California SB 690 Does Not Repeal CIPA: What Website Teams Need to Know

What SB 690 actually changes

Start with the chaptered bill text, not a headline about an earlier draft. California SB 690 is Chapter 976, Statutes of 2026. It amends Penal Code § 637.2, CIPA’s civil-remedy provision. The operative new language in subdivision (d)(1) is: “An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.”

That wording matters. The change identifies a statute, a defendant category, a setting, and an enforcement route. It restricts private enforcement of the specified § 638.51 claims under § 637.2. It does not repeal § 638.51’s underlying prohibition or declare all website tracking lawful. The Attorney General remains able to bring the covered actions.

The § 638.50 definitions concern devices or processes recording dialing, routing, addressing, or signaling information and exclude communication contents from those definitions. Section 638.51 prohibits installing or using a pen register or trap-and-trace device without a court order, subject to exceptions. Whether a particular tracking implementation meets those definitions is a separate legal question that SB 690 does not settle.

When it takes effect, and which pending claims it reaches

The bill was approved and filed on September 30, 2026. Crowell & Moring’s October 8 analysis and DLA Piper’s October 5 analysis identify January 1, 2027 as the effective date. As of this guide’s October 21, 2026 review, that date is still ahead. Do not confuse an enacted amendment with a currently operative limitation.

Subdivision (d)(2) of the enacted text says the amendments apply retroactively “to any pending claim in an action commenced within two years before the operative date of that legislation.” With a January 1, 2027 operative date, the lookback begins January 1, 2025. The provision concerns covered pending claims in that window, not every historical dispute, settled claim, or other cause of action in the same lawsuit.

Hinshaw’s October 13 analysis flags possible constitutional challenges to retroactivity. SB 690 also contains a severability clause: invalidating a provision or application need not invalidate the rest. That is not a ruling that a challenge will succeed or fail. Counsel should assess filing dates, the pleaded sections, procedural posture, and any later decisions before deciding what relief to seek. Do not ignore a demand letter, court deadline, or preservation duty in anticipation of the change.

Why people think CIPA is going away

Much of the confusion comes from treating earlier versions as the final law. SB 690’s official page has a version selector and Compare Versions tool. The enacted bill changes one civil-remedy section; it does not enact a general “commercial business purpose” exemption from all CIPA provisions.

The distinction is not just terminology. Crowell’s current analysis explains the remaining litigation and enforcement exposure, while DLA Piper distinguishes § 638.51 reform from § 631 and § 632 claims. Read the dated, post-signing analyses alongside the chaptered text. An article describing what the bill “would” do before its amendments or signature may no longer describe the law that passed.

A narrower private enforcement route is a meaningful change. Calling it the end of CIPA is not accurate. Nor does the enacted law establish that every surviving allegation is valid: plaintiffs still have to satisfy the applicable legal requirements and defendants may have defenses.

What SB 690 does not remove

CIPA § 631: The wiretapping provision includes prohibitions on reading communications in transit without the required consent and assisting prohibited conduct. Website disputes may involve pixel event payloads, search terms, chat messages, or replay data. Whether a flow satisfies the elements depends on its contents, timing, the parties’ roles, consent, and defenses. SB 690 does not amend § 631. See our § 631 guide.

CIPA § 632: The eavesdropping and recording provision addresses confidential communications and all-party consent. Confidentiality and the other elements require separate review; not every website interaction is a confidential communication. SB 690 does not amend this section either.

Other laws: SB 690 does not amend the federal Wiretap Act, Pennsylvania’s WESCA, the VPPA, or the CCPA. Those regimes have different coverage, elements, exceptions, and remedies. Hinshaw’s analysis specifically cautions that other causes of action are not removed by this limited law. A surviving legal route does not itself establish liability, and a CIPA audit is not a complete assessment of those other laws.

Civil remedies: The chaptered § 637.2 retains a damages framework of the greater of $5,000 per established violation or three times actual damages, subject to its new enforcement limitation. A tracker-hit total is not a legal count of violations. Standing, remedies, and the application of the amendment still need claim-specific analysis.

What this means for Shopify pixels and checkout

California SB 690 contains no Shopify-specific exemption. A merchant still needs to know what storefront, search, app pixels, hosted checkout, and server-side integrations transmit. Do not turn off consent controls just because one litigation route is narrowing. The right legal analysis depends on the challenged collection, not the platform name.

Our Shopify checkout evidence article links to a captured reject-all journey where Meta requests were absent after rejection and reload, then appeared in a later shopping/checkout segment. A search term also reached Google Analytics after rejection. The report did not include entered shipping or payment details, and some payloads were redacted. Those observations warrant investigation; they do not prove a violation, a universal Shopify problem, or a particular consent-setting error.

Review whether the visitor’s choice reaches each integration and whether actual requests match the approved design. Preserve the timing, destinations, available payloads, and missing evidence. That record helps counsel distinguish routing-information allegations from communication-content allegations instead of assuming SB 690 answers both.

A practical next step, without promising legal clearance

If you have a demand letter or lawsuit, give counsel the alleged statutory sections, dates, URLs, vendors, consent notices, and available captures. Preserve relevant evidence and settings in coordination with counsel before deleting records or making evidence-sensitive changes. Ask specifically whether the § 638.51 enforcement limitation and pending-claim window apply, and which other claims remain. This is not a legal response template.

For ongoing review, inventory transmitted fields and recipients, test consent timing and rejection with synthetic inputs, and review vendor and server-side settings. Use the website compliance guide and pixel litigation overview to organize the facts. Neither a banner screenshot nor a tracker label establishes legal compliance or liability.

The free got cipa? scan screens a submitted page after Reject All from California. Detailed findings and reports require an email. It does not test the entire Shopify purchase journey or determine the outcome of a claim. got pixels? is the full product for deeper checkout, chatbot, and contact-form journeys. Test only sites you are authorized to audit; treat the results as evidence for review, not a certification.

The sources to read first

1. California Legislative Information: chaptered SB 690. The controlling starting point for the amendment’s exact scope, pending-claim language, and severability. Use the History and Compare Versions tabs to distinguish the enacted text from proposals.

2. Crowell & Moring, October 8, 2026. A post-signing explanation of the private-enforcement limitation and remaining website-tracking claims.

3. DLA Piper, October 5, 2026. A concise overview of the January 2027 effective date, pending actions, and the distinction from §§ 631 and 632.

4. Hinshaw & Culbertson, October 13, 2026. An overview of remaining privacy claims and potential disputes about retroactivity. These law-firm analyses are commentary, not court decisions or advice about your specific situation.

Key cases

FAQ

Further reading

• SB 690: enacted text, Chapter 976 — California Legislative Information
• SB 690: official legislative history — California Legislative Information
• SB 690: private enforcement and remaining claims (Oct. 8, 2026) — Crowell & Moring
• SB 690: effective date and scope (Oct. 5, 2026) — DLA Piper
• SB 690: remaining risks and retroactivity (Oct. 13, 2026) — Hinshaw & Culbertson
• California Penal Code § 638.50: definitions — California Legislative Information
• California Penal Code § 638.51 — California Legislative Information
• California Penal Code § 631 — California Legislative Information
• California Penal Code § 632 — California Legislative Information

Related reading