SB 690 Could End the Pixel Lawsuit Wave, but Not the Privacy Risk

For three years, the pixel on a brand's checkout page has been a litigation magnet. California's Invasion of Privacy Act, written decades before the first analytics script, turned into a template for demand letters and class actions over the everyday tools marketers use to measure a website. This month the state legislature sent the Governor a bill meant to shut much of that down. Read the fine print, though, and the relief is narrower than the headlines suggest, and a second bill in the same package points at a much bigger change to how customer data can move.

What SB 690 Actually Removes

SB 690 passed the California legislature unanimously on August 28, 2026, according to an analysis from Taft's Privacy & Data Security Insights, and the Governor has until September 30 to sign or veto it. The target is specific: it eliminates the private right of action for pen register and trap and trace claims under Penal Code Section 638.51 when the alleged violation arises from "conduct on a website, online application, or mobile application." After that, only the Attorney General could bring those claims against private businesses, and Taft notes the Attorney General has never brought a tracking-technology case under Section 638.51, handling tracking through CCPA enforcement instead.

The retroactivity is what gives the bill teeth. A summary from Venable confirms an operative date of January 1, 2027, with the limitation applying to certain pending claims filed within two years before that date. Taft adds that the bill includes a severability clause, so the removal of the private right of action survives even if a court strikes the retroactive piece. For a brand currently fighting a pen register suit over a Meta or TikTok pixel, that is the part of the bill that matters.

What It Leaves Standing

The wiretap section is untouched. As Carpe Datum Law lays out, the private right of action under CIPA Section 631, which addresses the content of communications, persists and applies to "session replay tools, chat features, pixels, and other third-party website technologies." Section 632 claims for confidential recording remain, as do claims under the federal Electronic Communications Privacy Act. The same analysis notes plaintiffs are already asserting multiple CIPA and federal wiretapping claims together "in order to avoid the anticipated statutory effect of SB690."

That matters because of where the money has actually gone. The ConsentPixel CIPA lawsuit tracker, last updated September 16, 2026, counts 49 CIPA website lawsuits with more than $153.45 million in publicly disclosed settlements. It attributes 65% of those cases to session replay tools such as Hotjar, FullStory, and Microsoft Clarity, 15% to other third-party scripts, 10% to forms and chat data, and just 10% to tracking pixels. The largest disclosed settlements are concentrated in health: Flo Health at $59.5 million, Sutter Health at $21.5 million, and Mass General Brigham at $18.4 million.

Those figures come from a vendor that sells consent tooling and reflect only settlements made public, so they are a floor rather than a census. The same tracker estimates more than 50,000 CIPA claims since 2022 once demand letters are counted, and notes 28 states have comparable wiretapping laws. A California fix does nothing about the other 27.

The Bill in the Same Package That Changes the Data Itself

SB 690 is about who can sue. AB 1542 is about what a business is allowed to do. Venable's summary describes it as prohibiting businesses, service providers, or contractors from "selling or sharing sensitive personal information to a third party, subject to specified exceptions," effective January 1, 2027. Under the CCPA framework, sharing covers disclosure for cross-context behavioral advertising, so for categories such as health, precise location, and financial data, the retargeting audience built from a site pixel is exactly the flow the bill targets.

The rest of the package pushes the same way. SB 923 extends deletion rights to information collected "from or about" consumers through third-party sources, AB 2561 bars operating systems and apps from undoing a user's privacy settings without consent, and AB 883 tightens how often data brokers must process deletion requests through the state's DROP platform, from at least every 45 days to at least once every 30. Taken together, California is narrowing the lawsuit exposure for tracking while widening the rules about what tracked data can be used for.

• Inventory every script, not just the pixels. Session replay, chat widgets, and embedded third-party code account for most of the tracked cases, and Section 631 still reaches all of them.
• Separate relief from compliance. SB 690 changes who can sue over one theory; it does not make any tracking practice lawful, and the Attorney General keeps the power to enforce.
• Map sensitive data flows before January. If AB 1542 becomes law, any audience or event stream carrying health, location, or financial signals to an ad platform needs a documented exception.
• Match disclosures to what the site really does. Taft's first recommendations are an audit of tracking technologies and privacy notices that reflect actual practice, backed by working consent mechanisms.
• Plan for the other 27 states. Comparable wiretap statutes elsewhere mean a California-only fix is a partial fix for any national brand.
• Invest in consented, first-party channels. Data customers give directly, through owned channels and opt-in lists, is the part of the stack neither bill makes harder to use.

SB 690 would take the cheapest lawsuit theory off the table for California websites, and for brands buried in pen register demand letters that is real relief. But the claims that account for most of the tracked litigation run through a section the bill leaves alone, and the companion bill on sensitive data moves the question from "can someone sue over this pixel" to "is this data allowed to leave at all." The marketers who treat this month as a reprieve will be auditing again in January.