California SB 690 Signed Into Law: What Changes for CIPA Website Tracking Claims in 2027?

For businesses responding to a CIPA demand letter and attorneys reviewing tracking allegations, the central technical question remains: What did the website actually do in the relevant browser session? Detection of a pixel, execution of a script, an observable network request, and a legal conclusion are different things.

Below, we explain the enacted law, its timing and limits, how counsel may approach existing matters, and where browser-level evidence and consent-state testing can still help.

Technical scope note: Auditzo provides technical website evidence, consent-state testing, and remediation-oriented observations. We do not provide legal advice, determine whether CIPA has been violated, evaluate the legal viability of a claim, or predict litigation outcomes. Qualified counsel should evaluate how SB 690 or any other legal development applies to a particular matter.

---

SB 690 Status: Signed, Chaptered and Effective Date

California SB 690 was approved by Governor Gavin Newsom on September 30, 2026 and filed with the Secretary of State the same day as Chapter 976, Statutes of 2026. It had passed the Legislature on August 28, 2026 and was presented to the Governor on September 4.

Being signed into law is not the same as already being effective. SB 690 is a non-urgency regular-session measure. Under California's general effective-date rule, its amendment is scheduled to take effect on January 1, 2027. As of this article's October 23, 2026 update, that effective date is still in the future.

Read the official bill history and chaptered bill text. California's default effective-date rule is stated in Government Code Section 9600.

---

What SB 690 Changes Under Sections 637.2 and 638.51

SB 690 amends California Penal Code Section 637.2, the provision that provides civil remedies for certain CIPA violations. It adds a specific limitation concerning claims involving Section 638.51, the pen-register and trap-and-trace provision.

Under the enacted Section 637.2(d)(1), an action under Section 637.2 against a private actor for an alleged Section 638.51 violation arising from conduct occurring on an internet website, online application, or mobile application may be brought only by the California Attorney General. This change is scheduled to operate beginning January 1, 2027.

That language is narrower than saying that Section 638.51 has been repealed, that all CIPA actions are barred, or that any third-party tracking practice is necessarily permissible. The statute and the alleged conduct still need to be examined separately.

Does SB 690 apply to pending cases?

The enacted Section 637.2(d)(2) states that the amendments apply retroactively to a pending claim in an action commenced within two years before the legislation's operative date. Given the scheduled January 1, 2027 effective date, the referenced two-year period begins January 1, 2025.

That provision does not, by itself, establish whether a particular pre-suit demand, filed action, arbitration, or procedural dispute is affected. Questions about case posture, the alleged cause of action, timing and retroactive application belong to qualified California counsel.

The controlling source is the chaptered text of SB 690, not older descriptions of the bill as a proposal.

---

What SB 690 Does Not Do

The law should not be summarized as ending all CIPA website-tracking litigation. It changes the availability of a particular civil action for a defined category of Section 638.51 website and application allegations against private actors.

SB 690 does not amend California Penal Code Section 631. Section 631 addresses different alleged conduct involving communications and can raise different questions about the nature of an interaction, third-party participation, consent and what information was observable in transit.

The law also does not resolve obligations or potential issues that may arise under other statutes, consent requirements, contractual commitments, vendor practices, or a business's own privacy representations.

It is not a legal safe harbor for every pixel, analytics tool, chat widget, session-replay script, or consent implementation. Which legal obligations apply, and whether any claim succeeds, must be evaluated by counsel based on the facts and current law.

---

Why This Matters if You Already Received a CIPA Demand Letter

If a business has already received a CIPA website-tracking demand letter, SB 690 may affect counsel's assessment, but its significance depends on what the letter alleges and the status of any action.

A demand based only on Section 638.51 is not identical to one invoking Section 631, several CIPA provisions, or other legal theories. The statutory language concerning pending claims in actions also should not be casually equated with every pre-suit demand letter.

A law being signed does not automatically resolve every existing demand or case, particularly before its effective date.

Qualified counsel should evaluate the alleged provisions, deadlines, case posture, statutory timing and retroactivity clause. Technical teams can separately determine whether the conduct alleged is observable, reproducible, or supported by available historical records.

If the matter is active, Auditzo's CIPA Demand Letter Technical Evidence Guide explains how to preserve the relevant website state, review supplied artifacts, and translate allegations into testable technical questions.

