If your studio runs a web store or a game site with a Meta pixel or Google tags, you may have already met the California Invasion of Privacy Act. It usually shows up as a demand letter from a firm you have never heard of.

California just took away one of the main theories behind those letters. SB 690 ends private pen register lawsuits over website tracking, starting January 1, 2027.

That’s a real relief from what seem to be often aggressive lawsuits. But it’s only part of the story, because the other half of the CIPA lawsuit playbook is still open.

What is a CIPA lawsuit, and why do game studio websites get them?

The California Invasion of Privacy Act (CIPA) is a 1967 wiretapping law. It was written for phone taps, not cookies.

Over the last few years, plaintiffs’ firms started applying it to the tracking code that nearly every website runs. The appeal is the damages: Penal Code § 637.2 allows $5,000 per violation, without proof of actual harm.

CIPA claims against websites come in two main flavors:

  • Wiretapping claims (§ 631). The argument is that a third-party vendor, like Meta or a chat widget provider, “listens in” on a visitor’s communications with your site.
  • Pen register claims (§ 638.51). The argument is that tracking code that captures things like IP addresses and device information works like a pen register, a device that records the numbers a phone dials, or a trap and trace device, which records where a call is coming from. Both are covered by § 638.51.

The pen register theory took off after a federal court let one proceed against a data company’s software kit in Greenley v. Kochava, Inc., 684 F. Supp. 3d 1024 (S.D. Cal. 2023). The court said software secretly embedded in apps could count as a pen register, and noted that no court had interpreted that part of CIPA before. Since then, CIPA demand letters have become routine, and they’ve reached small game companies that sell merch or games directly from their own sites.

Game studios make easy targets. Most run a store page or a marketing site with ad pixels, and most have California visitors.

An open laptop glowing in a dark room

What does California SB 690 change, and when does it take effect?

California SB 690 was signed on September 30, 2026. It takes effect January 1, 2027.

The change is narrow and specific. SB 690 amends § 637.2, the section that lets private people sue under CIPA.

After January 1, a claim against a private business under § 638.51 (the pen register and trap and trace section), for conduct on a website or app, can be brought only by the California Attorney General. Private plaintiffs and their lawyers can no longer bring it.

There is no size threshold and no special exemption to qualify for. If you are a private business and the claim is about your website or app, the pen register theory is off the table for private plaintiffs.

Does SB 690 reach pending cases?

Partly, and this is the detail that matters most if you already have a CIPA lawsuit or demand letter.

The law applies to pending pen register claims in cases filed within 2 years before January 1, 2027. In practice, that means cases filed on or after January 1, 2025.

A pen register case filed before 2025 isn’t affected. And if a pen register claim about your website or app isn’t filed until after January 1, 2027, a private plaintiff can’t bring it at all.

Can you still be sued under CIPA section 631 after SB 690?

Yes. This is the part a lot of the early headlines skipped.

SB 690 only names the pen register section. The wiretapping section (§ 631), the recording section (§ 632), and § 632.7 are untouched, and private plaintiffs can still bring CIPA claims under them for $5,000 per violation.

Expect the plaintiffs’ bar to adjust. Demand letters that leaned on the pen register theory are likely to lean harder on wiretapping arguments instead.

So SB 690 takes away one theory. It is not a reason to stop managing your tracking.

Game pieces and a die on a board game

Is the Meta pixel on your web store still a risk?

It is, mainly through the wiretapping theory. The core question in those cases is whether a third party captured the content of a visitor’s communications without consent.

The most practical protection you control is the same one it was before SB 690: consent before the tracking starts. A cookie banner that loads ad pixels only after a visitor clicks to accept is much harder to attack than one that fires every tag on page load and asks permission afterward.

Your privacy policy matters too. It should accurately describe the trackers you run, who receives the data, and why.

Chat widgets and session replay tools deserve a second look. These tools capture more of what a visitor actually types or does, which is exactly what the wiretapping theory targets.

What should you do if you get a CIPA demand letter?

Don’t ignore it, and don’t pay it on reflex. Many CIPA demand letters are form letters sent in bulk, hoping a quick settlement is cheaper than a fight.

Start with 3 questions:

  1. Which section does it cite? A letter built only on § 638.51 is a pen register or trap and trace claim, and SB 690 is about to take that theory away from private plaintiffs.
  2. Has a case actually been filed, and when? The filing date decides whether SB 690 reaches a pending case.
  3. What does your site actually do? Know which tags load, when they load, and whether a consent banner controls them.

Then check your insurance. Some cyber and media liability policies cover privacy claims, and many treat a demand letter itself as a claim, which starts the clock on notice.

A video game controller on a white background

What you should do

  • Inventory your trackers. List every pixel, tag, chat widget, and session replay tool on your sites and stores, including ones a contractor or plugin added.
  • Gate tracking behind consent. Make sure ad and analytics tags wait for a visitor to accept, at least for California visitors.
  • Update your privacy policy. It should match what your site actually does today, not what it did at launch. Our guide to CCPA compliance for game companies covers the broader California rules.
  • Check your vendor contracts. Know what your analytics and ad vendors do with the data they collect from your site.
  • Handle demand letters deliberately. Identify the section cited and the filing date before you respond, and loop in counsel early.
  • Put a review on the calendar for January 2027. SB 690 takes effect January 1, and the plaintiffs’ bar will adjust fast.