California just gave website operators some relief from a particular category of privacy lawsuits.

For e-commerce and SaaS businesses, that is welcome news. But “fewer grounds for a lawsuit” and “permission to collect data” are two very different things.

If your website or application uses advertising pixels, analytics, session replay, embedded chat, or other third-party technologies, SB 690 is a reason to review your practices. It is not a reason to stop reviewing them.

What actually changed?

Governor Gavin Newsom signed SB 690 on September 30, 2026. The law amends the civil-remedies provision of the California Invasion of Privacy Act, commonly known as CIPA.

Specifically, actions under that provision against private actors for alleged violations of Section 638.51 arising from websites, online applications, or mobile applications will be reserved to the California Attorney General. Section 638.51 addresses “pen registers” and “trap and trace” devices, concepts that plaintiffs have applied to website tracking technologies.

The amendment also reaches pending claims in actions commenced within the two years before its operative date. Businesses facing existing litigation should have counsel assess whether the particular claims qualify. It is not an automatic dismissal of every website privacy case. Enacted SB 690

The law takes effect January 1, 2027, under California’s ordinary effective-date rules. Signing and effectiveness are not the same event. California Constitution, Article IV, Section 8

What did not change?

SB 690 does not eliminate other CIPA claims, including claims under Sections 631 and 632. Depending on the facts, those provisions can raise separate questions about interception or recording of communications. Plaintiff attorneys have already indicated that litigation may shift toward those theories, including disputes involving information transmitted through search bars and chat features. That possibility is not a conclusion that every such feature violates the law.

Nor does SB 690 replace the CCPA and its CPRA amendments. For covered businesses, notice requirements and applicable sale/sharing opt-out obligations, including honoring Global Privacy Control, remain separate compliance issues. California Attorney General’s CCPA guidance

The practical takeaway: do not remove a privacy control simply because one litigation theory has been narrowed.

For e-commerce: examine the entire shopping journey

My recommendation is to follow a visitor from the landing page through product search, cart, checkout, and customer support.

At each stage, ask:

  • Which outside companies receive information?
  • Does a tool receive only a page event, or also search terms, form entries, or chat messages?
  • What happens before a visitor makes a privacy choice?
  • Does declining tracking actually change what is transmitted?
  • Are sensitive fields excluded from recording and analytics?

A cookie banner is the visible part of the system. The more important question is what the system does.

California’s Attorney General has already described enforcement involving online retailers whose tracking technologies disclosed information to third parties without appropriate opt-out handling or service-provider arrangements. Those examples illustrate why technical configuration and vendor contracts matter alongside disclosures. CCPA enforcement examples

For SaaS providers: separate the marketing site from the product

A public landing page and an authenticated customer workspace should not receive an identical, unexamined tracking configuration.

Review them separately. Include embedded support tools, product analytics, session replay, and third-party integrations.

For example, an analytics event that seems harmless on a marketing page could expose customer information if the same implementation captures a workspace URL, document title, or user-entered search.

Ask not only what your team intends to collect, but what the vendor actually receives and what its agreement permits it to do with that information.

Should you review your privacy policy and terms of service?

Yes. Review both, but start with the actual data flows.

Privacy policy and collection notices. Check whether they accurately describe the information collected, its purposes, the relevant recipients, and available choices. A policy that describes your previous configuration may no longer describe your business.

Terms of service. Review provisions addressing third-party services, customer data, confidentiality, and responsibilities for notices or permissions. Make sure they are consistent with the product and your privacy commitments.

Do not assume that a broad sentence saying users “agree to tracking” resolves every consent question. Have counsel evaluate the particular technology, timing, notice, and applicable law.

Vendor terms and data-processing agreements. Your own documents are only one side of the relationship. Review what your analytics, advertising, chat, and other providers are permitted to collect, retain, disclose, and use for their own purposes.

These are recommended review steps, not a claim that SB 690 requires every company to rewrite every agreement.

Treat this as an operational review, not a copywriting exercise

Bring legal, engineering, marketing, and product into the same review.

Inventory the technologies. Test their behavior. Compare the results with your disclosures and vendor agreements. Assign an owner to each mismatch and preserve the evidence of what was corrected.

Then repeat the review when tools, configurations, or vendor terms change.

A privacy policy cannot fix a tracker that ignores the choices the policy promises to honor.

SB 690 offers meaningful relief in a defined area of litigation. The strongest response is to use that breathing room to understand your tracking stack, not to assume it no longer matters.

General information, not legal advice. Current as of October 4, 2026.