On July 1, 2026, the California Assembly’s Committee on Privacy and Consumer Protection passed SB 690, a bill that would amend the California Invasion of Privacy Act (CIPA) to cut off the flood of litigation that has hit companies across industries for the last several years.

By way of background, dozens of states have passed comprehensive privacy laws to regulate website cookies and pixels. Despite that, plaintiffs have increasingly turned to wiretapping and pen register laws like CIPA—statutes never designed for online tracking—to bring thousands of lawsuits and arbitrations in recent years. Indeed, some pro se plaintiffs and firms appear to be sending thousands of demand letters a week, with courts expressing concern that it is approaching vexatious conduct.

SB 690 was introduced in 2025 to add a “commercial purpose” exception to CIPA, clarifying that the use of cookies and pixels on commercial websites does not constitute unlawful wiretapping or eavesdropping, nor does it constitute as a pen register. SB 690 overwhelmingly passed the California Senate last year, then stalled, apparently due to political and lobbying pressure.

At the July 1, 2026 hearing, the committee amended SB 690 in two significant ways.

First, the committee narrowed the “commercial purpose” exception to cover only “conduct occurring on an internet website, online application, or mobile application.” Such conduct would no longer be subject to CIPA’s private right of action. Enforcement would shift exclusively to the California Attorney General.

Second, and more consequentially, the “commercial purpose” exception would apply retroactively: it would reach pending claims in any lawsuit commenced within two years before SB 690’s operative date of SB 690, if it passes.

The California legislature now enters summer recess. SB 690 is expected to move to the Appropriations Committee in August. The Privacy and Consumer Protection Committee vote is welcome news for the business community, but the bill still has a long way to go—and plenty of time for political and lobbying groups to mount a fight. In the meantime, companies should continue to balance statutory and regulatory compliance, business needs, and risk mitigation efforts, while tracking SB 690’s progress.