All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
California’s new online tracking law will remove a way to sue companies over how they collect your data, even affecting some lawsuits already underway.
Gov. Gavin Newsom signed SB 690 on September 30, removing consumers’ ability to bring certain lawsuits over website and app tracking under the California Invasion of Privacy Act (CIPA).
The change takes effect January 1, 2027, and also applies to certain pending cases, according to an analysis by law firm Pillsbury.[1]
Newsom framed the measure as protection for small businesses facing “overzealous lawsuits,” according to his signing statement quoted by CyberScoop.[2]
Hayley Tsukayama, director of state affairs at the Electronic Frontier Foundation (EFF), said the change makes it “impossible for ordinary people to sue companies engaged in unlawful metadata surveillance.”
The change targets rules covering “pen registers” and “trap-and-trace” devices, which capture information about communications, such as their source or destination, rather than their contents.
Think of a record showing which number you called, rather than a recording of what you said. Online, that information can include IP addresses and timestamps.
Consumers have used these provisions to challenge tracking technologies on websites, including cookies and pixels. Whether ordinary website tools qualify under those rules remains legally contested.
SB 690 closes off private lawsuits for website and app conduct under that specific provision, leaving those civil enforcement actions to California’s attorney general. Other CIPA claims remain available, and the law does not make all tracking legal.
It also reaches backward: Certain pending claims in cases filed during the two years before January 1, 2027, fall within its scope. Cases with additional claims may still proceed on those other grounds.
For these claims, you will have to rely on California’s Attorney General to take action. You lose the ability to bring the case yourself.
You don’t have to type a secret into a website for your activity to reveal something personal.
A California Assembly committee analysis describes how online advertising systems circulate information such as IP addresses, device details, location, and browsing behavior. That information can help companies infer sensitive characteristics, including health conditions and political interests.
The same analysis explains how tracking pixels and scripts can connect browsing activity with user profiles. What looks like a routine page visit to you can become another detail in a much larger picture of your life.
The concern extends beyond personalized ads. Tsukayama warned that government agencies seek information from businesses and data brokers to target people based on their beliefs or health decisions.
Some claims remain available. SB 690 targets website and app tracking claims under CIPA’s pen-register provision. It does not eliminate other CIPA claims.
California residents retain separate protections under the California Consumer Privacy Act (CCPA). For businesses covered by that law, you can request access to your personal information, ask for its deletion subject to exceptions, and opt out of its sale or sharing.
The California Attorney General’s consumer guide explains how to exercise those rights:
There is a catch: The CCPA generally doesn't let you sue over every violation. Its private lawsuit provision is limited to certain data breaches; other violations rely on public enforcement.
You can still tell covered companies to stop selling or sharing your information. SB 690 means one fewer way to sue them personally over how they tracked you in the first place.
Top ad blocker that historically scores 100/100 on AdBlock Tester, passing every banner, interstitial, pop-up, and contextual ad test
Successfully blocked YouTube ads in our testing, one of the trickier platforms for ad blockers to handle consistently
Works across Chrome, Edge, Safari, and Opera, plus Android and iOS mobile apps
/images/2023/10/12/best_identity_theft_protection_with_dark_web_monitoring.jpg)
/images/2023/05/18/deleteme_review-1.jpg)
/images/2026/10/08/claude-chat-arrest-florida-woman.jpeg)
/images/2026/10/08/california-sb-690-online-tracking-lawsuits.png){kind=tracking}
/images/2026/10/07/trump-mobile-data-breach.jpeg)
/images/2026/10/07/amazon-ai-agents-collect-your-data.png)
/images/2026/10/06/congress-healthcare-cybersecurity-bill.jpeg)
/images/2026/10/06/would_you_upload_your_passport_to_keep_scrolling__the_uk_may_ask_you_to.png)
/authors/thomas-kent-headshot-cropped.png){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2023/03/01/logo-total-adblock.png){kind=logo}
/authors/thomas-kent-headshot-cropped.png)