Quick Hits
- Senate Bill 690 limits website-related California Penal Code Section 638.51 claims to actions brought by the attorney general, effective January 1, 2027, with a two-year retroactive reach.
- The law curbs private trap-and-trace lawsuits involving cookies, pixels, and similar tracking technologies, though constitutional challenges and other claims may remain.
- Companies may want to continue reviewing tracking tools, third-party data sharing, consent practices, privacy policies, and cookie-banner disclosures.
The amendment to Section 637.2 provides that: “An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.”
For context, Section 638.51 provides that a person may not install or use a pen register or a trap and trace device without first obtaining a court order. A “pen register” is a “device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” Penal Code ¶ 638.50(c) defines a “trap and trace device” as a “device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of a communication.” California courts have concluded that software (such as cookies) may qualify as a pen register or trap and trace device, and that third-party pixels and other tracking technologies used on websites may also fall within the statutory definition. As a result, plaintiffs have used Section 638.51 to bring a wave of lawsuits, often brought as putative class actions.
The relief provided by the California Legislature was to amend 637.2 of the California Penal Code, which eliminates a private right of action under California Penal Code Section 638.51 and mandates that only the attorney general can bring trap and trace claims. The law takes effect on January 1, 2027, and applies retroactively for two years, which means it applies to lawsuits that have been filed over the last two years. It seems like a perfect result.
Not so fast, this is California after all. The retroactive application will likely be challenged on constitutional grounds. In addition, the plaintiffs’ bar believes that this law does not provide a blanket immunity and that conduct that constitutes intentional, surreptitious, and independently tortious interception and exploitation of consumer communications will still be subject to Section 638.51. Finally, this law does not affect claims under Penal Code Section 631(a), which addresses wiretapping, and Penal Code Section 632, which addresses recording confidential communications. These are other common causes of actions in lawsuits challenging the operation of a website.
The most important takeaway is that, even with this change in California law, careful review and maintenance of company websites remains a priority. Key points include using cookie banners on company websites and crafting consent and privacy policies; reviewing website analytics or tracking tools; and determining whether data is collected and shared with third parties, and whether opt-in consent for tracking tools may be appropriate in certain high-risk states.
Ogletree Deakins’ California offices and Cybersecurity and Privacy Practice Group will continue to monitor developments and will post updates on the California and Cybersecurity and Privacy blogs as additional information becomes available.
Follow and Subscribe
LinkedIn | Instagram | Webinars | Podcasts
