Newsom Signs Law Ending Private Pen Register Lawsuits

Governor Gavin Newsom signed Senate Bill 690 on September 30, 2026, eliminating the private right of action for pen register and trap-and-trace claims under the California Invasion of Privacy Act (CIPA) when they arise from conduct on websites or applications. The law designates the California attorney general as the sole party permitted to bring such actions against private actors. It applies retroactively to pending claims commenced on or after January 1, 2025, and becomes operative on January 1, 2027.

The legislation targets a surge of high-volume litigation and demand letter campaigns that targeted businesses using standard analytics and tracking technologies, such as Google Analytics and HubSpot. Previously, these claims exposed businesses to statutory damages of $5,000 per violation. Following the bill's passage, Lofty, a real estate CRM platform that had filed a federal declaratory judgment action to combat these lawsuits, voluntarily dismissed its case.

While the law removes the scalable pen register theory, it does not provide a total remedy for website operators, as private litigants can still pursue claims under other CIPA provisions regarding wiretapping or federal privacy laws. Governor Newsom noted that the final version of the law is narrower than the original bill and stated that additional work is needed to address other decades-old statutes within CIPA that remain susceptible to abuse by aggressive litigants.