California State Sen. Anna Caballero, D-Fresno
SACRAMENTO — A bill that aims to end a wave of abusive “shakedown” privacy lawsuits targeted at California businesses and nonprofits over alleged violations of a 1967 wiretapping law has passed the state legislature and is on its way to the governor’s desk.
Senate Bill 690, authored by state Sen. Anna Caballero (D-Merced), unanimously passed the Assembly on Friday. The measure gained state Senate approval last year and has received support from business groups and supporters of tort reforms.
But amendments have narrowed the bill’s provisions. The latest version eliminates private lawsuits under the California Invasion of Privacy Act (CIPA) for targeted actions related to common website tools, such as chats, payment processing and meeting scheduling. It would authorize only the state attorney general to bring such legal complaints against private parties.
Among its privacy provisions, CIPA prohibited certain techniques for intercepting electronic communications and specifically prohibited using what’s called a “pen register” or a “trap and trace” device to capture such electronic data. But since 2024, California plaintiffs’ attorneys have alleged that the tracking technologies used on businesses’ websites to collect information on visitors are actually illegal pen registers under CIPA, according to the Legislature’s analysis of the bill.
Caballero has reported that about 4,000 lawsuits alleging CIPA violations have been filed against businesses in the state – most of them related to tracking software – over several years. A coalition called Stop CIPA Shakedown Lawsuits argues that SB 690 is needed to deal with “the growing wave of abusive lawsuits” brought under CIPA.
California Citizens Against Lawsuit Abuse (CALA) also expressed satisfaction that lawmakers acted on this issue.
“CIPA was written in 1967 to stop wiretapping, not to punish businesses for using standard website tools already regulated under CCPA (the 2018 California Consumer Privacy Act),” Maryann Marino, regional director of California CALA, toldThe Record in an email. “Passing SB 690 doesn't weaken privacy protections. It simply closes the loophole that turned a criminal statute into a tool for shakedown lawsuits against small businesses in our state.”
The measure is a win for all parties because it focuses enforcement on actual privacy harms to protect consumers while shielding small businesses from liability burdens, Marino said.
In a prepared statement, Andrew Kingman, general counsel for the Virginia-based Alliance for Legal Fairness, urged California Gov. Gavin Newsom to sign the bill into law.
“We are pleased to see California lawmakers recognize the urgent need for CIPA reform and advance SB 690 to the governor’s desk,” Kingman said. “This is a step forward for the small businesses, nonprofits and public agencies that have been forced to spend valuable resources defending themselves against abusive lawsuits.”
If SB 690 becomes law, it will apply retroactively to any pending CIPA pen-register claim relating to websites and online or mobile applications for the two years prior to Jan. 1, 2027.
Tens of thousands of demand letters seeking settlements relating to such CIPA violations have been sent to businesses and nonprofit groups across California in recent years, according to Stop CIPA Shakedown Lawsuits. Often, such letters and subsequent claims allege no actual harm has occurred, according to SB 690 supporters.
Just five law firms have generated about 72% of the CIPA litigation in recent years, according to the California Chamber of Commerce.
