California Ends Right to Sue Over Website Tracking Tools, Splitting Business and Privacy Advocates

California Governor Gavin Newsom has signed SB 690, a bipartisan update to the California Invasion of Privacy Act (CIPA). The change removes the private right to sue over internet-based surveillance, ending a key provision of the 57-year-old law. Supporters call it an overdue correction that will stop frivolous lawsuits, while privacy advocates say it is a blow to digital consumer privacy rights.

CIPA was passed in 1967 and requires a court order for wiretapping, eavesdropping, interception or recording of telephone calls. Courts later extended it to cover most internet-based communications, such as email and websites. In 2015, lawmakers added a provision letting residents sue companies over unauthorised use of certain tracking technologies, such as pen registers, with penalties of up to $5,000 per violation plus triple damages. Pen registers are mainly used by law enforcement to log metadata like phone numbers, IP addresses and timestamps, without capturing the content of conversations.

Newsom and the bill's sponsors say that provision led to thousands of lawsuits and demand letters against companies using common tools such as browser cookies for legitimate business purposes. In his signing statement, Newsom said the measure addresses the use of such claims to extract settlements from small businesses that unwittingly install software on their websites that can track and share visitor information. He said he wants to protect small businesses from overzealous lawsuits based on a statute written without today's technology in mind.