On September 30, Governor Newsom signed SB 690. Starting January 1, 2027, private plaintiffs can no longer sue under Penal Code § 638.51, CIPA’s pen register and trap and trace provision, over anything that happens on a website or app. Only the California Attorney General can bring those claims now.
So trap and trace is gone. Wiretapping isn’t. CIPA’s wiretapping provision, § 631, is still active, and so is the federal Electronic Communications Privacy Act.
What passed and who pushed it
The bill Newsom signed is a much narrower version of the one Senator Anna Caballero filed in February 2025, which carved a broad “commercial business purpose” exception out of four CIPA sections. It cleared the Senate without a no vote, sat in the Assembly for a year, and was cut down to § 638.51 this summer in a deal between Caballero and Assemblymember Rebecca Bauer-Kahan, who chairs the Assembly Privacy and Consumer Protection Committee. Both houses passed it unanimously on August 28.
Brandon Reilly, who leads Manatt’s privacy and data security practice, was there from the start. He testified as one of Caballero’s two expert witnesses in April 2025, alongside Los Angeles Times president Chris Argentieri, and went back before the Assembly that July. Usama Kahf of Fisher Phillips made the case for the narrowed bill at the July 1, 2026 hearing where it advanced, and the Stop CIPA Shakedowns coalition, including CalChamber, NFIB, TechNet, the California Retailers Association and the Ecommerce Innovation Alliance, kept the pressure on.
What it means
Trap and trace was the most difficult CIPA claim to defend, no doubt, so this is a big step. Nevertheless, it’s one step, not the finish line. Here’s what changes, what stays the same, and the other thing you need to think about.
What changes
Section 638.51 is the part that changes. Lawmakers wrote it in 2015 to govern how police use pen registers and trap and trace devices. Plaintiffs’ firms turned it against ordinary analytics and ad tech, arguing that anything collecting an IP address counts. It was overly broad, and under that reading the majority of even benign internet connections became a “violation.”
SB 690 amends § 637.2 so private plaintiffs can’t sue on § 638.51 anymore, and it reaches back to pending claims filed in the two years before January 1. This changes your exposure on trap and trace. If a demand letter on your desk rests only on that theory, it just lost most of its teeth.
What stays the same
This doesn’t change § 631 or ECPA, and that’s where I’d focus. Plaintiffs already use § 631 against session replay, chat widgets and third-party pixels, the same tools that show up in trap and trace complaints. Expect many of those cases to come back dressed as wiretapping claims. Sections 632, 632.7 and the federal Wiretap Act are still in play. And the Legislature never said trackers aren’t pen registers, or created a safe harbor for business use.
What else to consider
A new law doesn’t change what your website is doing. A § 631 case asks whether a third party captured the contents of a communication while it was in transit. That makes it a data flow question. You need to know which vendors receive what, and when, and that picture changes every time someone adds a tag. Make sure consent is collected before anything fires, not after.
Newsom’s signing message asked lawmakers to take up CIPA’s other provisions next year, and the coalition has already named § 631 as its next target. Until something passes, assume § 631 filings will pick up where trap and trace left off.