---

Why Technical Website Evidence Still Matters

SB 690 changes a specified civil-action remedy starting in 2027. It does not tell an attorney or business what a website actually did during a particular browsing session.

Those are separate questions.

A modern website may contain analytics tools, advertising pixels, tag managers, chat widgets, session technologies, ecommerce integrations, CRM scripts, consent tools, and other third-party components.

Determining whether one of those technologies was merely present, actually executed, generated a network request, transmitted observable values, or behaved differently based on consent requires technical investigation.

Depending on the matter, useful technical questions can include:

• Which third-party technologies were present?
• Which technologies actually executed during the tested session?
• Which external domains received browser requests?
• What observable parameters or payload fields were transmitted?
• Did relevant requests occur before any consent interaction?
• What changed after Accept?
• What changed after Reject or Decline?
• Did cookies or browser storage differ between consent states?
• Which user action preceded a particular request?
• Can the behavior identified in a demand letter still be reproduced?
• Has the website configuration changed since the alleged event?

These questions do not determine whether CIPA or another law was violated.

They establish a technical record that counsel, privacy teams, developers, and other qualified reviewers can evaluate in the context of the matter.

---

Detection Is Still Not the Same as Transmission

One recurring problem in website-tracking disputes is collapsing several different technical stages into one conclusion.

1. Technology Detection

A script, tag, cookie, integration, domain, or technology signature is identified.

Detection can establish the presence of a technology or technical indicator.

It does not necessarily establish what occurred during the relevant browsing session.

2. Execution

The relevant browser-side technology actually executes or initializes.

This is stronger behavioral evidence, but execution alone does not describe every communication that may result.

3. Network Transmission

The browser makes an observable request to an external or internal endpoint.

At this stage, a technical reviewer may be able to examine:

• destination
• timing
• HTTP method
• request structure
• observable parameters
• payload fields where visible
• initiator information
• consent and session context

4. Technical Interpretation

A reviewer evaluates what those artifacts demonstrate about observable browser behavior.

Limitations still matter. Browser-side evidence, for example, may not reveal every process that occurs after information reaches an external server.

5. Legal Interpretation

Qualified counsel evaluates technical findings against the statute, asserted theory, relevant authority, consent issues, procedural posture, defenses, exceptions, and other legally material facts.

These stages should not be treated as interchangeable.

The presence of a pixel does not, by itself, establish every factual or legal claim that could be made about that pixel.

---

What About Section 631 Website-Tracking Claims?

SB 690 does not amend Section 631.

Businesses should therefore not assume that the enacted Section 638.51 civil-action change, once effective, automatically resolves allegations based on Section 631.

Section 631 uses different statutory language and may require counsel to evaluate different factual and legal questions.

From a technical perspective, this can make it important to understand exactly what happened during a particular interaction rather than relying only on a list of detected tracking technologies.

Depending on the allegation and agreed scope, a technical review may examine interactions such as:

• website searches
• lead-generation forms
• contact forms
• chat interactions
• checkout or shopping-cart events
• account or signup workflows
• appointment or quote requests
• analytics events
• advertising events
• session technologies
• third-party scripts triggered by a user action

The technical objective is to connect an interaction to observable browser behavior and supporting evidence.

User action -> Browser behavior -> Supporting artifact -> Technical interpretation

Qualified counsel determines the legal significance of that record.

---

Do Not Confuse Legislative Change With Website Remediation

Another mistake would be to interpret SB 690 as a reason to stop reviewing consent and tracking behavior.

The legislative development does not automatically answer whether a website's consent implementation works as intended.

A business may still need to know whether optional technologies activate before a consent choice, whether a Reject choice suppresses the expected requests, whether browser storage persists, or whether an integration operates outside the site's primary consent mechanism.

Those questions can remain relevant to privacy programs, other regulatory frameworks, client requirements, internal governance, vendor oversight, technical remediation, and counsel-directed review independently of the particular Section 638.51 private-action issue addressed by SB 690.

Where deeper behavioral testing is required, Auditzo's Manual Evidence Audit compares observable website behavior across defined sessions rather than relying only on a tracker inventory.

---

If Your Website Is Being Reviewed Now, Preserve the Current State

Website technology can change quickly.

A developer can republish a Google Tag Manager container. A consent rule can be modified. A Shopify or WordPress application can update. A marketing platform can change its implementation. A pixel can be removed or replaced.

