California Law Will Protect Small Businesses from Website Nuisance Lawsuits

SACRAMENTO, CALIFORNIA (October 6, 2026) – California Governor Gavin Newsom signed Senate Bill 690 into law to protect small businesses from website nuisance lawsuits. The law goes into effect January 1, 2027.

Newsom wrote to the members of the California State Senate:

“I am signing Senate Bill 690, which eliminates the private right of action under the California Invasion of Privacy Act (CIPA) for violations of the pen register and trap-and-trace statute arising from conduct occurring on an internet website, online application, or mobile application.

“This measure addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses that unwittingly install software on their websites that at times have tracked and shared the information of visitors to the site. I applaud the author’s efforts and align myself with the goal of protecting small businesses from overzealous lawsuits based on a statute written without today’s complex technological landscape in mind. However, additional work in this area is needed, as CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants. I urge the Legislature to take this on next year to ensure a fair balance between protecting private and preventing rapacious litigation.”

The law would not eliminate CIPA 631/632 claims or website tracker claims including the Electronic Communications Privacy Act (ECPA) and California’s Computer Data Access and Fraud Act, according to the law firm of Covington & Burling LLP. The law would:

• Eliminate private lawsuits for website-based pen register claims. Claims arising from conduct “occurring on an internet website, online application, or mobile application” could be brought “only by the Attorney General.”
• Apply to certain pending claims. The bill would apply retroactively to “any pending claim” in an action commenced on or after January 1, 2025, potentially affecting many pending lawsuits.
• Preserve Attorney General enforcement. The bill would keep enforcement authority with the Attorney General.
• Leave other CIPA claims intact. The bill would not alter private rights of action under CIPA’s wiretapping provision (Section 631) or confidential recording provision (Section 632).