On September 30, 2026, Governor Gavin Newsom signed SB 690 (Sen. Anna Caballero, D-Merced). The law removes private plaintiffs' ability to sue websites and apps under the "pen-register" and "trap-and-trace" provisions of the California Invasion of Privacy Act (CIPA). Plaintiffs' firms have used those provisions to target ordinary cookies, analytics tags and ad pixels. XBIZ covered the signing for the adult industry on October 5, noting that adult sites have been hit by "a wave of CIPA lawsuits" alleging that trackers and cookies were set and user data shared before visitors gave consent.

Why It Matters

For sex-toy e-tailers, sexual-wellness DTC brands and adult content sites, CIPA pen-register demand letters have been a steady cost of doing business in California. The sensitivity of the browsing data made these businesses especially appealing targets, because few want to defend a "you shared my vibrator-shopping clickstream with Meta" claim in open court. SB 690 removes the cheapest version of that threat. Businesses with pending § 638.51-only claims filed since January 2025 should talk to counsel about stays or dismissal once the law takes effect. It is not a full safe harbour. Wiretap and eavesdropping theories survive, and the attorney general can still enforce pen-register claims. The underlying question of whether a pixel counts as a "pen register" is still undecided. For intimate-products merchants, the safest course hasn't changed: put consent banners in front of tags that share data, audit what third-party pixels send from product and checkout pages, and treat sexual-wellness browsing data as sensitive health-adjacent information. California signed **AB 1705**, the adult-site upload-certification law, in the same September 30 batch, so these businesses face more compliance work on content even as their tracking-litigation risk drops.

According to a client alert from Pillsbury Winthrop Shaw Pittman, SB 690 amends only Penal Code § 637.2, CIPA's civil-remedy section. From the January 1, 2027 operative date, only the California attorney general can sue a private business for a § 638.51 pen-register/trap-and-trace violation arising from a website or app. The change is partly retroactive. It applies to pending claims in actions filed within the two years before the operative date, which in practice means suits filed on or after January 1, 2025 should become subject to dismissal. It does not change the substantive ban in § 638.51. It also leaves CIPA's § 631 wiretapping and §§ 632/632.7 eavesdropping claims available to private plaintiffs, and those carry $5,000-per-violation exposure. Pillsbury expects plaintiffs to try re-pleading under those sections.

The problem was large. Pillsbury cites the Assembly Privacy Committee's analysis: roughly 600 such lawsuits had been filed against California businesses when the reform effort began in early 2025, and about 4,000 had been filed 18 months later. Testimony put total settlements at more than half a billion dollars. In his signing message, Newsom said the bill "addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses." He also urged the legislature to fix CIPA's "other decades-old statutes" next year. Adult-industry attorney Corey Silverstein called the change "significant." He cautioned that "the correct analysis now turns much more heavily on what the technology actually collects, what it transmits, who receives the data, and for what purpose."

Sources

Update — 2026-10-06

Initial entry — story first created.