California’s SB 690, signed September 30, gives partial relief, not a safe harbor. That is the core message of an October 1 IAB legal affairs paper written by Steven Stein and Spencer MacDonald of FTI Consulting. The pen register claims that fuelled tens of thousands of demand letters are leaving private hands, but older wiretap-style claims are still very much available.
What SB 690 actually changes
SB 690 removes the private right of action for alleged violations of Penal Code Section 638.51 on websites, online applications and mobile apps. Those claims would be reserved for the California Attorney General. The change takes effect January 1, 2027 and reaches pending claims commenced within the two years before that date, according to the paper and the enrolled text PPC Land reviewed.
That is where the relief stops. Sections 631, 632 and 632.7, the older interception, recording and confidential communication provisions, keep their private rights of action. The authors conclude the reforms do not create a substantive safe harbor for adtech litigation.
The $5,000 figure is a floor, not a cap
The paper describes CIPA damages as supporting penalties of up to $5,000 per violation. That is the wrong way round. Section 637.2(a) sets the recovery at the greater of $5,000 per violation or three times actual damages, and a plaintiff does not need to prove actual harm. In class litigation, that base amount can be multiplied across every visitor in the class.
The scale claim is also worth reading cautiously. The paper cites more than 4,000 CIPA lawsuits and tens of thousands of demand letters, but gives no time period and no underlying docket source.
Six controls the paper recommends
The authors set out six operational controls for legal, privacy and marketing teams:
- Script inventory and risk analysis: map every analytics, chat, session replay, ad and pixel script, including tag-managed, async and deferred code.
- California-specific consent: block third-party scripts from loading or transmitting data until a banner choice is made.
- Session replay and keystrokes: disable replay by default and mask keystrokes, free-text fields, search inputs and forms.
- Consent interface design: avoid dark patterns, double negatives and asymmetric choices.
- Vendor contracts: position vendors as service providers only, with no independent use, cross-customer analytics, model training or audience building.
- Proof of consent: log timestamp, geolocation, enabled categories and banner version for each user.
Why this matters for marketers
The practical fight is moving from which tags fire to what those tags capture and when. A site can be fully CCPA or CPRA compliant on an opt-out basis and still face a CIPA claim built on opt-in timing: if a third-party script reads a visitor’s clicks, keystrokes or form text before they consent, the plaintiffs’ bar can argue interception.
Recent examples show the same shape. A webXray audit of more than 7,000 California-facing sites found 194 of 242 ad tech vendors setting cookies after a Global Privacy Control opt-out, with Google failing 86 percent of the time. Healthline Media paid $1.55 million in July 2025 over trackers that kept firing after users opted out. Complaints against Ace Hardware and LinkedIn paired pen register theories with Section 631 interception claims.
For performance and analytics teams, the lesson is operational. The tags your consent management platform allows after consent are not the main risk; the ones that load or transmit before consent are.
What to do before January 2027
Treat consent as a technical firewall, not a banner. Block first, disclose clearly, mask by default, and log the consent event. Audit tag-managed and async scripts separately from the page source, because those are often the first to fire and the easiest to miss. If you are using session replay, turn it off unless a user opts in.
Source: PPC Land
