Does SB 690 end CIPA website lawsuits?

No. From January 1, 2027, it ends private suits under the pen-register section, 638.51, for websites and apps. Wiretap claims under section 631, eavesdropping claims under section 632 and other federal and state laws are untouched.

Is cookieless analytics enough to avoid CIPA claims?

Not by itself. The claims turn on what data reaches whom: a cookieless beacon that sends IP addresses and URLs to a separate company still fits the pen-register fact pattern, and replay of typed text fits the wiretap one. Who receives the data matters more than whether a cookie is set.

How much can a CIPA claim cost?

CIPA allows $5,000 per violation or three times actual damages. Website-tracking settlements found so far range from about $1.5 million to $59.5 million; the statutory figures matter because plaintiffs multiply them across every class member.

CIPA lawsuits and website analytics: 2026 update

Pixel and website-tracking suits, most under California’s Invasion of Privacy Act (CIPA), grew from about 66 in 2023 to 480 in the first nine months of 2026. SB 690 ends private pen-register website claims from January 1, 2027, but the section 631 wiretap claim remains. Suits target data reaching third parties, not cookies.

Updated October 25, 2026

Filings by year

Pixel and website-tracking suits filed (Rain Intelligence count)
Year	Suits filed
2023	About 66
2024	244
2025	361
2026 (January to September)	480

That is more than 1,160 suits since 2023, plus about 300 pre-suit investigations. By theory, and overlapping: about 610 plead the CIPA section 631 wiretap claim, about 340 the section 638.51 pen-register claim, about 230 health or tax data, and about 160 the federal Video Privacy Protection Act. Most are in California.

Wider counts measure something else. Testimony on SB 690 put the number of CIPA lawsuits against California businesses at about 4,000, plus thousands of demand letters, counting state-court suits as well. Cite each figure with its scope.

What SB 690 changes

The Governor signed SB 690 on September 30, 2026, after it passed the Assembly 66-0. It takes effect on January 1, 2027.

Website claims before and after SB 690
Claim	From January 1, 2027
CIPA §638.51 pen register / trap and trace (websites and apps)	No private suits; enforcement by the Attorney General only. Applies to actions commenced on or after January 1, 2025.
CIPA §631 wiretap	Unchanged
CIPA §632 eavesdropping	Unchanged
Federal wiretap (ECPA), VPPA, CDAFA, other states’ wiretap laws	Unchanged

Goodwin expects the wave to “shift rather than stop”, toward section 631 and 632 claims and other states’ wiretap laws in Florida, Pennsylvania, Arizona and Washington. The Governor has called for further reform in 2027.

Cases that shaped the wave

Selected outcomes
Case	What was tracked	Outcome
Doe v. Kaiser	Quantum Metric session replay, Adobe, Google, Microsoft/Bing, Dynatrace and X; no Meta Pixel	About $47.5 million, final approval July 2026, class of about 13.1 million
Frasco v. Flo Health	Health-app data sent to Meta, Google and Flurry	Jury found Meta liable under CIPA §632 (August 2025); Flo, Google and Flurry settled before trial for $59.5 million combined
European Wax Center	Meta Pixel	$5 million, preliminary approval April 2026
Los Angeles Times	Ad-tech trackers (pen-register class)	$3.85 million
Ideal Image	Website tracking without consent	$3.5 million (February 2026)

Damages under CIPA are $5,000 per violation or three times actual damages (Penal Code §637.2), and plaintiffs argue for counting each visit. In Flo, plaintiffs estimate about 1.6 million California class members; at $5,000 each, potential statutory exposure can reach billions. That is exposure, not money paid: the settlements above run from a few million to $59.5 million.

What plaintiffs target

Third-party data flows. Trackers that send visitors’ IP addresses to a separate company were pleaded as pen registers in Shah v. Fandom; cookies are not required for that theory.
Fingerprinting. In Greenley v. Kochava, claims over SDK fingerprinting survived a motion to dismiss; a suit against Toyota alleged fingerprinting after users declined cookies.
Session replay. Replay that captures keystrokes and form input is treated as capturing “contents”. In May 2026 the Third Circuit (In re BPS Direct) found concrete injury where replay captured card and purchase data.
Chat widgets. Chatbot wiretap matters rose from 2 in 2021 to about 30 in 2025, the fastest-growing section 631 front.
Typed text. Search queries and typed form text remain a risk, while one court held that full URLs, device data and button clicks are not “contents” (Wiley v. Universal Music, September 2026).

The wave is not one-way

Popa v. Microsoft (Ninth Circuit, 2025) and Cook v. GameStop (Third Circuit): session replay of ordinary browsing gave no standing.
A federal court declared the serial filer Vivek Shah a vexatious litigant.
Massachusetts’ highest court held that the state wiretap law does not reach website browsing (Vita v. New England Baptist).
Consent defeats claims when a working banner fired before tracking (Lakes v. Ubisoft; In re Adobe).

What reduces risk

No setup removes the risk. These are the factors the cases turn on:

Keep analytics first-party or self-hosted, so no independent third party receives the data. A claim needs a third party; where only the site and the visitor are parties, the “party exception” applies.
Do not share analytics data with ad networks.
Do not replay typed content: mask form fields, and switch replay off on sensitive pages.
Pick a vendor that is contractually limited to processing for you and does not use the data for itself. Courts treat such a vendor as an extension of the site, like a tape recorder, though they are split on the test.
Strip search terms and other typed text from what you collect.

Proxying a third-party script through your own domain changes the network path, not who receives the data; we found no ruling that treats it as a defense. If the data still reaches a company that can use it, the third-party question is unchanged.

Editor’s pick:OnyxMetric

If you are replacing a tracker, OnyxMetric is the tool this guide picks. What it does by default:

Its script sets no cookies.
With the default settings it does not keep IP addresses and salts visitor IDs daily.
Session replay and form tracking stay off until you turn them on; most options are configurable per site.
It can run through a first-party proxy on your own domain.
Its privacy policy says data is never sold, shared with advertisers or used for model training.
It is hosted on AWS in the United States.
When session replay is on, it masks form inputs.

Try OnyxMetric free for 7 daysmade by this guide’s publisher

Disclosure: OnyxMetric is made by the publisher of this guide. It is recorded with the same field marks as every other tool, and links to it carry a referral tag so we can count visits.

Questions

Does SB 690 end CIPA website lawsuits?: No. From January 1, 2027, it ends private suits under the pen-register section, 638.51, for websites and apps. Wiretap claims under section 631, eavesdropping claims under section 632 and other federal and state laws are untouched.
Is cookieless analytics enough to avoid CIPA claims?: Not by itself. The claims turn on what data reaches whom: a cookieless beacon that sends IP addresses and URLs to a separate company still fits the pen-register fact pattern, and replay of typed text fits the wiretap one. Who receives the data matters more than whether a cookie is set.
How much can a CIPA claim cost?: CIPA allows $5,000 per violation or three times actual damages. Website-tracking settlements found so far range from about $1.5 million to $59.5 million; the statutory figures matter because plaintiffs multiply them across every class member.

Sources

This note is general information compiled from public sources, not legal advice. Laws and cases change; ask your own counsel before you rely on it.