{"id":3312,"date":"2026-10-06T07:19:58","date_gmt":"2026-10-06T11:19:58","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=3312"},"modified":"2026-10-06T07:19:59","modified_gmt":"2026-10-06T11:19:59","slug":"california-legislature-halts-class-actions-alleging-that-common-website-advertising-technologies-are-pen-registers-and-trap-and-trace-devices","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2026\/10\/06\/california-legislature-halts-class-actions-alleging-that-common-website-advertising-technologies-are-pen-registers-and-trap-and-trace-devices\/","title":{"rendered":"California Legislature Halts Class Actions Alleging That Common Website Advertising Technologies Are Pen Registers And Trap And Trace Devices"},"content":{"rendered":"
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

By Gerald L. Maatman, Jr., Justin R. Donoho, and Hayley Ryan<\/strong><\/p>\n\n\n\n

Duane Morris Takeaways:<\/em><\/strong>\u00a0 On September 30, 2026, California Governor Newsome signed Senate Bill 690<\/a>, which amends the California Invasion of Privacy Act (\u201cCIPA\u201d) to eliminate the private right of action under California Penal Code \u00a7 638.51 for pen register and trap-and-trace device claims arising from website, online application, and mobile application activity. Under the amended statute, only the California Attorney General may bring such claims against private actors. The law takes effect on January 1, 2027, and it applies retroactively to any pending claim in an action commenced within two years before that date. For the thousands of companies now facing CIPA \u00a7 638.51 class actions and demand letters over the use of pixels, cookies, and similar website advertising technologies (\u201cadtech\u201d), Senate Bill 690 offers significant and fast relief. It is not, however, the end of CIPA litigation. The wiretapping provision (\u00a7 631) and the eavesdropping provision (\u00a7 632), which plaintiffs have also used in adtech cases, are untouched.<\/em><\/p>\n\n\n\n

The bill\u2019s final form is much narrower than the version first introduced. As introduced, Senate Bill 690 would have exempted all processing of personal information for a “commercial business purpose” as defined by the California Consumer Privacy Act (\u201cCCPA\u201d) from civil and criminal liability under all three sections of the CIPA. See Assembly Committee On Privacy And Consumer Protection Committee Report (July 1 , 2026) (\u201cCommittee Report\u201d) at 6-7<\/a>. The analysis in our blog post covers the legal landscape that led to the bill, the scope and mechanics of the enacted statute, how the bill narrowed during the legislative process, and what corporate counsel and class action practitioners should do now.<\/em><\/p>\n\n\n\n

Background<\/strong><\/p>\n\n\n\n

The CIPA was adopted in 1967 to criminalize wiretapping, eavesdropping, interception, and recording of telephone communications without court authorization. Section 637.2 confers a private right of action to any person injured by a violation of the CIPA. Available relief includes statutory damages of $5,000 per violation, three times the actual damages suffered by the plaintiff, if any, and injunctive relief. Section 637.2(c) specifically provides that plaintiffs do not need to show actual damages. The Assembly Committee on Privacy and Consumer Protection observed that, in the adtech context, these violations \u201ccan stack up rapidly, causing defendants to face potentially devastating liability.\u201d See<\/em> Committee Report at 7.<\/p>\n\n\n\n

Recent adtech litigation has relied on three CIPA provisions: \u00a7 631 (wiretapping), \u00a7 632 (recording confidential communications), and \u00a7 638.51 (pen registers and trap-and-trace devices). Section 638.51 was added only in 2015, and according to the Assembly Committee on Privacy and Consumer Protection, the Legislature gave \u201clittle, if any, thought\u201d to how it would apply online or interact with the CIPA\u2019s private right of action. See<\/em> Committee Report at 1. The Committee called the pen register and trap and trace device statute \u201ca poster child for abusive lawsuits,\u201d explaining that \u201c[b]ecause the potential liability can be staggering, businesses generally settle this litigation hastily, encouraging vexatious litigants to continue blasting out demand letters.\u201d See id<\/em>. at 1.<\/p>\n\n\n\n

The case law gave businesses little certainty.  For example, federal district courts in California are split as to whether third-party collection of website-user information may constitute a trap and trace device or pen register under \u00a7 638.51.  California state trial courts, by contrast, have mostly dismissed these claims, as in Licea v. Hickory Farms LLC<\/em>, No. 23STCV26148, 2024 WL 1698147 (Cal. Super. Ct. Mar. 13, 2024), Casillas v. Transitions Optical, Inc<\/em>., No. 23STCV30742, 2024 WL 4873370 (Cal. Super. Ct. Sep. 9, 2024), and Sanchez v. Cars.com Inc<\/em>., No. 24STCV13201, 2025 WL 487194 (Cal. Super. Ct. Jan. 27, 2025). The Committee noted that there is no published California appellate authority applying \u00a7 638.51 to software. See<\/em> Committee Report at 16. According to the bill\u2019s sponsors, \u00a7 638.51 lawsuits rose from about 600 to nearly 4,000 after SB 690 was introduced, and tens of thousands of businesses received demand letters. See id<\/em>. at 7.<\/p>\n\n\n\n

What Does SB 690 Change?<\/strong><\/p>\n\n\n\n

SB 690 amends only \u00a7 637.2, the CIPA\u2019s civil remedies provision. Its main features are as follows:<\/p>\n\n\n\n