The California legislature adjourned its 2026 session on August 31. Before it did, it passed a batch of privacy and technology bills — six of them tracked in detail by firm summaries published September 4 — and sent them to Governor Newsom, who has until September 30 to sign or veto each one. Signed bills take effect January 1, 2027 unless they carry urgency statutes; none of the six do.

Five of the six amend obligations you already know: data deletion, data brokers, AI disclosure. One of them reaches backwards into pending litigation and starts taking claims away from plaintiffs. That one is SB 690, and if you run any public-facing website, it is worth understanding regardless of whether you self-host.

SB 690: The Pixel Statute Gets Its Teeth Pulled

California's Invasion of Privacy Act (CIPA) dates from 1967 — a wiretapping law written for telephone lines. Its pen-register provision, Penal Code § 638.51, prohibits installing or using a device that records the numbers dialed from a phone without consent or a court order. For the past several years, plaintiffs' firms have been arguing that website tracking technologies — analytics cookies, session replay, advertising pixels, chat widgets that log metadata — are pen registers in exactly that sense. Every page load is an "installation" of a "device." The claims arrive as demand letters and class actions, and they do not require proof of actual harm to be filed.

The economics of that litigation shape are the problem: statutory penalties per violation, a statute that does not require demonstrating injury, and a legal theory broad enough to cover a support widget. Small organizations with a donor page and a chat button got demand letters alongside the adtech shops. Settling was routinely cheaper than fighting, which is the definition of a shakedown shape whether or not any individual claim is meritorious.

SB 690 amends § 638.51 with one structural change, and we read it in the enrolled text rather than a firm summary because the details matter: an action against a private actor for a § 638.51 violation arising from conduct on an internet website, online application, or mobile application may be brought only by the Attorney General. The private right of action — the engine of the demand-letter economy — is gone for web and app tracking claims.

Then it goes further. The amendments apply retroactively to any pending claim in an action commenced within two years before the operative date. If the bill is signed and takes effect January 1, 2027, cases filed back to the start of 2025 become subject to the new rule. Defense counsel have already started positioning the existing docket for dismissal. The backlog of pixel lawsuits that made trackers expensive does not just stop growing — it gets a mechanism for dying.

If Newsom signs, this takes effect January 1, 2027. If he vetoes, the legislature cannot send it back this session. Until September 30, the honest answer to "is this law?" is no — it is a bill on a desk, and desk bills do not change anyone's compliance math yet.

What SB 690 Does Not Do

The bill is narrower than the press releases imply, and the gap matters:

  • Wiretap and recording claims are untouched. CIPA's § 631 (interception of communications in transit) and § 632 (recording confidential communications) keep their private rights of action. Plaintiffs have already been layering these theories on top of pen-register claims — session replay and chat-recording products are the obvious targets — and SB 690 does nothing to those counts.
  • The Attorney General can still enforce. Web tracking did not become legal. It became a state-enforced violation instead of a privately-enforced one, which is a very different thing from permission.
  • CCPA exposure is unchanged — and growing. Tracking on your site implicates the CCPA's disclosure, opt-out, and sale/share provisions regardless of who can sue under CIPA. Which brings us to the rest of the batch.

The Other Five

  • SB 923 expands the CCPA deletion right to data collected "from or about" a consumer — the inferred and derived data, not just what was handed over — and requires online-only businesses with a direct consumer relationship to offer a web-based method for submitting requests. Inferred data has been the comfortable hiding place in deletion workflows. Not after this one.
  • AB 1542 prohibits selling or sharing sensitive personal information, subject to exceptions. Adtech business models that monetize sensitive categories take the hit; the rest of us inherit a new category to keep out of our pipelines.
  • AB 883 tightens the data broker Delete Act machinery — brokers process deletion requests through the DROP platform every 30 days instead of 45, and new enforcement pathways let local prosecutors act for elected officials and judges.
  • SB 1000 reworks the AI Transparency Act: provenance disclosures for AI-generated content get a "disclosure verification tool" instead of a detection-tool mandate, and the monthly-user threshold defining covered providers disappears — more providers covered.
  • SB 1050 requires clear disclosure when an advertisement prominently features a synthetic performer, and creates takedown obligations for platforms after court findings.

Read together, the batch is not a privacy win or a privacy loss — it is a rebalancing. SB 690 removes a private enforcement weapon aimed at websites; SB 923 and AB 1542 tighten the underlying privacy obligations; SB 1000 and SB 1050 extend disclosure duties into synthetic media. The net regulatory load on a small organization probably decreases. The load on anyone running a tracking-heavy business definitely does not.

The Argument From the Liability Layer

Three weeks ago this site made the patchwork argument: nineteen-plus state privacy regimes, diverging not converging, compliance as continuous governance, and continuous governance requires direct control of the data layer because you cannot audit what you do not run.

SB 690 is a second argument from a different layer of the stack. Not data governance — liability. The demand-letter wave existed because third-party scripts sit in your HTML and carry someone else's legal theory into your server logs. The pixel on a small business's contact page was the same pixel adtech used; the tracking library on a community organization's donation form behaved identically to the one on a data broker's site. Embed the script, inherit the exposure. When the legal theory lives in Sacramento and the script lives in your footer, your risk is whatever the legislature does this month.

The self-hosted posture takes the regulated activity off your pages in the first place. No ad pixels — there is nothing to buy, and nothing to opt out of. No third-party chat widget phoning home — run your own help desk or a Matrix channel. No third-party analytics — check the logs you already own. This is the same advice as the patchwork post's step four, "disable what you don't need," but SB 690 supplies the reason it pays: the activity that generated the claims simply is not there, and a law that changes who can sue over it is irrelevant to you.

There is a fairness caveat worth stating plainly, because we are not adtech's lawyers: SB 690 is litigation reform, not a privacy achievement. It does nothing to make tracking more transparent, more consensual, or less extractive. It makes tracking cheaper to be sued over. If your community's site carries tracking scripts, the right response to SB 690 is not relief — it is removing them anyway, for the reasons the CCPA amendments keep tightening.

While You Wait

  1. Do not restructure compliance around a bill on a desk. Until Newsom signs — chaptered, on leginfo — the old math stands. September 30 is the deadline.
  2. Inventory what your public pages load. Every third-party script, pixel, and widget. You want this list regardless of what happens to SB 690; it is the same inventory the patchwork post asked for, one layer up.
  3. If signed: do not celebrate, patch. Veto or sign, SB 923's expanded deletion rights and AB 1542's sensitive-data restrictions arrive January 1, 2027 for anyone with California users. The obligations ratchet; only the plaintiffs' bar gets interrupted.

The EU makes the sovereignty argument through policy. The US states are making it through fragmentation and, occasionally, through litigation reform. Both directions keep arriving at the same place: the pages you serve and the scripts they carry are your legal surface. Own them, or trust that whoever wrote them kept your interests in mind.