What happened
On August 28, 2026 the California Legislature passed SB 690, a bill that would eliminate private lawsuits for website-based pen register claims under the California Invasion of Privacy Act. The bill would restrict such claims to actions brought only by the Attorney General and apply retroactively to pending claims filed on or after January 1, 2025. The measure now heads to Governor Newsom for signature, with an effective date of January 1, 2027 if signed.
Why it matters for trust and compliance
- Its status is passed. It is not law yet. Track it, but do not treat it as an obligation.
- The bill removes private rights of action for website pen register claims, potentially affecting many pending lawsuits.
- Takes effect January 1, 2027.
Who is affected
technology controller
Recommended actions
- Review consent, cookie and tracking practices against the requirement.
- Check that privacy notices describe the practices this addresses.