California strips private plaintiffs of CIPA pen-register claims against website trackers

Pen registers and trap-and-trace devices are police tools ^[6]. Under court order, local police, the FBI and the DEA use pen registers to log outgoing metadata such as dialed numbers, IP addresses and timestamps, and trap-and-trace tools to log incoming contacts ^[6]. Investigators use the logs to map a suspect's network without hearing what was said ^[6]. Privacy attorneys at Kelley Drye say CIPA's 2015 pen-register addition was meant to codify how agencies get those orders for phone metadata without violating the act ^[8]. The same addition let residents sue companies over unauthorized use of such tracking, at up to $5,000 per violation plus triple damages ^[4].

Plaintiffs' lawyers aimed it at websites. They "sent tens of thousands of demand letters to businesses threatening class-action suits under the CIPA's pen-register and trap-and-trace provisions for using everyday website tools like cookies, analytics software and pixels," according to Pillsbury privacy attorneys Shruti Bhutani Arora and Christine Mastromonaco ^[10]. The Assembly Committee on Privacy and Consumer Protection called the provision "the poster child for abusive lawsuits" ^[11].

"Enterprising plaintiffs' attorneys have exploited the statute at scale to go after businesses using third-party software to enable advertising on their websites," the committee wrote ^[12]. "Because the potential liability can be staggering, businesses generally settle this litigation hastily, encouraging vexatious litigants to continue blasting out demand letters," the committee added ^[13].

The suit counts come from a party to the fight. Estimates of filings under the provision vary widely, CyberScoop reported ^[20]. The Alliance for Legal Fairness, a Virginia-based lobbying firm backing the bill, tracked about 600 suits in 2025, according to its written comments ^[21]. It now says the number has "exploded" to more than 4,000 ^[21]. That is a rise of more than six times ^[22]. The Chamber of Commerce was among hundreds of California groups that signed in support ^[9].

Newsom cast the bill as small-business relief. "This measure addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses that unwittingly install software on their websites that at times have tracked and shared the information of visitors to the site," he wrote in his signing statement ^[7].

Opponents included the ACLU, the Electronic Privacy Information Center, the Privacy Rights Clearinghouse, the Consumer Federation of California, most major California labor unions and dozens of civil rights groups ^[14]. The committee's own report noted opposition from "a broad array of privacy, civil society, legal and immigrant rights organizations" ^[15]. The Electronic Frontier Foundation fought the bill for years ^[16].

The final exemption is narrower than the first drafts. Early versions of SB 690 would have exempted other CIPA privacy provisions from private suits; later versions cut the exemption back to pen registers and trap-and-trace ^[17]. Courts have extended CIPA to most internet communications, including email and websites ^[3]. Private claims under the act's other privacy provisions sit outside the new exemption ^[19]. For a company running third-party ad and analytics scripts, the private pen-register class action is what goes away ^[18].