California businesses are getting sued over the tracking scripts on their own websites. The law being used was written to stop phone tapping, the damages are $5,000 per violation, and there is no revenue threshold. A bill that closes one of the two main theories passed the Legislature on August 28 and is on the Governor's desk. Here is what it does, what it does not do, and what we changed on our own site.
If your website runs Google Analytics, a Meta pixel, or a session replay tool like Hotjar or Microsoft Clarity, you are running close to the exact configuration that thousands of California lawsuits have targeted over the past three years. The law being used was written to stop people from tapping telephone lines. The statutory damages are $5,000 per violation. And unlike the CCPA, there is no revenue threshold, no employee count, and no minimum number of records. A two-person shop in Riverside is exposed on the same terms as a national publisher.
On August 28, 2026, a bill that closes one of the two legal theories driving these cases passed the California Legislature without a single no vote. It is now on the Governor's desk. It is narrower than most of the coverage suggests, and it will not help you until January 2027 even once it is signed. This post covers what the law actually says, what the Los Angeles Times settlement really was, exactly what SB 690 does and does not do, and the changes we made to our own site before advising anyone else on theirs.
Update, September 2, 2026
SB 690 passed the Assembly on August 28, the Senate concurred in the Assembly amendments the same day by a vote of 39 to 0, and the bill was enrolled on August 31. It now goes to Governor Newsom, who has until September 30 to sign or veto it under the post-session rules. With no opposing votes in either house, a veto would be a surprise. Nothing below about what the bill does, and does not do, has changed. We will update again when the Governor acts.
The rest of this post reads as it did on August 22, with the status lines corrected.
We build and configure websites. We are not lawyers, and nothing here is legal advice. Everything below is engineering posture and cites primary sources so you can take them to counsel.
A wiretapping law is being used against your analytics
The California Invasion of Privacy Act, Penal Code section 630 and following, was passed to stop eavesdropping on private communications. Plaintiffs' firms have spent the last three years applying it to websites, on two separate theories.
- Section 631, the wiretapping theory. The argument is that when a third-party script loads on your site, that vendor becomes an unauthorized party listening in on a private communication between you and your visitor.
- Section 638.51, the pen register theory. A pen register captures the routing and addressing information of a communication rather than its content. The argument is that tracking scripts collecting IP addresses, device identifiers and page paths are doing exactly that, without a court order.
What makes both theories economical to file at scale is the remedy. Penal Code section 637.2 says any person injured by a violation of the chapter may bring an action, and may recover the greater of $5,000 per violation or three times actual damages. Nobody has to prove they lost money. Multiply $5,000 by a class of California visitors and the arithmetic explains the filing volume better than any theory of privacy harm does.
The part small business owners consistently get wrong: this is not CCPA. There is no $25 million revenue trigger and no 100,000 consumer threshold. If you have a website that California residents visit and it loads third-party scripts, you are inside the addressable set.
The millisecond problem
Most businesses that have thought about this at all responded by installing a cookie banner. That is often not enough, and the reason is load order.
On a typical site, the analytics and advertising tags are placed in the document head so they fire as early as possible, because that is what the vendor documentation recommends for data accuracy. The consent banner is a JavaScript widget that renders once the page is interactive. The result is that the tracking scripts have already executed, and already sent the visitor's IP address and page path to a third party, before the banner appears asking permission. The window is measured in milliseconds, and it is the single most common technical defect described in these complaints.
The practical consequence is uncomfortable: a site with a consent banner that fires tags first can be in a worse position than a site with no banner at all, because the banner is documentary evidence that the operator knew consent was required.
What the LA Times settlement actually was
The case people cite is Mirmalek v. Los Angeles Times Communications LLC in the Northern District of California. The court granted final approval to a $3.85 million settlement on June 26, 2026. The class covered people who visited the LA Times website or mobile app from California between January 31, 2023 and December 19, 2025. The LA Times did not concede liability, and an appeal has been filed, so payments have not gone out.
Two details matter more than the headline number. First, the trackers at issue were TripleLift, GumGum and Audiencerate. Those are ordinary advertising and audience vendors, not anything exotic. Second, the claim was brought under section 638.51, the pen register theory. Hold on to that, because it is precisely the provision SB 690 addresses.
What SB 690 would change, and what it would not
SB 690 passed the Assembly Appropriations Committee 15 to 0 on August 13, 2026, passed the Assembly floor on August 28, and cleared Senate concurrence 39 to 0 the same day. It was enrolled on August 31 and is now with the Governor. It has been amended substantially since it was introduced, and a lot of commentary still describes the original, much broader version. Reading the current bill text, here is what it actually does.
It amends Penal Code sections 631, 632, 632.7, 637.2 and 638.50. The operative change for website operators is in section 637.2, which would provide that an action against a private actor for a violation of section 638.51 arising from conduct on an internet website, online application or mobile application “may be brought under this section only by the Attorney General.” In plain terms: the pen register theory survives, but private plaintiffs and their firms can no longer bring it over a website. Enforcement moves to the Attorney General, who has finite resources and different priorities than a contingency-fee firm.