Once that happens, a current test may no longer reproduce the environment that existed when a demand letter, complaint, or technical allegation was created.

Depending on the matter and counsel's direction, potentially relevant technical material can include:

• HAR or browser network captures
• timestamped screenshots
• screen recordings where appropriate
• cookie and browser-storage records
• tag-manager versions
• consent-management platform configuration
• available consent records
• deployment history
• integration settings
• relevant application or plugin versions
• relevant server or platform records where available
• technical evidence supplied with the demand or complaint

Not every matter requires every artifact.

The goal is not maximum data collection. The goal is relevant, traceable, and reproducible evidence.

For a deeper methodology, see Auditzo's Website Tracking Evidence Preservation Guide for Legal Review.

---

What Businesses Should Do Now

After SB 690's signing, businesses reviewing website-tracking allegations should separate legal analysis from technical fact-finding, while allowing those workstreams to inform each other.

1. Confirm the applicable law and timing with counsel

Use the chaptered text, not an outdated summary of the bill. The Section 637.2 amendment is scheduled to become effective January 1, 2027, and its effect on a pending matter requires case-specific legal review.

2. Identify exactly which legal theories are alleged

Determine whether the relevant materials refer to Section 638.51, Section 631, both, or a different framework. Technical auditors should not decide which theory succeeds.

3. Preserve relevant evidence before material changes

Where preservation is appropriate, coordinate with counsel and document relevant website behavior and configuration before making material changes. Preserve the original demand materials and relevant technical artifacts as well.

4. Test actual browser behavior under defined conditions

Scope the relevant pages, geography, browser state, consent choices and user interactions. Examine request timing, observable payload details, cookies and storage rather than treating a list of detected tools as proof of what was transmitted.

5. Keep historical observations separate from remediation

If the website is changed, retain dated evidence and maintain a change log so the current state is not presented as a substitute for an earlier state.

6. Verify the result of every material fix

Do not assume a tag-manager update, CMP rule, app change or code deployment changed browser behavior as intended. Run defined post-fix sessions and document the results.

Auditzo's Post-Remediation Verification service is organized around this before-and-after distinction.

---

When Does SB 690 Take Effect?

January 1, 2027 is the scheduled effective date for SB 690's amendment of Section 637.2. The measure was signed and chaptered September 30, 2026; as of October 23, 2026, it is enacted but has not yet reached its effective date.

This timing matters when evaluating current allegations and pending proceedings. Its retroactivity language must be read alongside the text of the amended provision and the specific procedural facts. Auditzo does not interpret how those rules determine the outcome of a particular claim.

The legal treatment of a claim may change; that does not rewrite the website's historical technical behavior. Browser captures, consent-state observations, relevant configuration history and other traceable evidence may still matter for counsel review, another legal theory or remediation.

---

How Auditzo Supports CIPA-Related Technical Review

Auditzo provides technical website evidence support for businesses, law firms, privacy professionals, and technical teams reviewing website-tracking behavior.

Unlike a generic scanner-only approach, a matter-specific review can be designed around the actual technical questions raised by a demand, complaint, remediation effort, or counsel-directed investigation.

Depending on the agreed scope, a review may include:

• clean browser sessions
• initial-state observations
• Accept and Reject consent comparisons
• specific user-journey reproduction
• third-party request analysis
• HAR and browser network evidence
• cookies and browser storage
• timestamped screenshots
• review of supplied technical evidence
• finding-to-evidence references
• technical limitations
• remediation-oriented observations
• post-remediation verification

Auditzo does not decide whether SB 690 eliminates a claim, whether CIPA was violated, whether a demand should be settled, or whether litigation should proceed.

Our role is to establish what can be observed technically and organize that evidence so qualified counsel and technical teams have a clearer factual record.

For a practical example of how technical investigation and subsequent remediation can be documented separately, see our CIPA Website Tracking and WCAG Accessibility Remediation Case Study. The case study describes scoped technical work and implementation outcomes; it is not a legal determination or certification of full compliance.

Legal teams can review Auditzo's Technical Website Evidence Support for Law Firms. Businesses needing deeper human-reviewed testing can explore the Manual Evidence Audit.

---

Frequently Asked Questions About SB 690 and CIPA Website Tracking

Has California SB 690 Become Law?

