If you've read our blog on what "Accept All" really means, you know that a lot happens in the first second you land on a website. Before the cookie banner even finishes loading, trackers can start collecting your IP address, your device details, and the pages you're about to visit, and send that information off to advertisers and data brokers.

For the past few years, Californians have had a powerful tool to push back by bringing claims against companies themselves. A bill that just cleared the California Legislature is about to change the process for one of the most common privacy claims. It's called SB 690, and even if you don't live in California, it's worth understanding what it does and what it might mean for you.

First, a Quick Refresher on CIPA

The California Invasion of Privacy Act (CIPA) is a wiretapping law from 1967, written when "eavesdropping" meant a device clipped to a phone line. Courts have since applied it to the digital world, and two parts of it matter most here:

• Section 631 covers wiretapping: intercepting the content of a communication. Online, that can look like a website routing what you type into a form or chat window to a third party without telling you.

• Section 638.51 covers "pen registers" and "trap and trace" devices, which capture routing information rather than content. Online, that can look like a tracker capturing your IP address and device data the moment you arrive on a site.

Either violation could be enforced by everyday consumers through a private right of action, meaning you don't have to wait for a government agency to act. You (or a group of people like you) can bring the claim directly with (or without) attorneys.

So, What Does SB 690 Actually Do?

SB 690 doesn't make website tracking legal. What it changes is who is allowed to enforce the law.

Under the bill, pen register and trap-and-trace claims under Section 638.51 that arise from a website, online application, or mobile app can only be brought by the California Attorney General. Individual consumers lose the ability to bring these specific claims themselves.

A few other details worth knowing:

• It's retroactive. The bill applies to pending claims and actions filed within two years before it takes effect, roughly anything filed since January 1, 2025. Thousands of cases already in the system could be affected.

• It started much bigger. The first version of SB 690 would have let companies off the hook for nearly all of CIPA as long as the tracking served a "commercial business purpose." Privacy groups like the ACLU of California and the Electronic Frontier Foundation pushed back, and the bill was cut down to just the pen register and trap-and-trace section.

• Where it stands. The Legislature passed the bill on August 28, 2026, with a unanimous 66–0 vote in the Assembly. The Governor has until September 30 to sign or veto it. If signed, it takes effect January 1, 2027.

Why Did This Happen?

The bill's supporters point to a real problem. Pen register claims jumped from roughly 600 to nearly 4,000, with many targeting small businesses rather than standard website functionality. A local bakery with an analytics tag shouldn't face a five-figure demand letter.

We agree, too. Chariot has never supported a case like that, and we don't condone attorneys who use privacy laws as a shakedown tool against small and mid-sized businesses.

But here's the part that hasn't gotten enough attention: filing volume was treated as proof of abuse rather than as evidence of how widespread the underlying practice is. Collecting your data before you've consented isn't an accidental byproduct of running a website. For many large companies, it's the business model: your IP address, your device, the pages you visit, and where you came from are captured, packaged, and sold, often before you've had a chance to say no.

SB 690 draws a line through that data. If a company captures the content of what you type, consumers can still hold it accountable. If it captures everything else about you, only the Attorney General can. In practice, that means the large-scale monetization of consumer data can continue with little private accountability, as long as it stays just below the threshold of what counts as "content." A flood of claims can mean a lot of frivolous filings, but it can also mean a lot of companies doing something nobody wanted to defend in the open. This bill lets them stop defending it.

The Problem With Putting It All on One Office

Public and private enforcement work differently. A government office weighs the public interest and chooses which cases to pursue; a private right of action lets individuals act without waiting for anyone else to prioritize their concern. SB 690 moves one category of privacy claims entirely into the first model, and it isn't yet clear how much capacity the Attorney General's office will dedicate to website tracking cases or what options consumers will have if a complaint isn't taken up.

Timing matters here, too. California voters will elect an Attorney General this November, and whoever wins takes office right around when SB 690 takes effect, making privacy enforcement a fair question to ask of every candidate.

Why This Matters Even If You Don't Live in California

California's privacy laws set the standard for the rest of the country, not because other states copied them, but because companies don't build separate websites for Californians. When a company has to comply with California's rules, it usually applies those protections to everyone.

The reverse is also true. When enforcement in California weakens, companies have less incentive to invest in privacy protections anywhere, and most other states have far weaker laws to fall back on. The ripple effect reaches consumers who never had a say in the first place.

There's also precedent. If a well-organized business coalition can retroactively eliminate a private right of action in the state with the strongest privacy protections in the country, it becomes a playbook for other states and other consumer laws.

What This Means for You

If you're wondering whether your rights just disappeared, here's the real picture:

• Consumers still have meaningful privacy rights. SB 690 doesn't touch Section 631, so wiretapping claims over the interception of your communications remain available to individuals. "A company routed what I typed to a third party without telling me" is a very different story from "a tracker logged my IP address," and only the second one is affected.

• The rules themselves haven't changed. SB 690 changes who can enforce Section 638.51, not what the law prohibits.

• A better fix was on the table. Groups pushing back on the bill proposed a revenue threshold, so that small businesses would be shielded while consumers kept their right to act against large corporations. That approach didn't make it into the final bill, and it's worth asking why.

Consumers have rights. Large companies don't get to lobby their way around them, and the small-business concern, while legitimate, deserves a scalpel rather than a sledgehammer. Privacy is a fundamental right, and its importance only grows as more of our lives move online.

The good news? You don't have to take on those giant corporations alone. Chariot Claims helps consumers join together to enforce their rights, making the process easier and more effective than going solo.

👉🏻 Check if you qualify for any current cases.

This article is for general educational purposes only and is not legal advice. Laws change and every situation is different; if you have questions about your specific circumstances, consider speaking with your attorney.