# California Limits CIPA Website Claims

California signed SB 690 on September 30, 2026, limiting private lawsuits under the California Invasion of Privacy Act’s pen-register and trap-and-trace provision for specified website, online-application, and mobile-application conduct. The change takes effect **January 1, 2027 (78 days away)** and applies retroactively to qualifying suits filed on or after January 1, 2025. It does not eliminate potential liability under other CIPA provisions or privacy laws, or enforcement by the California Attorney General.

- Government contractors and other businesses using tracking technologies on websites or applications should review those practices and confirm that privacy disclosures accurately describe them.
- The change narrows one category of private claims; it does not remove broader privacy-law exposure or Attorney General enforcement risk.
- Contractors serving California agencies or handling personal information should account for the law’s effective date and retroactive scope when assessing relevant claims and privacy practices.

**Jurisdictions:** sled
**Industries:** Information Technology
**Topics:** Regulatory Compliance
**Published:** October 14, 2026

### Government Entities
- California Legislature
- California Attorney General

### Sources
- [California’s SB 690 Removes Some CIPA Claims, But Privacy and Legal Risks Remain | Hinshaw & Culbertson - Privacy, Cyber & AI Decoded - JDSupra](https://www.jdsupra.com/legalnews/california-s-sb-690-removes-some-cipa-7157765) - JD Supra