What SB 690 Changes About Tracking Demand Letters for Your Store

SB 690, signed on September 30, 2026, takes effect on January 1, 2027. It stops private plaintiffs from suing over website trackers under one section of the state's privacy law, the "pen register" section. The wiretap section, the other common basis for tracking demand letters, is untouched. The letters will keep coming. Their argument will change.

I have spent thirty years in security and hold CISSP and PCIP certifications. I am not a lawyer, and nothing here tells you what your letter means or whether to settle. What I can explain is which part of the technical claim changed, because that part is checkable from outside your store.

What did SB 690 actually change?

From January 1, 2027, claims under section 638.51 of the California Invasion of Privacy Act (CIPA) that arise from a website, online application or mobile app can only be brought by the California Attorney General. A visitor and their law firm can no longer bring that claim themselves. Nothing else in CIPA moves.

The Legislature passed the bill unanimously on August 28, 2026, and Governor Newsom signed it on September 30, according to DLA Piper's October 2026 alert. It amends the section of CIPA that says who may sue, not the sections that say what is unlawful.

What is a "pen register" claim, and why did it matter?

A pen register was a device that recorded the numbers a phone line dialled, without listening to the call. Plaintiffs argued that a tracking pixel does the same thing online: it records who visited a page, from which device and address, and sends that to an advertising company. No message content was needed for the claim.

That made it cheap. Almost every store loads at least one tag that sends visitor details to a third party, so almost every store could be named. The theory took off after a 2023 federal ruling, Greenley v. Kochava, accepted that tracking software could be a pen register. The letters of the last two years leaned on it, and that is why the bill was written to remove it.

Which claims does SB 690 leave in place?

The wiretap and eavesdropping sections, 631 and 632, are not changed, and private plaintiffs can still bring them. So can claims under the federal Wiretap Act. The Attorney General can still enforce section 638.51, and the California Privacy Protection Agency still enforces the CCPA (California Consumer Privacy Act).

DLA Piper reports that plaintiffs are already shifting toward sections 631 and 632 and the federal statute. K&L Gates makes the same point: the bill does not touch the anti-wiretapping provisions these cases often cite.

A wiretap claim is harder to make. The plaintiff has to show that a third party captured the content of what a visitor communicated, while it happened. Holland & Knight calls that a "steeper hill" than proving a tag loaded and sent an IP address.

Does SB 690 help if a letter already arrived?

Possibly. The law reaches lawsuits filed on or after January 1, 2025, and K&L Gates notes that plaintiffs may challenge that reach. It says nothing directly about letters sent before any lawsuit, which is what most merchants receive.

K&L Gates suggests that a business holding a letter built on section 638.51 may be in a stronger negotiating position. Whether yours is built on that section, and what to do about it, is counsel's call.

Will the demand letters stop?

Probably not. Holland & Knight expects them to continue, because paying a small settlement usually costs less than fighting one, even when the claim is weak. What should change is the theory in the letter, away from pen register claims and toward wiretap claims.

The same firm notes that defendants have been winning more often. It counts at least seven recent federal decisions refusing to certify website wiretapping cases as class actions. Holland & Knight defends these cases for a living. The count is real. The optimism is theirs.

My earlier guide to what a CIPA demand letter is said relief was not on the way. That was true when it was written in September, before the bill was signed. The part about section 631 still holds.

Which tools on my store matter more now?

The ones that can see what a shopper types. A wiretap claim needs content, so a chat widget, a session-replay tool or a form-analytics script sits closer to the centre of a section 631 claim than an analytics tag that only reports a page view. I'm reading this as an engineer. A lawyer may weigh it differently.

Chat claims are not new. In Licea v. Old Navy (2023), a federal court let part of a claim over a website chatbot go forward, as The Fashion Law reported. In Gutierrez v. Converse (2025), the Ninth Circuit sided with the retailer over its chat feature, Duane Morris noted. Courts have gone both ways. A chat widget is not an automatic loss, but it is where the fight has moved.

These widgets are common. In our September 2026 reference scan of 44 online store pages, 19 loaded a customer chat widget, and 6 of those were AI chat agents that read and answer what shoppers type. Three of the six checkout pages we reached loaded one too. We picked those 44 stores by hand, so don't read 19 of 44 as a rate for the whole web.

What should a store owner do this week?

Write down what your store runs before anything changes, then look hardest at the tools that see what shoppers type. You can start this without a lawyer or a developer. If a letter ever arrives, this record is the first thing your lawyer will ask for.

1. Record what loads before a visitor answers your banner. Our free Website Tracking Checker lists every advertising, analytics, session-replay and chat service a first-time visit sends data to, from outside your store.
2. List the tools that capture typing. Chat widgets, session replay, search and form analytics. Note which pages each one runs on, especially the checkout.
3. Check whether your banner holds tags back or only records a choice. Most banners only record it. Why your cookie banner is not blocking trackers walks through the difference.
4. Keep the record dated. If a letter arrives later, the first question is what was running on the date in the letter.

If you want that record kept for you, Store Health reads your store every week and keeps a dated history of what changed. It is free to start on the plans page. If a letter is already on your desk, notice triage is the quicker route.