California Pixel Lawsuits After SB 690: What Changes on 1 January 2027 and What Does Not

The section at issue, Penal Code 638.51, restricts pen registers and trap and trace devices. Plaintiffs argued that ordinary advertising and analytics tags fit that description because they collect address information about a visit. WilmerHale reports that the Governor signed SB 690 on 30 September 2026 and that it removes the private right to sue for violations of that section arising from conduct on websites, online applications or mobile apps.

The change is operative on 1 January 2027. It applies to pending claims in actions started within two years before that date, which Privacy World reads as cases filed on or after 1 January 2025. The same article expects plaintiffs to challenge that backward reach.

Two limits are stated in the law-firm summaries. The bill does not legalize the use of pen registers, and it creates no safe harbor. The research behind this article confirmed the signing from law-firm pages and could not open the legislature's own bill page, so check the enacted text.

Goodwin notes that the enacted bill leaves sections 631 and 632 intact. Those sections concern intercepting or recording the contents of a communication. The statutory amount Goodwin gives for a violation is $5,000, or three times actual damages if greater.

Jeffer Mangels reported in September 2026 that plaintiffs' firms are increasingly pairing or replacing their California counts with the federal Wiretap Act, the Video Privacy Protection Act and Florida's communications security law. Florida has its own pen-register section, which California's reform does not affect.

Courts are also narrowing some claims on standing. Privacy World reports that a pen-register case against SeatGeek was dismissed for lack of standing on 28 October 2026 and that a Ninth Circuit appeal on the same question is pending. Goodwin's summary of the outlook is that the wave is likely to shrink and to shift.

The figures below were collected by ConsentStack, a consent-software vendor, from a law-firm tracker and from its own search of federal dockets. The Fisher Phillips map publishes no method. ConsentStack's federal search covers only the four California federal districts, so it leaves out state courts.

The same page records that the bill's sponsor told an Assembly committee there were about 600 such suits in early 2025 and 4,000 eighteen months later. It also cites Fisher Phillips for the mix: of more than 4,000 website suits, about a third allege only a pen-register claim and about a third pair one with another claim under the same law.

No count of demand letters exists. Treat any single number as one firm's tally with its own scope.

This enforcement comes under the California Consumer Privacy Act, from the Attorney General and the state privacy agency. SB 690 does not affect it. The amounts and facts below come from law-firm and compliance summaries of each action, and the Attorney General's release on Disney.

The pattern is consistent across the four. In each one a control was offered, and the tracking continued or the request was not carried through. A business usually learns this from a regulator or from a test, because the banner itself looks the same either way.

The audit is from InfoTrust, which sells consent and analytics services, and its method is not published. It also reported that a typical site fired 25 tracking tags before any consent interaction, and that the Meta Pixel was present on 62% of sites and still firing after an opt-out on 30%.

These are one vendor's figures for one sample. They are still the closest thing to a measurement in the research, and they match what the regulator cases describe. A banner is a request to stop. Whether the tags stop depends on how each one was installed.

The research notes reason that tools which capture what a visitor types, such as chat widgets, search bars and session replay, stay exposed to wiretap claims because those claims concern the contents of a communication. That is an inference, and counsel should confirm how it applies to your site.

The checks below are ones the regulator cases point to. Run them after every change to your tags, and keep the dated result.

• With the Global Privacy Control signal switched on in the browser, load the site and list every advertising and analytics tag that fires.
• Click reject or opt out on the banner and repeat the check, including on pages reached afterwards.
• Open the Do Not Sell or Share link and confirm the request is processed.
• Sign in on a second device and confirm the opt-out followed the account.
• Look for tags placed directly in page code, outside your tag manager.
• List the tools that capture typed text or page activity, and ask counsel about each.
• Save the date, the pages tested, the browser used and the result.