended bill reached the Assembly floor, the California Court of Appeal issued a tentative ruling in Variety Media, LLC v. Superior Court.
The court held that CIPA’s “pen register” definition is not limited to telephone equipment and may extend to internet communications—a setback for retailers that have taken the position that CIPA was never meant to extend to cookies or analytics tools. Favorably, however, it also held that collecting a user’s IP address alone was insufficient to state a pen register claim because an IP address identifies the source—not the destination—of a communication. For retailers, these developments are a mixed bag. Retailers should continue to closely evaluate their tracking practices, disclosures, and vendor relationships.
The Upshot
- SB 690 passed the Assembly and Senate but awaits the Governor’s signature. If enacted, it would bar private plaintiffs from bringing CIPA pen register and trap-and-trace claims, leaving those claims to the California Attorney General. The bill is expected to apply retroactively to actions filed within the two years before its effective date.
- In a tentative ruling, the Variety Media court held that CIPA’s pen register provision applies beyond telephone equipment to internet communications, but that collecting an IP address alone was insufficient to state a pen register claim. The ruling is not final.
- Retailers remain exposed to privacy and consumer-protection litigation risks. They should test their tracking tools, ensure disclosures match actual practices, preserve evidence, review vendor agreements, and evaluate pending demands and cases.
The Bottom Line
SB 690 and Variety Media may give retailers stronger defenses to certain website tracking claims, but neither eliminates the broader litigation risk. Retailers should identify what their tracking tools collect and share, address tools that activate before consent, align disclosures with actual practices, and preserve the evidence needed to defend future claims. Ballard Spahr can assist with tracking-technology reviews, demand-letter responses, class action defense, and regulatory inquiries.
California lawmakers and courts are changing the landscape for lawsuits over website tracking technologies. The Legislature has moved to curb private lawsuits under the pen register and trap-and-trace provisions of the California Invasion of Privacy Act (CIPA) through Senate Bill 690. Meanwhile, the California Court of Appeal issued a tentative ruling in Variety Media, LLC v. Superior Court holding that CIPA’s “pen register” definition may extend beyond telephone equipment to certain online communications—a setback for retailers that have taken the position that CIPA was never meant to extend to cookies or analytics tools. The court also concluded, however, that collecting a user’s IP address alone was insufficient to state a pen register claim. These developments may reshape litigation over web tracking technologies, but they do not eliminate the risks. Retailers should continue to assess their tracking practices, disclosures, and vendor relationships.
What Would SB 690 Change?
On August 28, 2026, the Legislature passed SB 690, and it now awaits the Governor’s signature. If enacted, it would eliminate private lawsuits under CIPA’s pen register and trap-and-trace provisions—Section 638.51—leaving enforcement to the California Attorney General. The bill would apply retroactively to actions filed within two years before its effective date.
SB 690 is not a blanket shield. It would not prevent private litigants from bringing the same website tracking claims under Section 631(a) of CIPA, or eliminate claims under other privacy statutes, consumer protection statutes, or common law.
What Did the Court Say in Variety Media?
A week before amended SB 690 reached the Assembly floor, the California Court of Appeal issued a tentative ruling in Variety Media, LLC v. Superior Court, No. B350578, addressing whether software that collects information from website visitors can qualify as a “pen register” under CIPA.
The court held that CIPA’s pen register provision is not limited to telephone equipment and may apply to devices or processes that collect information about online communications. But the court also held that collecting a visitor’s IP address alone was not enough to state a pen register claim because an IP address identifies the source of a communication rather than the destination.
The ruling is not final and could change. Retailers should not treat it as settled law.
Practical Steps for Retailers
Retailers should consider the following actions:
- Find and test every tracking tool. Identify the cookies, pixels, analytics tools, chat services, fraud tools, and software kits operating across each website and app. Test what each tool collects, when it activates, and which vendors receive the information.
- Address tools that activate before consent. Determine whether any tool begins collecting or sharing information before the customer makes a choice. Disable, delay, or reconfigure tools that do not follow the intended consent process.
- Make disclosures match actual practices. Compare test results with privacy policies, cookie banners, checkout pages, loyalty terms, promotions, pricing statements, and automatic-renewal disclosures. Correct any gap between what is disclosed and what the technology actually does.
- Retest after website or vendor changes. Repeat the review when adding a vendor, launching a campaign, or updating a website or app. Periodic testing can catch tools that were added or reactivated without legal review.
- Preserve the evidence needed for a defense. Save dated policies, consent records, screenshots, network-testing results, tracking configurations, and deployment histories. These materials can show what customers saw and what the technology did during the relevant period.
- Strengthen vendor agreements. Require vendors to disclose their data practices, follow consent settings, provide audit information, assist with claims, preserve relevant evidence, and address indemnification and defense costs.
- Triage pending demands and cases. Identify the filing date, website or app involved, challenged technology, information allegedly collected, claims asserted, and procedural stage. If SB 690 becomes law, assess whether its retroactive provision applies—but do not assume it will eliminate private actions under CIPA Section 631(a) or other privacy and consumer-protection claims.
A Clearer Path—or Just a Different Fight?
SB 690 would eliminate private lawsuits under CIPA’s pen register and trap-and-trace provisions, but plaintiffs may continue to pursue website tracking claims under different legal theories. The tentative Variety Media ruling also cuts both ways. Its broader reading of the pen register definition may help plaintiffs, while its treatment of IP addresses gives retailers a potential defense. The result is more guidance—but not certainty, which means litigation risk remains. Retailers should keep these developments in mind while actively evaluating their tracking practices, disclosures, and vendor relationships.
Ballard Spahr’s Retail and E-Commerce Team assists retailers with website tracking reviews, demand-letter responses, class action defense, and regulatory inquiries.
Subscribe to Ballard Spahr Mailing Lists
Get the latest significant legal alerts, news, webinars, and insights that affect your industry.
Subscribe Copyright © 2026 by Ballard Spahr LLP.
www.ballardspahr.com
(No claim to original U.S. government material.)
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, including electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of the author and publisher.
This alert is a periodic publication of Ballard Spahr LLP and is intended to notify recipients of new developments in the law. It should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own attorney concerning your situation and specific legal questions you have.