SB 690 narrows CIPA demand letters, but privacy exposure remains

At a glance

What this is: This is a legal analysis of California SB 690 and its impact on CIPA demand letters, with the key finding that one private cause of action narrows while broader privacy exposure remains intact.

Why it matters: For privacy, consent, and identity governance teams, the practical issue is not whether the letter goes away, but whether the organisation can prove what data was collected, when, and under what consent state.

Context

California’s SB 690 changes who can sue over some website and app tracking conduct, but it does not change the underlying collection practices that create the risk. That means the governance problem remains one of evidence, consent state, and record quality rather than a simple removal of exposure.

For security and privacy teams, the relevant boundary is between lawful collection mechanics and private enforcement rights. In identity-adjacent programmes, that boundary matters because consent records, notice timing, and downstream data-sharing proofs increasingly function like control evidence, not just compliance paperwork.

The article treats this as a narrow enforcement shift, not a broad legal safe harbour, and that is the correct operational reading. Teams that only track statutes will miss the operational reality that payload logging, consent logging, and visitor-level traceability still determine defensibility.

Key questions

Q: What breaks when a CIPA demand letter relies only on § 638.51?

A: Once SB 690 becomes operative, a private plaintiff can no longer bring a website or app-based § 638.51 claim. That means letters built only on that theory lose their private enforcement leverage, although the underlying collection conduct and other surviving claims, such as § 631 or federal wiretap theories, may still remain in play.

Q: Why do consent logs and packet records matter so much in privacy disputes?

A: Because privacy disputes increasingly turn on proof, not assertions. Consent logs show the state the user was in, while packet or HAR records show what data actually left the page, to whom, and when. Without both, teams may know a tracker existed but still be unable to defend the specific allegation being made.

Q: What are the signs that a privacy programme is not ready for a § 631 challenge?

A: The clearest warning sign is when a team can list tags but cannot reconstruct transmitted contents, recipient identity, or the exact notice state at the time of collection. If evidence lives in separate systems and cannot be joined to an individual visitor and timestamp, the programme is exposed to content-based claims.

Q: How should teams respond when a private CIPA theory becomes weaker but other claims remain?

A: Treat it as a litigation rebalancing, not a dismissal trigger. Preserve the retroactivity argument, identify which counts survive independently, and focus on the evidence needed for the strongest remaining theory. The operational goal is to reduce leverage on the table before settlement dynamics harden.

Technical breakdown

What SB 690 changes in CIPA enforcement

SB 690 amends California Penal Code § 637.2 so private plaintiffs can no longer sue under CIPA’s pen register and trap-and-trace provision, § 638.51, for website, online application, or mobile application conduct once it becomes operative. The statute shifts that claim to the California Attorney General and reaches back to some pending claims filed within the stated window. It does not erase the underlying conduct, and it does not touch other causes of action that plaintiffs often plead alongside § 638.51.

Practical implication: Treat the bill as a change in enforcement rights, not a change in collection behaviour or evidence preservation.

Why § 631 and § 632 still matter after the reform

The article makes clear that CIPA’s wiretapping and recording provisions remain untouched. Section 631 and section 632 still create exposure when organisations collect contents or confidential communications in ways that plaintiffs can plead and support with technical evidence. That matters because the easier pen-register theory may weaken, but the harder content-based theory remains available and can be more durable if a website records what a user typed, watched, or submitted.

Practical implication: Reassess your risk on contents-level telemetry, not just tag inventory, because that is where surviving claims will concentrate.

Consent logs and packet evidence are now the deciding records

The article argues that the decisive operational question has shifted from ‘which trackers are present’ to ‘what left the page, to whom, and against what consent state.’ That is a much stricter evidentiary standard because scanners and cookie inventories can show presence, but not always transmission, timing, or the visitor-specific notice state at the moment of collection. Privacy programmes that cannot reconstruct that sequence are poorly prepared for a § 631-style challenge.

Practical implication: Build visitor-level evidence trails that tie consent, notice, and outbound data events together in a single defensible record.

NHI Mgmt Group analysis

SB 690 is an enforcement reset, not a privacy reset. The statute narrows who can sue under one CIPA theory, but it leaves the collection model, notice requirements, and evidence expectations untouched. That means privacy governance still has to answer the harder question of what data moved, when it moved, and under what consent state. The practitioner conclusion is simple: legal exposure narrows, operational accountability does not.

