California Senate Bill 690 (SB 690) reportedly narrows one private lawsuit route under the California Invasion of Privacy Act (CIPA), but it does not make website or app tracking automatically lawful. A September 2026 legal analysis says Governor Gavin Newsom signed the measure on September 30, 2026, with the operative change beginning January 1, 2027. The reported amendment concerns private claims under CIPA section 638.51 involving pen registers and trap-and-trace devices in connection with websites, online applications and mobile applications.
For visitors, that means the identity of the potential enforcer and the timing of conduct matter more than before. CIPA sections 631 and 632 reportedly remain in place, courts have reached different conclusions about tracking pixels and session-replay tools, and California’s separate Consumer Privacy Act (CCPA) rights continue to apply. The practical answer to “What does California’s updated wiretapping law mean for website visitors and app users?” is therefore limited: one category of private claim may become harder to bring, while other legal theories and consumer rights remain available.
As an Amazon Associate I earn from qualifying purchases.
What SB 690 changes on January 1, 2027
The change described in a September 2026 analysis by Proskauer on Privacy is specific to CIPA section 638.51. That provision is used in claims alleging pen-register or trap-and-trace activity. According to the analysis, SB 690 removes private enforcement for certain section 638.51 claims arising from conduct on websites, online applications and mobile applications. Enforcement for the covered claims would be left to the California Attorney General.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe reported effective date is January 1, 2027. The same analysis describes limited retroactive treatment for certain pending claims that were commenced on or after January 1, 2025. “Retroactive” does not mean every old case disappears or that every claim filed during that period is covered. Whether a pending case falls inside the statute’s reported window depends on the claim pleaded, the conduct alleged and the procedural status of that case.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The official enacted text was not available in the source material used for this explainer. The scope, effective date and retroactivity details should therefore be checked against the final legislative text and a lawyer’s advice before anyone relies on them in a live dispute.
| Question | Reported answer | What it means for a visitor or app user |
|---|---|---|
| Which CIPA provision is targeted? | Section 638.51, for certain pen-register and trap-and-trace claims tied to website, online-application or mobile-application conduct. | A private claim based only on that theory may be restricted after the effective date. |
| When does the change operate? | January 1, 2027, according to the September 2026 legal analysis. | The date of the alleged conduct and the date a case was started can both matter. |
| Who reportedly retains enforcement authority? | The California Attorney General for the covered claims. | A private plaintiff may not have the same section 638.51 remedy that was previously asserted. |
| Are CIPA sections 631 and 632 removed? | No. The analysis says the final measure left them unchanged. | Different wiretapping or eavesdropping theories may still be argued where their elements are met. |
| Does the bill approve all tracking? | No. The bill is not described as a blanket exemption for tracking technologies. | A website’s use of analytics, pixels or replay software still requires a fact-specific legal analysis. |
What the law does not mean
It is not the end of “website wiretapping” cases
Statements that California has ended website wiretapping lawsuits go too far. They collapse several CIPA provisions and other privacy laws into one label. SB 690’s reported change addresses a private-enforcement route under section 638.51. It does not repeal CIPA, eliminate every private claim, or decide that ordinary online tracking is legal.
It does not create a safe harbor for commercial tracking
A broader proposed carve-out for ordinary commercial-purpose processing was reportedly not retained in the final measure. That matters because the commercial purpose of a script, by itself, is not a legal conclusion. The relevant questions can include what information was transmitted, to whom, how the system functioned and which statutory elements are alleged.
Recommended Free Tools
It does not decide every case involving a named technology
Tracking pixels, analytics packages, chat widgets, chatbots and session-replay systems can operate in materially different ways. A pixel might send an event when a page loads; a replay service might record clicks, keystrokes or navigation; a chat tool might transmit the text of a conversation to a vendor. The technology label alone does not establish whether a particular deployment violates CIPA.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
How website and app tracking creates the legal question
When a page or app opens, it can load code from the operator and from third-party services. That code may send information such as a page address, button interaction, device details, advertising identifiers, search terms or the contents of a form. Some services collect only measurements needed for performance; others can connect events to an account or a browsing session.
CIPA litigation has focused on whether particular transmissions resemble the conduct covered by statutory wiretapping, eavesdropping, pen-register or trap-and-trace provisions. A claim may turn on the exact data flow rather than on the marketing name of the service. Questions include whether the service received communication content, whether the website operator was a participant in the communication, whether consent was obtained and what the alleged interception occurred.
Inside Class Actions’ January 2026 roundup reported differing court outcomes involving session replay and pixels. Those decisions show why no universal answer can be given for every website or app. One court’s treatment of a tool or implementation is not a ruling that all implementations are lawful or unlawful.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Section 638.51 compared with sections 631 and 632
Readers often see these provisions grouped together in headlines, but they are not interchangeable. The following distinction is the starting point for understanding a notice, complaint or news report.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
| Provision | General issue raised in online-tracking disputes | Effect of the reported SB 690 change |
|---|---|---|
| CIPA §638.51 | Pen-register and trap-and-trace allegations connected to website, online-application or mobile-application conduct. | Private enforcement for certain covered claims is reportedly removed; Attorney General enforcement remains. The change is reported to begin January 1, 2027, with limited treatment of some pending claims filed on or after January 1, 2025. |
| CIPA §631 | Wiretapping allegations, including claims that communications were intercepted or received without authorization. | Reportedly unchanged by the final measure. SB 690 does not erase a possible section 631 theory. |
| CIPA §632 | Eavesdropping or recording allegations involving confidential communications. | Reportedly unchanged by the final measure. Whether it applies depends on the communication and facts. |
This table is not a legal test or prediction. A person evaluating a specific matter needs the actual pleadings, technical evidence, consent language and dates. The same website can generate different issues for a page view, a support chat and a logged-in financial transaction.
