In the span of one week, two long-awaited developments emerged from California’s Court of Appeal and Legislature. Together, they may narrow a prominent category of litigation under the California Invasion of Privacy Act (“CIPA”) involving website and application tracking technologies. CIPA and similar federal and state wiretap statutes were originally enacted to address communications surveillance, but they are increasingly invoked to challenge routine online practices involving cookies, pixels, session-replay tools, and analytics tags.
First, on August 21, 2026, the California Court of Appeal issued a tentative ruling in Variety Media, LLC v. Superior Court, Case No. B350578, finding CIPA’s pen-register provisions may not extend to technology that collects only a website visitors’ Internet Protocol (“IP”) addresses.
Second, on the heels of this decision, the California Legislature passed Senate Bill 690 (“SB 690”) on August 28, 2026, which, if signed by the Governor, would eliminate private pen-register and trap-and-trace claims under CIPA filed within two years before the January 1, 2027, effective date.
Neither development is final: the appellate ruling remains tentative, and SB 690, which is expected to be signed by the Governor, has not yet been enacted. Even so, together they signal a potentially important narrowing of a prominent category of CIPA website-tracking claims.
The Tentative Ruling in Variety Media LLC
After extensive briefing, the Court of Appeal issued a tentative ruling on August 21, 2026, rejected Variety Media’s argument that CIPA’s pen-register provisions are confined to telephone equipment, finding based on the statute’s legislative history that it may reach internet-based technology.
However, the tentative ruling adopted a limiting construction of the definition of a “pen register” or “trap and trace” device that favored Variety Media. Traditionally, these devices capture information identifying the destination of an outgoing communication, whereas a visitor’s IP address generally identifies the origination of the communication. The Court therefore tentatively concluded that collecting an IP address, alone, does not meet the definition of a pen-register device. Under the tentative ruling, the plaintiff would have to amend the complaint to bolster the allegations regarding the information collected.
California Legislature Passes SB 690 to Limit Private CIPA Claims
SB 690 emerged in response to a growing wave of claims alleging that commonplace website and application technologies violate CIPA’s pen-register and trap-and-trace provisions.
If signed by the Governor, SB 690 will amend the California Penal Code to eliminate a private right of action for online tracking technology under the pen register provisions of CIPA, and only the Attorney General would be permitted to bring an action for using a pen register “on an internet website, online application, or mobile application.”
SB 690 also expressly addresses pending litigation which could affect thousands of cases. Under the plain language, the amendment will “apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation.”
How the Two Developments Interact
If the Governor signs SB 690, it will materially weaken many private, website-based claims without requiring courts to resolve the full reach of the statute. The practical importance of Variety Media may therefore shift. Its technology-neutral interpretation could remain relevant to Attorney General enforcement, claims outside SB 690’s coverage, and disputes concerning conduct beyond the reach of the retroactivity provision. Its source-versus-destination analysis could also influence how courts evaluate whether particular data fields qualify as dialing, routing, addressing, or signaling information.
The developments provide some relief for defendants, but they are not final. Website operators should continue to monitor the evolving landscape of online tracking litigation, keeping in mind these key takeaways from recent events:
- Do not assume website-tracking exposure has ended. Plaintiffs will likely continue to bring theories under other statutes besides CIPA or other sections of CIPA, like section 631 wiretap claims. Businesses should treat the developments as a reason to reassess—not abandon—their practices related to website tracking tools, including the preservation of technical documentation related to data collected by various tools.
- Reassess pending demands and cases. Covered section 638.51 claims may be candidates for a stay, dismissal, demurrer, supplemental briefing, or revised settlement posture, depending on procedural posture and the final status of the ruling and legislation.
- Preserve alternative defenses. Other defenses to CIPA related litigation including consent, party status, lack of interception in transit, jurisdiction, standing, arbitration, and pleading deficiencies may remain independently viable.
For more information or assistance, please contact Sharon R. Klein, Philip N. Yannella, Rachel L. Schaller, Gabrielle N. Ganze, or another member of Blank Rome’s Privacy, Security & Data Protection practice group.