California Narrows Private Right of Action for Website Tracking Under Privacy Law

California enacted Senate Bill 690, which restricts when private parties can sue under the California Invasion of Privacy Act regarding online tracking technologies like cookies and pixels. The law takes effect January 1, 2027, and includes a two-year lookback period for lawsuits filed before enactment, potentially affecting pending cases. The legislation represents a significant shift from recent litigation trends where plaintiffs had increasingly targeted websites under theories that web-based tracking mechanisms should be treated like traditional pen registers and trap-and-trace devices.

California's 1967 privacy law originally targeted telephone surveillance technologies, establishing penalties of at least $5,000 per violation for unauthorized interception of communications. Over recent years, plaintiffs began reinterpreting these provisions to apply to modern web technologies—cookies, pixels, and tracking tags—arguing they function similarly to traditional wiretapping devices by capturing visitor data and digital activity patterns.

Senate Bill 690 fundamentally reshapes enforcement by removing individuals' ability to sue over these digital tracking claims. The law's retroactive two-year lookback period means pending cases filed in the months before enactment may be dismissed or substantially altered. However, private citizens retain the right to pursue other CIPA violations, such as unauthorized wiretapping or recording of communications, while the California Attorney General retains exclusive authority over digital-tracking disputes.