California SB 690 Spares Email Pixel Wiretap Suits

Business groups spent eighteen months lobbying for SB 690 as the fix for a litigation wave that has produced thousands of California lawsuits over cookies, session replay scripts and tracking pixels. What the Assembly Privacy Committee advanced on July 1 is a different bill.

The broad exemption is gone. What survives reaches two Penal Code sections plaintiffs treat as a secondary count. The wiretap provision they build the actual complaint around was not amended at all.

Key Takeaways

• The Assembly Committee on Privacy and Consumer Protection advanced SB 690 by a vote of 14 to 0 on July 1, 2026, according to the official vote record.
• The amended bill reaches only Penal Code sections 638.50 and 638.51, the pen register and trap and trace provisions, and hands enforcement to the California Attorney General alone.
• CIPA sections 631 and 632, the wiretap and eavesdropping provisions carrying most email tracking pixel class actions, were dropped from the bill and remain enforceable by private plaintiffs.
• Retroactivity reaches back two years from the operative date of January 1, 2027, extinguishing pending section 638.51 claims commenced on or after January 1, 2025.
• The Legislature reconvened August 3, 2026 and must pass SB 690 before adjournment on August 31, 2026 for it to take effect.

What Did SB 690 Originally Propose, and What Does It Do Now?

It began as a rewrite of the California Invasion of Privacy Act and ended as a carve out for one statute. Senator Anna Caballero introduced SB 690 in February 2025 to amend Penal Code sections 631, 632, 632.7 and 638.50, adding a defense that defeated liability whenever the technology served a "commercial business purpose" — nearly every analytics and advertising tool a company runs.

All of it was cut. As Shook, Hardy & Bacon summarized, the surviving version applies only to sections 638.50 and 638.51, removes the private right of action and leaves enforcement with the Attorney General.

The operative language now sits in Penal Code section 637.2, which creates CIPA's civil remedy. The amended text reads: "An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General." One statute. One category of conduct.

Why Did Plaintiffs Start Calling a Tracking Pixel a Pen Register?

Because the theory sidesteps the hardest element of a wiretap claim. Sections 638.50 and 638.51 were written for devices recording the routing and addressing information of a phone call rather than what was said, and installing one without a court order is prohibited outright.

In Greenley v. Kochava, a court found that software identifying consumers, gathering data and correlating it through unique fingerprinting falls within CIPA's pen register definition. K&L Gates traced how the plaintiffs' bar generalized that holding into a theory that almost any tool profiling a visitor qualifies.

The appeal is procedural. A pen register claim requires no proof that anyone read the contents of a communication, and no interception while the message was moving — only that a process captured identifying signals. For a hidden image reporting an IP address and a timestamp, that is a far shorter walk.

Why Section 631 Is the Lane That Actually Matters

Section 631 is the wiretap provision, it carries the same $5,000 per violation damages, and SB 690 does not touch it. It bars reading or learning the contents of a communication in transit without the consent of all parties. Plaintiffs argue a pixel firing the instant an email is opened meets that timing requirement, and courts have divided.

Most coverage frames the July amendments as CIPA reform. That framing is generous. Look at how these complaints are built: in Krzyzek v. OpenX Technologies (N.D. Cal.), the court denied nearly all of the defendant's motion to dismiss in January 2026, letting claims under sections 631(a) and 638.51, the federal Electronic Communications Privacy Act and intrusion upon seclusion proceed to discovery. Both CIPA counts were pled side by side in one complaint.

Strike 638.51 and the case does not end. It loses a count. Defendants still face discovery, class certification and a wiretap theory the bill leaves unclarified. Courts remain split on whether a pixel load is an interception — see the Blue Shield Meta Pixel suit a judge tossed in July 2026 on standing rather than the merits.

How Big Is the Tracking Litigation Wave?

Large enough that the bill's author watched her caseload estimate multiply nearly sevenfold in committee. Troutman Pepper Locke reported that Senator Caballero cited roughly 600 cases at introduction in early 2025, a figure that had exploded past 4,000 by the July 2026 hearing, with most filings traced to four law firms.

Kelley Drye's CyberAdviser reported that plaintiffs' firms have collected over half a billion dollars in settlement payments on these claims, with demands typically between $10,000 and $25,000 — priced deliberately below the cost of defending.

Geography is the underappreciated number. The CIPA Lawsuit Tracker counted 3,968 pending cases in California at the end of July 2026, against 811 in Florida and 108 in Illinois — roughly 81 percent of that three state docket in one jurisdiction. One legislature's drafting therefore sets the practical rules almost everywhere, including for health data cases like the order forcing Google and Meta into discovery over prescription pixel data.

What Do Retroactivity and Attorney General Enforcement Change in Practice?

Together they convert a live class action risk into a regulatory one, backward in time. The amendments "apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation." Stoel Rives reads that as a 24 month retroactivity period running from the operative date of January 1, 2027 — so pending pen register claims commenced on or after January 1, 2025 would be wiped out the day the law takes effect.

For a defendant the calculus shifts now: a pure 638.51 case filed in 2025 becomes a wasting asset in any settlement negotiated before January. A case pleading section 631 alongside it barely moves.

For consumers, losing a private right of action means losing the only remedy most people will ever practically have, since the Attorney General's office prosecutes a handful of privacy matters a year, not thousands.

What This Means for Your Inbox

If you open marketing email in Gmail, nothing about SB 690 changes what the sender learns. The pixel still loads. It reports that you opened the message, roughly where you were, what device you used and how long it stayed on screen. The only question in Sacramento is which statute a lawyer may cite eighteen months from now.

The arithmetic explains why senders care. CIPA sets damages at $5,000 per violation, so one campaign to 100,000 California recipients, if every open counted once, carries $500 million in nominal exposure — matching everything plaintiffs' firms have reportedly extracted across this entire wave. No court has awarded anything close, and standing defenses kill many cases early. But that number is why marketing teams are rewriting consent flows.

Your takeaway is simpler. The fight over whether a pixel firing is a wiretap has run four years without resolution, and SB 690 removes one theory without answering it. Blocking remote images, or using an extension that strips pixels before they load, ends the collection today rather than arguing about it in 2029. Our comparison of ways to block email tracking in Gmail covers the options.

What to Watch

Four dates and an open question decide this. The official bill history tracks movement fastest.

• August 3, 2026. The Legislature reconvened. SB 690 sits in Assembly Appropriations and must clear it before any floor vote.
• August 31, 2026. Adjournment. Miss it and the bill dies for the session.
• January 1, 2027. Operative date if the bill is passed and signed.
• January 1, 2025. The far end of the retroactivity clock, and the cutoff for which pending claims get extinguished.
• The appellate courts. California appeals courts are weighing whether section 638.51 reaches website technology at all. A ruling for defendants makes the bill redundant; a ruling for plaintiffs makes passing it urgent.

Watch one more thing after August: whether anyone reintroduces the section 631 language. The coalition traded it away to get something through committee, and the wiretap theory is what generates the filings. That fight was deferred, not settled.

Sources: California Legislative Information, SB 690 text and votes, Shook, Hardy & Bacon, Troutman Pepper Locke, Stoel Rives and Kelley Drye CyberAdviser (all July 2026), K&L Gates on pen register claims, and Krzyzek v. OpenX Technologies (N.D. Cal. Jan. 27, 2026).