Home - Blank Rome LLP

Register to receive insights and analyses on breaking news and trends across varying industries.
<a class="link-primary mt-4" href="/subscribe">Subscribe</a>

Philadelphia, PA

New York, NY

Wilmington, DE

Cincinnati, OH

Princeton, NJ

Los Angeles, CA

Houston, TX

Tampa, FL

Shanghai

South Florida

Pittsburgh, PA

Washington, D.C.

Chicago, IL

Orange County, CA

Dallas, TX

Boston, MA

On June 3, 2025, the California Senate passed Senate Bill 690 ("SB 690") in a unanimous 35-0 vote, advancing a measure that would significantly limit lawsuits under the California Invasion of Privacy Act ("CIPA") against businesses using standard online technologies. Notably, the bill was amended prior to passage to remove its retroactivity provision, meaning it will not apply to pending cases. The bill now moves to the Assembly for further consideration.

core/paragraph

Over the last several years, CIPA—originally enacted in 1967 to address wiretapping and eavesdropping—has been repurposed by plaintiffs’ attorneys as a powerful tool to target online businesses for their use of common web technologies such as cookies, pixels, chatbots, and session replay tools. This has resulted in a dramatic surge of lawsuits, often class actions, alleging that these technologies constitute illegal “wiretapping” or the use of “pen registers” and “trap and trace” devices under CIPA. The business community, including small and mid-sized ecommerce companies, has faced a wave of demand letters and litigation, with businesses sometimes being coerced to settle rather than risk the threat of statutory damages and protracted legal battles. These lawsuits have been widely criticized as burdensome and predatory, creating significant legal uncertainty and financial risk for companies operating in California. In response, SB 690 was introduced to protect companies that use online tracking technologies for a commercial business purpose from violating CIPA.&nbsp;

Key Provisions and Scope of SB 690

SB 690 proposes to address this problem by introducing exemptions for activities conducted for “commercial business purposes” from several core CIPA provisions. The bill would exempt from liability the interception or recording of communications when done for a commercial business purpose. It also clarifies that the use of pen registers and trap and trace devices for commercial business purposes does not fall within the scope of CIPA’s prohibitions. Perhaps most significantly, SB 690 would bar private lawsuits for the processing of personal information for a commercial business purpose, effectively eliminating the private right of action for a wide range of CIPA claims related to online business activities.

The definition of “commercial business purpose” in SB 690 is closely tied to the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”). It encompasses the processing of personal information to further a business purpose as defined in the CCPA, such as operational purposes, auditing, security, marketing, and analytics. It also includes activities subject to a consumer’s opt-out rights under the CCPA and CPRA, such as the sale or sharing of personal information. The bill adopts the CCPA’s definitions of “personal information” and “processing,” ensuring consistency across California’s privacy statutes.

A particularly notable feature of SB 690, as originally proposed, was its retroactive application, which would have applied the bill’s provisions to any case pending as of January 1, 2026. However, this retroactivity provision faced significant opposition during the legislative process. On May 29, 2025, just before the Senate vote, the bill was amended to remove the retroactivity language. As passed by the Senate, SB 690 is now silent on retroactive application and would likely only apply prospectively.&nbsp;

The bill now proceeds to the Assembly, where it will undergo committee reviews, three readings, and a final vote. If both houses pass the bill in the same form, it will be sent to the Governor for approval.

Potential Implications for Businesses

The legislative intent behind SB 690 is clear: CIPA was never meant to regulate the types of routine online data collection and analytics now at issue in many lawsuits. Proponents of the bill argue that the CCPA and CPRA provide a comprehensive, modern framework for regulating online privacy, including robust notice and opt-out rights for consumers. SB 690 is intended to harmonize California’s privacy laws, prevent duplicative and conflicting legal standards, and curb abusive litigation that threatens both large and small businesses. By clarifying that business activities already regulated by the CCPA are not within the scope of CIPA, the bill aims to restore legal certainty and allow businesses to focus on compliance with California’s primary privacy statutes, rather than defending against costly and unpredictable CIPA lawsuits.

If enacted, SB 690 would dramatically reduce the risk of CIPA litigation for businesses that use standard online tracking and analytics technologies in compliance with the CCPA and CPRA. This would provide much-needed relief from the lawsuits that have proliferated in recent years, allowing companies to redirect resources away from legal defense of specious claims.

With the Senate’s passage of SB 690 and the removal of the retroactivity provision, the bill represents a significant potential shift in the legal landscape for online businesses operating in California. Its progress and any further amendments will be closely watched by stakeholders across the technology, ecommerce, and privacy sectors.

For more information or assistance, please contact <a href="/people/harrison-brown/" id="19173">Harrison Brown</a>, <a href="/people/ana-tagvoryan/" id="19295">Ana Tagvoryan</a>, Victor J. Sandoval, or another member of Blank Rome’s <a href="/services-and-industries/litigation/business-litigation/" id="18541">Business Litigation</a> group.

core/button

core/buttons

Data Privacy

Harrison Brown

Ana Tagvoryan

Privacy, Security & Data Protection

Business Litigation

Alert

Publications

California SB 690 Passes California’s Senate, Signaling a Major Step in Redefining Privacy Law and Limiting CIPA Litigation for Online Businesses

<a href="https://admin.blankrome.com/wp-content/uploads/2026/03/6.5.25_bizlit.pdf">Download This Alert</a>

California SB 690 Passes California’s Senate, Signaling a Major Step in Redefining Privacy Law and Limiting CIPA Litigation for Online Businesses

Offices

Stay Connected

Slide Menu

Slide Search

California SB 690 Passes California’s Senate, Signaling a Major Step in Redefining Privacy Law and Limiting CIPA Litigation for Online Businesses

Offices

Stay Connected