California narrows one website privacy lawsuit risk for contractors
A new law will limit private lawsuits over some website tracking claims starting in 2027. Contractors still need to check their tracking tools, privacy notices and consent practices.
California has passed a law that narrows one type of privacy lawsuit tied to business websites and apps. The change may matter to service companies outside California, too, because the claims described in the law can involve California residents visiting sites run elsewhere, according to ACHR News.
Gov. Gavin Newsom signed SB 690 on Sept. 30. Starting Jan. 1, 2027, the law removes the right for private parties to sue under one part of the California Invasion of Privacy Act, or CIPA, for certain website and app tracking claims. Those claims will instead be brought by the state Attorney General, ACHR News reported.
The targeted claims involve pen-register and trap-and-trace provisions. In plain terms, they concern tools that can capture information about a person’s online activity. The law does not remove every possible privacy claim, so a contractor’s website is not automatically free of risk.
Why contractors were paying attention
CIPA was passed in 1967 to criminalize wiretapping. Over time, it was also used in lawsuits involving digital privacy. ACHR News reported that companies faced claims over website tools, including chat functions and tracking products such as Google Analytics, Meta Pixel and HubSpot.
One case involved Folsom Lake Heating & Air in Granite Bay, California. The lawsuit sought $5,000 for each visit to the company website, not for each unique visitor, according to ACHR News. The article said plaintiffs had obtained five-figure settlements from businesses.
The law may reach companies based outside California. A lawyer quoted by ACHR News said CIPA can apply when a California resident visits a website and tracking technology captures that visit. A privacy policy saying a company does not target California residents is not, by itself, a defense, the lawyer said.
The scale of filings helps explain why the change drew attention. ACHR News reported that more than 800 claims were filed in 2025. Pen-register and trap-and-trace claims made up about two-thirds of active California privacy litigation as of July 2026.
What the new law does not change
SB 690 takes effect on Jan. 1, 2027, and applies retroactively to pending claims filed within the two years before that date. So a covered claim filed in 2025 or 2026 that is still pending on the effective date is included, according to ACHR News.
The law does not eliminate other parts of CIPA, including provisions involving wiretapping and communication interception. ACHR News quoted attorney Trent Cotney saying the change reduces one major source of lawsuits but does not remove website privacy exposure.
That means the practical task is still to know what a website collects and who placed the tools there. A contractor may use tracking through a website platform, an online booking tool, a chat vendor or a marketing provider. The article advises businesses to check their own site and ask vendors what they have installed.
The law also does not make an inaccurate privacy policy safe. If a site uses tracking tools, the notice should accurately describe them. Contractors should also review how visitors are told about tracking and whether their consent practices match the tools in use.
A short website check this week
Owners do not need to become technology experts to start. They can ask the person who manages the website or marketing account for a list of tracking tools, then compare that list with the privacy policy. If the list is unclear, the vendor should explain what each tool does and whether it collects visitor data.
- Ask the website and marketing vendors for a current list of tracking tools, chat features and pixels on the site.
- Check whether the privacy policy names the tools and describes their use accurately. Flag missing or unclear details for the site manager or a lawyer.
- Review the site’s consent notices and ask vendors whether any changes are needed for the tools currently in use.
- Put a recurring reminder on the calendar to recheck the site after vendor, booking or marketing changes.
The legal change offers relief from a specific kind of private CIPA claim, not a blanket pass for tracking. A basic audit now can help an owner see what is running on the site, correct gaps in the privacy notice and know what to revisit as the law takes effect.