Yes. Governor Gavin Newsom signed SB 690 on September 30, 2026, and it was chaptered as Chapter 976, Statutes of 2026. The amendment is scheduled to take effect January 1, 2027. Signing and effectiveness are separate dates.

See the official status record.

What Does SB 690 Change for Private Section 638.51 Website Claims?

Once effective, the new Section 637.2(d)(1) provides that an action under Section 637.2 against a private actor for an alleged Section 638.51 violation arising from conduct on an internet website, online application or mobile application may be brought only by the California Attorney General.

That specific rule should not be confused with repeal of Section 638.51 or elimination of all potential website-tracking claims.

Does SB 690 Eliminate All CIPA Website-Tracking Claims?

No. The enacted amendment addresses a defined category of Section 638.51 civil actions under Section 637.2. It does not amend Section 631, and it does not itself determine a website's obligations under other potentially applicable laws or agreements.

Does SB 690 Apply Retroactively?

The enacted text says that the amendment applies retroactively to a pending claim in an action commenced within two years before the legislation's operative date. With the scheduled January 1, 2027 effective date, that window begins January 1, 2025.

Whether the clause applies to a particular action, demand, arbitration or procedural setting is for qualified counsel to assess; a pre-suit demand should not be assumed to be the same as a pending claim in an action.

Should Businesses Stop Reviewing Website Tracking Because SB 690 Was Signed?

No.

Website tracking behavior can remain relevant to other legal theories, privacy frameworks, consent requirements, contractual obligations, internal governance, vendor oversight, remediation, and technical risk management.

Separately from legal requirements, a business may simply need to know whether its website behaves as intended.

Does Finding Meta Pixel, Google Analytics, or Another Tracker Establish a CIPA Violation?

No.

Detection establishes that a technology or technical indicator was observed.

It does not automatically establish execution, network transmission, the complete contents of a request, or the legal significance of the observed behavior.

Can a Website Scan Tell Us What Was Transmitted?

An automated scan can help identify technologies, cookies, external domains, requests, and other technical signals.

A matter-specific investigation may require deeper human-reviewed testing, including HAR analysis, user-journey reproduction, request inspection, consent-state comparison, cookies, browser storage, and evidence supplied with the allegation.

Should I Remove Tracking Technologies Immediately After Receiving a CIPA Demand?

Auditzo does not make that legal or business decision.

From a technical evidence perspective, businesses and counsel should consider whether relevant current-state behavior needs to be documented before material configuration changes are made.

What If the Website Has Already Been Changed?

A current audit can establish what is observable now.

Historical conclusions may require earlier HAR files, screenshots, logs, configuration history, tag-manager versions, consent records, deployment history, or other timestamped evidence.

Current behavior should not be represented as proof of historical behavior unless the available evidence supports that conclusion.

Can Auditzo Determine Whether SB 690 Defeats Our Demand Letter or Lawsuit?

No.

That is a legal question for qualified counsel.

Auditzo can investigate and document website behavior, reproduce scoped interactions where reasonably possible, compare consent states, review supplied technical artifacts, and explain what the technical evidence does and does not establish.

---

Received a CIPA or Website-Tracking Demand?

If you received a tracking-related demand or are reviewing a high-risk website configuration, involve qualified counsel for legal decisions and preserve relevant technical evidence before material changes where appropriate.

Start with Auditzo's CIPA Demand Letter Technical Evidence Guide to understand evidence preservation, allegation-specific testing, HAR review, consent-state comparison, and technical evidence organization.

If the matter requires human-reviewed browser testing, Auditzo can scope a Manual Evidence Audit around the specific URLs, technologies, workflows, consent states, and technical questions identified by the business or counsel.

Attorneys and legal teams can also review our Technical Website Evidence Support for Law Firms.

Legal rules can change. Reliable technical evidence starts with establishing what the website actually did.

---

Primary Sources and Further Reading

• California Legislature: SB 690 bill history and status
• California Legislature: SB 690 chaptered text, Chapter 976 (2026)
• California Penal Code Section 637.2
• California Penal Code Section 631
• California Government Code Section 9600 (general effective-date rule)

Originally published: September 9, 2026. Substantially updated: October 23, 2026. This is general educational and technical information, not legal advice. Legal outcomes depend on facts and applicable law.