Once SB 690 becomes operative, a private plaintiff can no longer bring a website or app-based § 638.51 claim. That means letters built only on that theory lose their private enforcement leverage, although the underlying collection conduct and other surviving claims, such as § 631 or federal wiretap theories, may still remain in play.
What § 638.51 can still support after SB 690 changes the enforcement picture
The key issue is not whether § 638.51 still describes the conduct, it is whether it still gives a private sender leverage in a demand letter. Once the private right of action disappears for that website or app theory, the letter can no longer threaten a stand-alone private lawsuit on that basis. The statute may still matter as background, but the pressure point shifts to other surviving theories or regulator-facing arguments.
A demand letter that relies only on one now-unavailable private theory is brittle because it assumes the recipient will treat the claim as enforceable in the same way as before. Practitioners should separate statutory narrative from enforcement authority, then check whether the same facts also fit a remaining civil claim, a different state privacy theory, or a federal interception theory.
Why the letter loses force when the only theory falls away
Demand letters work when the sender can credibly connect facts, elements, and a remedy the recipient wants to avoid. If the only pleaded theory no longer supports private enforcement, the letter may still describe objectionable conduct, but it loses the threat of an immediate private damages or injunction path under that theory. That weakens settlement pressure and gives the recipient more room to ignore or narrow the response.
This also changes how counsel should read the letter’s risk posture. If the communication is built around a single statutory hook, the real question becomes whether the facts support any surviving claim with independent remedies. If they do not, the letter may be more rhetoric than leverage, even if the underlying conduct remains controversial or potentially unlawful under a different regime.
What still needs a second look before you dismiss the demand
The safest response is not to assume the matter is dead, but to test the underlying conduct against every surviving theory the facts could support. The conduct itself may still be actionable under another California privacy provision, a federal wiretap theory, or a different plaintiff posture. For related privacy and consent issues, the underlying consent and notice mechanics are often the real operational question, which is why practitioners sometimes pair this analysis with a Consent Management Guide: Cookies, CMPs and GPC when evaluating website-facing collection flows.
That second look matters because the failure mode is usually over-claiming, not over-description. If the sender cannot map the same facts to a surviving cause of action, the letter is vulnerable to pushback on standing, remedy, and demand scope. If the facts do map to a surviving theory, the recipient should treat the issue as broader than § 638.51 alone and evaluate exposure on the full set of claims actually pled or threatened.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Privately enforceable claim shifts change legal and operational risk treatment. |
| Recommendation — Reassess legal exposure and update the response strategy when the enforcement theory changes. | ||
| CIS Controls v8 | CIS-17 — Incident Response Management | Demand letters tied to collection conduct may trigger security and legal response handling. |
| Recommendation — Route the matter through documented response ownership and preserve relevant evidence. | ||
| ISO/IEC 27001:2022 | A.5.31 — Legal, statutory, regulatory and contractual requirements | The question turns on whether a statutory claim still supports private enforcement. |
| Recommendation — Track the changed legal requirement and adjust response handling to the surviving claims. | ||
Practitioner Guidance
What to verify: Confirm whether the letter names any surviving cause of action beyond § 638.51, and whether the alleged conduct fits the elements of those claims rather than only the expired pressure point.
Decision rule: If the letter is theory-only and the theory no longer supports private enforcement, respond by narrowing the issue to the live claims and asking the sender to identify the remedy they still contend is available.
Common mistake: Treating the demand as harmless because one statutory citation fails, when the same facts may still support a different privacy or interception theory with real leverage.
Practitioner takeaway: The important distinction is between a dead enforcement theory and a dead fact pattern, because only the former drops away when the letter depends solely on § 638.51.
Related resources from NHI Mgmt Group
- What breaks when AI security only relies on logging and alerting?
- What breaks when Oracle SoD reporting relies on assigned roles instead of effective access?
- What breaks when AI governance relies only on approval workflows?
- What breaks when a service provider relies on email address as the user key?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org