Skip to content
Brief Security & Trust ·

California ends private suits over cookies and pixels under part of wiretap law

SB 690 removes the private right to sue only under the pen-register and trap-and-trace provisions of a 1967 law.

In brief
  • Newsom signed SB 690, ending private suits under the pen-register and trap-and-trace provisions only. Earlier versions were broader.
  • Lawsuit counts differ by source. CyberScoop does not give a start date or say what happens to pending cases.

CyberScoop reported on 6 October that Governor Gavin Newsom signed SB 690 last week. It ends residents' right to sue websites and apps under one part of California's 1967 wiretapping law. That part, added in 2015, covers pen registers: tools that log metadata such as phone numbers, IP addresses and timestamps, not content. Each violation could cost up to $5,000, and damages could be tripled. Newsom and sponsors say it fueled thousands of suits and demand letters over tools like browser cookies.

Per CyberScoop, the final exemption covers only pen-register and trap-and-trace claims, after earlier versions were broader. CyberScoop does not discuss other state or federal privacy claims, a start date, or pending cases. The Alliance for Legal Fairness, a lobbying firm backing the bill, counted about 600 suits in 2025 and now claims over 4,000. The EFF opposed the bill; the Chamber of Commerce backed it.

Interpretation: this closes one lawsuit route but leaves data collection itself unchanged. Cookies, analytics software and pixels still gather visitor data. Teams could list their third-party tools and decide how to handle demand letters already received.

A WebPulse Brief: a short report of an important event, written by the WebPulse Newsroom with AI assistance and checked against the reporting below. When there is more to explain, we follow up with a full story. How we use AI.

Reporting: CyberScoop.