The bill also adds a definition of “commercial business purpose” at section 638.50, tied to the CCPA: processing that furthers a business purpose as defined in Civil Code section 1798.140, or that is subject to a consumer's opt-out rights. And it is retroactive. The amendments would apply “retroactively to any pending claim in an action commenced within two years before the operative date,” which would reach a large share of the cases currently on file.
Now the part that gets left out. SB 690 does not eliminate section 631 wiretapping claims. That theory remains available to private plaintiffs. If the bill becomes law, the pen register lane closes and the wiretapping lane stays open, and it is reasonable to expect filings to migrate rather than stop. Anyone telling you this bill ends CIPA website litigation is describing a version of it that no longer exists.
The timeline also matters. The Legislature is done with it; the Governor has until September 30, 2026 to act. If signed, the law takes effect January 1, 2027, and the retroactivity clause reaches pending claims filed within the two years before that date. Between now and then, nothing changes for a business that gets sued next week.
What we changed on our own site
We went through this on linktechsolutions.io before we said a word about it to a client, partly because it is hard to advise on a configuration you have not had to defend yourself. Three changes, and the reasoning behind each.
Session replay runs in production only, and never in any authenticated area. Session replay is the highest-risk category in this whole discussion because it records interaction with the page itself, including what people type. Keeping it off staging and out of logged-in areas shrinks both the risk surface and the volume of recorded data that would ever need to be explained.
We honor Global Privacy Control. GPC is a browser-level signal that says the visitor has opted out of sale and sharing of their personal information. California treats it as a valid opt-out request. Reading it and suppressing analytics for those visitors is a small amount of code, and it converts an abstract consent argument into observable behavior: the visitor asked, and the site complied, on that specific visit.
We disclose the tools by name.The footer and privacy policy say which analytics and session tools run on the site. The consent defense in these cases turns heavily on notice, and vague language about “cookies and similar technologies” is weaker notice than naming the vendors.
None of this makes anyone lawsuit-proof. It moves a site from the easy end of a plaintiff firm's target list toward the end where the complaint takes actual work to draft.
What to do now, whether or not it is signed
These are worth doing regardless of what the Governor does, because section 631 exposure survives either way.
- Audit your load order. Open your site with the network tab recording and a fresh profile. Note every third-party request that fires before you interact with the consent banner. That list is the exhibit.
- Block until consent, not after. Tags should be gated behind the consent decision rather than fired and later suppressed. Consent Mode in advertising terms is not the same thing as not loading the script.
- Honor Global Privacy Control. Suppress analytics and advertising tags for visitors sending the signal.
- Get session replay out of authenticated areas, and mask form fields everywhere it does run. Payment and contact fields especially.
- Name your vendors in the privacy policy and footer instead of describing them as a category.
- Inventory what you actually use. Most sites we audit are carrying at least one tag nobody remembers installing, from a campaign that ended years ago. Every unused tag is exposure with no upside.
If you are not sure what is running on your site, that uncertainty is the finding. Our website development work includes this configuration by default, and if you are weighing a broader rebuild, the cost breakdown here covers what that involves. If your site has other issues surfacing at the same time, our guide to why a site fails to show up on Google is a reasonable next read.
We will update this post again once the Governor signs or vetoes the bill.
Frequently asked questions
Can a California business be sued over Google Analytics?
Yes. Plaintiffs bring California Invasion of Privacy Act claims over analytics, advertising pixels and session replay tools, arguing the third-party script is an unauthorized party listening to the visit. Penal Code section 637.2 lets any injured person recover $5,000 per violation or three times actual damages, whichever is greater. Unlike the CCPA, there is no revenue or size threshold.
What is the millisecond problem in CIPA lawsuits?
Most consent banners load after the tracking scripts have already fired. That gap, often only milliseconds, is what plaintiffs point to: data left the visitor's browser before anyone agreed to anything. Having a cookie banner does not help if the scripts run before someone clicks it. It is the most common technical defect in these complaints, and it is fixable.
What does SB 690 actually change?
Less than early coverage suggested. As amended, it makes pen register claims under Penal Code section 638.51 arising from a website enforceable only by the Attorney General, which removes the private lawsuit driving most filings, and it adds a commercial business purpose exception tied to the CCPA. It does not eliminate section 631 wiretapping claims. It would apply retroactively to pending claims in actions commenced within two years of the operative date.
Should I wait for SB 690 before fixing my tracking setup?
No. The bill passed the Legislature on August 28, 2026 and is awaiting the Governor, and it would not take effect until January 1, 2027 even once signed. It also leaves section 631 wiretapping claims intact, which is the other theory plaintiffs use. The configuration work is the same either way, so do it now.