Topic starter
23/10/2026 12:45 am
TL;DR: SB 690 narrows one private CIPA claim, Ketch reports, but it leaves § 631, § 632, federal Wiretap Act exposure, and the underlying collection duties untouched. Evidence quality now matters more than broad statute awareness in privacy disputes.
Editorial analysis by NHI Mgmt Group, based on content published by Ketch: “California SB 690: what it changes for CIPA claims, and what it doesn't”.
Key questions
Q: Why do consent logs and packet records matter so much in privacy disputes?
A: Because privacy disputes increasingly turn on proof, not assertions.
Q: What are the signs that a privacy programme is not ready for a § 631 challenge?
A: The clearest warning sign is when a team can list tags but cannot reconstruct transmitted contents, recipient identity, or the exact notice state at the time of collection.
Q: What breaks when a CIPA demand letter relies only on § 638.51?
A: Once SB 690 becomes operative, a private plaintiff can no longer bring a website or app-based § 638.51 claim.
Practitioner guidance
- Inventory every open privacy claim by statutory theory Map each demand letter and complaint to the specific provisions it pleads, including § 638.51, § 631, § 632, the federal Wiretap Act, and any state analogues.
- Preserve packet-level and consent evidence Retain the records that show what data left the page, when it left, which third party received it, and what consent state applied to that visitor at that moment.
- Rebuild the evidentiary model around contents-level questions Move beyond tracker inventories and ensure you can answer the contents question with packet logs, HAR files, and timestamped consent state for each visitor.
Bottom line: SB 690 narrows one private CIPA claim, but it does not change the underlying collection practices or the need to prove what happened on the site.
Glossary terms: Consent Logging, Control-Level Evidence, Retroactivity Clause, Pen Register Theory
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
SB 690 is an enforcement reset, not a privacy reset. The statute narrows who can sue under one CIPA theory, but it leaves the collection model, notice requirements, and evidence expectations untouched. That means privacy governance still has to answer the harder question of what data moved, when it moved, and under what consent state. The practitioner conclusion is simple: legal exposure narrows, operational accountability does not.
A question worth separating out:
Q: How should teams respond when a private CIPA theory becomes weaker but other claims remain?
A: Treat it as a litigation rebalancing, not a dismissal trigger. Preserve the retroactivity argument, identify which counts survive independently, and focus on the evidence needed for the strongest remaining theory. The operational goal is to reduce leverage on the table before settlement dynamics harden.
👉 Read our full editorial: SB 690 narrows CIPA demand letters, but privacy exposure remains
This post was modified 6 days ago by NHI Mgmt Group