California Legislators Passed Privacy Law Reform

The bill aims to curb litigation by shifting enforcement of website tracking claims to the state attorney general.

Updated on Sept. 20, 2026 in Legislative Policy

Isometric editorial illustration of a stylized geometric grizzly bear on a plinth, representing California state regulatory policy. — The California Legislature passed Senate Bill 690 to limit private lawsuits over website tracking tools, shifting oversight to the state attorney general. AI Illustration. Upload story photo >

Live Poll

Should small businesses be shielded from lawsuits involving routine website tracking tools?

The California Legislature has passed Senate Bill 690 to eliminate private lawsuits under the California Invasion of Privacy Act related to standard website tracking tools. The bill would transfer enforcement authority to the state attorney general to protect organizations from aggressive litigation.

Why it matters

Business owners are seeking relief from a wave of legal actions tied to website technologies like pixels and cookies that plaintiffs claim violate 1967 privacy statutes. The measure is designed to shield agencies and companies from costly litigation while maintaining privacy standards.

Statewide litigation and settlements linked to these claims have reached an estimated $500 million. The bill, which passed without a dissenting vote, also applies retroactively to claims filed within two years prior to January 1, 2027.

The players

Gavin Newsom

He is the current Governor of California who holds the authority to sign or veto the legislation by the end of September 2026.

American Civil Liberties Union

This organization is among the 54 groups that have formally opposed the passage of the bill.

Senator Caballero

She is a member of the California State Senate who issued a public statement regarding the legislative effort on August 31, 2026.

The details

Plaintiffs have increasingly utilized the 1967 California Invasion of Privacy Act to argue that common website tracking tools function as pen registers. The proposed legislation would replace private plaintiff-driven lawsuits with state-led enforcement.

1967: The California Invasion of Privacy Act was originally enacted.
Spring 2026: Amy's Roofing and Solar was targeted by a lawsuit.
May 2026: Element Electric was named in a lawsuit.
August 31, 2026: Senator Caballero released a statement regarding the bill.
September 30, 2026: The deadline for Governor Gavin Newsom to sign or veto the bill.

Political Context

The opposition from groups like the American Civil Liberties Union highlights concerns that shifting enforcement solely to the attorney general could weaken privacy protections. Proponents argue this is a necessary correction to prevent the misuse of legacy statutes against routine digital business practices.

For local businesses across California, this bill could eliminate the threat of thousands of dollars in potential damages for common website usage. Taxpayers and business owners should monitor the governor's office for the final action by late September.

The takeaway

This legislative effort reflects a growing struggle to adapt decades-old privacy laws to the realities of modern digital tracking tools. Organizations are waiting to see if state oversight will effectively replace the current wave of private litigation.