California Ends Private Right to Sue Over Internet Tracking Under CIPA
Governor Gavin Newsom has signed Senate Bill 690 into law, marking a significant change to the California Invasion of Privacy Act (CIPA), a wiretapping statute originally enacted in 1967. The new law eliminates a provision that allowed residents to sue companies for unauthorized use of pen register and trap-and-trace technologies when applied to internet-based communications such as website tracking, cookies, and analytics tools.
This provision was added to CIPA in 2015, granting individuals a private right of action with statutory damages of up to $5,000 per violation, plus the potential for triple damages. Since its addition, privacy attorneys report that the provision has led to a surge in litigation and demand letters directed at businesses using common web tracking tools.
Rise in Litigation Prompts Legislative Action
According to the Alliance for Legal Fairness, a Virginia-based lobbying group that supported the bill, approximately 600 lawsuits were filed under the pen register provision in 2025. The group now claims that number has "exploded" to over 4,000 cases. Privacy attorneys from Pillsbury law firm, Shruti Bhutani Arora and Christine Mastromonaco, stated that plaintiffs have sent "tens of thousands" of demand letters to businesses threatening class-action suits over the use of everyday website tools like cookies, tracking pixels, and analytics software.
The California Assembly Committee on Privacy and Consumer Protection described the pen register provision as "the poster child for abusive lawsuits," noting that enterprising plaintiffs' attorneys have exploited the statute at scale to target businesses using third-party advertising and tracking software. The committee warned that the potential for staggering liability leads many businesses to settle quickly, encouraging further demand letter campaigns.
Business Support and Privacy Opposition
SB 690 received broad backing from business organizations, including the California Chamber of Commerce, which was among hundreds of groups that signed in support of the legislation. Proponents, including Governor Newsom, argue that the original 2015 provision has led to frivolous lawsuits against small businesses that unknowingly deploy tracking software for legitimate purposes.
In his signing statement, Newsom said the measure addresses the "vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses" and praised the authors for protecting companies from overzealous litigation based on a statute written before today’s complex digital landscape.
However, the bill faced strong opposition from privacy and civil rights advocates. Major California labor unions, the American Civil Liberties Union, the Consumer Federation of California, the Privacy Rights Clearinghouse, the Electronic Privacy Information Center, and dozens of other groups opposed the change. The Electronic Frontier Foundation (EFF) has actively campaigned against the bill for years.
Privacy Groups Warn of Eroded Protections
Privacy experts argue that removing the private right of action undermines a key enforcement mechanism for digital privacy. Hayley Tsukayama, director of state affairs at the EFF, told CyberScoop that the bill "never should have been signed" and that the organization failed to persuade Newsom to veto it.
Tsukayama emphasized that CIPA was originally designed to protect individuals from surveillance of private communications, but the amendment now prevents ordinary people from taking legal action against companies engaged in unlawful metadata collection. She warned this is particularly concerning as law enforcement and data brokers increasingly seek personal data to target individuals based on political beliefs, religious affiliations, or health-related information.
Despite the rollback of this enforcement tool, California maintains other strong privacy protections. The state passed comprehensive privacy legislation in 2018, establishing the California Privacy Protection Agency to enforce digital privacy laws. It also has some of the strictest data broker regulations in the country, requiring brokers to register with the state and offering consumers universal opt-out mechanisms for data collection and sharing.
Source: CyberScoop