The governance gap is evidence quality, not statutory awareness. Many teams can name the law they are worried about, but cannot reconstruct the technical facts that matter when a demand letter lands. That is the deeper failure mode this article exposes, and it is especially relevant where consent, identity state, and downstream sharing are tied together across systems. The practitioner conclusion is to treat telemetry and consent logs as defensible control evidence.

Website tracking has become an identity-adjacent control problem. The article implicitly shows that notice, consent, and downstream distribution records now behave like identity governance artefacts because they tie a specific person to a specific data event. That creates a boundary problem for privacy, IAM, and data teams: each owns a piece of the truth, but none can defend the whole chain alone. The practitioner conclusion is to govern the chain as one control surface.

CIPA litigation is moving from broad scans to contents-level scrutiny. As the easier private claim weakens, surviving challenges will focus more on payloads, timing, and transmission detail than on the mere presence of tags. That raises the quality bar for defensibility and shifts attention toward packet evidence, visitor records, and proof that downstream recipients respected the recorded state. The practitioner conclusion is to prepare for narrower but more technical claims.

What this signals

Contents-level evidence is becoming the control plane. Privacy teams can no longer rely on tag inventories alone because the surviving challenge is whether they can reconstruct what data left the page, who received it, and what notice state applied at that moment. That makes consent logs, HAR files, and packet records the practical centre of the control environment.

Identity and privacy governance are converging around proof. The article shows that a visitor’s consent state, the notice they saw, and the downstream sharing instructions now function as a chain of evidence rather than isolated compliance artefacts. Teams that treat those records as operational controls will be better positioned to defend both legal and governance scrutiny.

For practitioners

• Inventory every open privacy claim by statutory theory Map each demand letter and complaint to the specific provisions it pleads, including § 638.51, § 631, § 632, the federal Wiretap Act, and any state analogues.
• Preserve packet-level and consent evidence Retain the records that show what data left the page, when it left, which third party received it, and what consent state applied to that visitor at that moment.
• Rebuild the evidentiary model around contents-level questions Move beyond tracker inventories and ensure you can answer the contents question with packet logs, HAR files, and timestamped consent state for each visitor.
• Separate website and app exposure from broader privacy obligations Keep CCPA opt-out handling, Global Privacy Control propagation, and downstream sharing records in scope, because SB 690 does not change those obligations.
• Plan for AG-led enforcement on surviving claims Assume the California Attorney General may become the main enforcer for website and app conduct under the narrowed provision, so maintain records that can satisfy regulatory review.

Key takeaways

• SB 690 narrows one private CIPA claim, but it does not change the underlying collection practices or the need to prove what happened on the site.
• The article’s practical warning is that evidence quality, not statute awareness, will decide which matters survive once the law becomes operative.
• Teams that can link consent, notice, and outbound data events at the visitor level will be better prepared for the narrower but more technical disputes that remain.

Key terms

• Consent Logging: Consent Logging is the recording of when, how, and for what purpose a person gave or withdrew consent. It gives defenders evidence that consent was valid, current, and specific, and it helps enforce downstream controls when consent changes. Missing logs make it hard to prove compliance, honour withdrawals, or trace unlawful processing after a dispute.
• Control-Level Evidence: Control-level evidence is proof that ties a specific control to the asset, scan result, remediation action, and verification step. It is stronger than a headline score because it shows how the control behaved in production and whether the gap was actually closed.
• Retroactivity Clause: A retroactivity clause applies a legal change to claims or events that began before the law became effective. In privacy litigation, it can reshape settlement leverage by removing or limiting causes of action already filed, while leaving the underlying conduct and other claims intact.
• Pen Register Theory: A pen register theory alleges that technology captured routing or signalling information rather than the contents of a communication. It is often easier to plead from website telemetry than a contents-based claim, which is why changes to private standing can materially alter litigation leverage.

Deepen your knowledge

NHI Foundation Level course covers NHI governance, identity lifecycle, and secrets management, and it gives practitioners a structured way to think about evidence, control scope, and operational accountability. It is designed for security and privacy teams that need to connect identity governance to broader risk decisions.