Can websites still track visitors in California?
Yes. SB 690 does not prohibit websites or apps from using analytics, advertising, customer-support or security tools. It changes a reported private-enforcement mechanism for one CIPA category. Whether a particular tracking practice is permissible remains dependent on the technology, notice, consent, data involved and applicable law.
Visitors should distinguish “tracking occurs” from “tracking violates a statute.” Modern sites commonly record events such as a page visit or an error report. More intrusive systems may capture text entered into a field, the sequence of clicks or a conversation with an agent. The legal significance of each event cannot be determined from the presence of a familiar vendor script alone.
Do California privacy rights still apply to apps and websites?
Yes. The California Attorney General’s CCPA overview, updated August 28, 2026, describes rights that operate separately from the CIPA amendment. Subject to the CCPA’s definitions, exemptions and thresholds, consumers can:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Know what personal information a business collects, uses, discloses or sells, and obtain access to relevant information.
- Request deletion of personal information, subject to statutory exceptions.
- Opt out of the sale or sharing of personal information. The Global Privacy Control can communicate an opt-out signal in supported circumstances.
- Exercise these rights without discrimination by the business.
These rights do not automatically prove that a business violated CIPA, and a CIPA claim does not replace a CCPA request. A person can have a valid access or opt-out request even when a private section 638.51 lawsuit is unavailable. Conversely, submitting a CCPA request does not resolve every question about interception or eavesdropping.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to evaluate a website or app situation
If you are trying to understand a notice, complaint or tracking disclosure, organize the facts in this order. This is an information checklist, not a prediction of liability.
- Identify the statutory section. Look for whether the allegation cites section 638.51, 631, 632, the CCPA or another law. Do not assume that a headline’s use of “wiretapping” identifies the claim.
- Record the dates. Note when the page, app feature or communication was used; when the alleged transmission occurred; and, if there is a case, when it was filed. January 1, 2027 is the reported operative date, while the reported retroactive window concerns certain pending claims commenced on or after January 1, 2025.
- Describe the technology’s actual behavior. Ask what script or software loaded, what fields or events it received, where the data went and whether it was linked to an account or identifier. Browser developer tools, an app’s privacy documentation and a company’s data-request response may help document the flow, but they do not by themselves establish a legal violation.
- Separate content from metadata. A page URL, timestamp or button event may raise different questions from the words typed into a chat or form. Preserve the distinction in any complaint or request.
- Check notice and choices. Save the privacy notice, consent banner, cookie settings and opt-out controls that were shown at the relevant time. Record whether a choice was available before the data was sent and whether the site honored a Global Privacy Control signal where required.
- Keep evidence without exposing other people. Save screenshots, dates and copies of notices, but avoid sharing another person’s account details, health information, financial data or private messages.
- Get advice for a live dispute. A pending claim, demand letter or threatened filing requires fact-specific legal advice. This general explanation cannot determine a deadline, remedy or likelihood of success.
What visitors can do under the CCPA framework
Use an access or deletion request
A consumer can ask a covered business what personal information it collects and uses, or request deletion subject to exceptions. The business may need to verify identity and may retain information that is necessary for security, legal compliance or other recognized purposes.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteOpt out of sale or sharing
Consumers can use a business’s “Do Not Sell or Share My Personal Information” control where applicable. A supported Global Privacy Control signal can also communicate an opt-out preference. An opt-out does not necessarily stop every first-party security, service or operational measurement, and it is not a universal command to disable all cookies.
Watch for discrimination
The CCPA framework generally bars discrimination for exercising covered rights, while allowing certain differences tied to the value of data or a permitted financial incentive. If access, deletion or opt-out changes the service you receive, document the exact explanation and date.
Common misunderstandings after the update
- “The law was repealed.” CIPA remains in force; the reported amendment is narrower.
- “Every tracking pixel is illegal.” Courts have differed, and implementation details matter.
- “Every tracking pixel is now safe.” Sections 631 and 632 were reportedly left unchanged, and other privacy laws still apply.
- “The effective date is the only date that matters.” The conduct date, filing date and any retroactive rule can all affect analysis.
- “A privacy-policy paragraph settles consent.” Whether notice was clear, timely and applicable to the actual data flow can be disputed.
- “A CCPA request proves a CIPA violation.” The statutes address different rights and theories.
What to watch as the change takes effect
Businesses, courts and the Attorney General will clarify how the amendment is applied in practice. Early questions are likely to include which claims qualify as website or app conduct, how the reported retroactive provision operates in pending cases and how section 638.51 allegations are distinguished from sections 631 and 632. Until those questions are resolved by authoritative text and decisions, treat broad statements about “legalizing tracking” or “ending lawsuits” with caution.
For an ordinary visitor, the durable takeaway is practical rather than predictive: a website or app may still transmit information through analytics, pixels, chat or replay tools; the legality of that transmission depends on facts; and California privacy choices under the CCPA remain relevant even when one CIPA private claim is restricted.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
