The DeMicco Digest
Grab your headphones and enjoy a mini-podcast version of this blog. Sit back and listen while we walk you through the key points!
I thought this would be helpful to the people I’ve been talking with lately. It touches companies whose websites run analytics, advertising pixels, chat, or session recording, and California changed part of the law on September 30, 2026.
An insurance broker I know reached out to me. One of his clients is getting sued over its website, and he asked if I could share information that would help his clients. We’ve been dealing with this for a while. A small number of plaintiff attorneys, most notably in California, send demand letters that threaten litigation over how a website handles cookies and tracking. The letters typically argue that common tools like Google Analytics, advertising pixels, chat widgets, and session-recording software collect visitor information without proper consent. They go to businesses of every size, including B2B manufacturers and distributors who assume a site that doesn’t sell online isn’t a target.
My team at AIMG wrote about cookie consent and privacy policies in September 2025. Enough has changed since then to warrant an update. I’m not an attorney, and this isn’t legal advice.
Table Of Contents
What California changed
Governor Newsom signed SB 690 on September 30, 2026
Beginning January 1, 2027, a private plaintiff can no longer sue a private business under Section 638.51 of the California Invasion of Privacy Act (CIPA), known as the pen register and trap and trace section, over conduct on a website or app. Only the state Attorney General can bring that kind of case. The change also applies to pending claims in lawsuits filed on or after January 1, 2025, though the law firms covering it expect plaintiffs to challenge that part.
According to the bill’s author, a small number of law firms used that section to file thousands of lawsuits against businesses, nonprofits, hospitals, and school districts, and the count grew from about 600 to nearly 4,000 after the bill was introduced in 2025.
K&L Gates notes the claims carried potential statutory damages of $5,000 per violation, and says a company holding a demand letter based on that section may now be in a stronger negotiating position. That is a conversation for your attorney.
What it didn't change
The section is still on the books, and the Attorney General can still enforce it [2]. The wiretapping sections of the same act were left alone, so private plaintiffs can still sue under those [4][5]. ArentFox Schiff says they may become plaintiffs’ main theory, especially against session recording and chat tools [5].
Federal wiretap law is untouched as well [5], and other states have similar laws. Barnes & Thornburg’s April 2026 review called Florida the most important front outside California and noted website tracking claims in Pennsylvania [6].
The governor’s signing message, as described by the firms covering it, says the act contains other decades-old statutes that are also open to abuse and urges the Legislature to take them up next year [4][7]. Opinions differ on how much SB 690 will help. Ballard Spahr wrote that the final law is much narrower than the original bill and isn’t expected to meaningfully reduce litigation under the act overall [7].
AI notetakers and regulators
Section 631, the wiretap section private plaintiffs can still use, was at the center of a ruling on August 13, 2026. A federal court in California partly denied a motion to dismiss by Otter.ai, the AI notetaker, and the state and federal wiretap claims survived. At this early stage the court treated the company as a third party to the conversations it recorded, in part because it was alleged to use recordings to train its own models [8]. If your team has an AI notetaker joining client calls, find out what the vendor does with the recordings.
In March 2026, California’s privacy agency announced a $1.1 million fine against a youth sports media company. The agency alleged the company forced visitors to click “agree” to tracking, pointed them to industry opt-out tools without offering its own, and failed to recognize opt-out preference signals [9]. That signal is a browser setting that tells every site you visit not to sell or share your information. By January 1, 2027, every browser must include it under a separate California law, and businesses covered by the state’s consumer privacy act are required to honor it [10]. Ask your attorney whether that act applies to your company.
Ask about your insurance
IMA Financial Group, an insurance brokerage, published a brief on this in the summer of 2026. It calls cyber policies the best bet for these claims, but says many of them don’t cover claims based on wrongful collection of information, and that many general liability policies now carry privacy exclusions [11]. Ask your broker how your policy would respond.
What I'd do now
Review these with your attorney.
- Know what is running on your site. Tools get added over the years, sometimes without anyone telling leadership [11].
- Check your consent banner. One that says “by using this site, you agree to cookies” is increasingly viewed as insufficient. A defensible setup gives visitors a real choice. Barnes & Thornburg recommends verifying that tags needing consent don’t fire until a visitor has said yes [6].
- Look hardest at chat, session recording, and AI notetakers, since those sit closest to the wiretap claims that remain [5][8].
- Make your privacy policy match what the site does, and keep dated records of your banner, tags, and policy [6].
- If a letter arrives, don’t respond on your own. Call your attorney and report it to your insurer right away. IMA warns that late reporting can jeopardize coverage [11]. Keep a record of what was running before you remove anything [6].
Still taking shape
None of it is legal advice. I wanted to share it because it’s important to keep on your radar, and it’s a lot easier to look at your site now than after a letter arrives. If you have questions, or you’ve seen something like this yourself, let me know.
Sources & Further Reading
The following resources informed this article. All claims have been verified against multiple sources where possible.
- Office of Governor Gavin Newsom, “Governor Newsom issues legislative update 9.30.2026,” September 30, 2026. – https://www.gov.ca.gov/2026/09/30/governor-newsom-issues-legislative-update-9-30-2026/
- California Legislature, Senate Bill 690 (Caballero), “Crimes: invasion of privacy,” enrolled text amending Penal Code section 637.2. – https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB690
- Office of Senator Anna Caballero, “Senator Caballero’s SB 690 Passed the California Legislature with bipartisan support,” August 31, 2026. – https://sd14.senate.ca.gov/news/press-release/senator-caballeros-sb-690-passed-california-legislature-bipartisan-support
- K&L Gates, “California Narrows CIPA Litigation: SB 690 Ends Pen Register and Trap-and-Trace Claims,” October 8, 2026. – https://www.klgates.com/thought-leadership/California-Narrows-CIPA-Litigation-SB-690-Ends-Pen-Register-and-Trap-and-Trace-Claims-10-8-2026
- ArentFox Schiff, “Pixel Pause: California Pulls the Plug on Private CIPA ‘Pen Register’ Suits,” October 2, 2026. – https://www.afslaw.com/perspectives/consumer-products-watch/pixel-pause-california-pulls-the-plug-private-cipa-pen
- Barnes & Thornburg, “CIPA/ECPA Website-Tracking Privacy Litigation in 2026,” April 14, 2026. – https://btlaw.com/en/insights/alerts/2026/cipa-ecpa-website-tracking-privacy-litigation-in-2026
- Ballard Spahr (via National Law Review), “Governor Newsom Signs SB 690, Ending the Private Right of Action Under CIPA’s Pen Register and Trap-and-Trace Provision,” October 2, 2026. – https://natlawreview.com/article/governor-newsom-signs-sb-690-ending-private-right-action-under-cipas-pen-register
- Troutman Amin (via National Law Review), on In re Otter.AI Privacy Litigation, No. 25-CV-06911-EKL (N.D. Cal. Aug. 13, 2026), published August 17, 2026. – https://natlawreview.com/article/invited-participant-or-third-party-eavesdropper-court-holds-otterai-third-party
- California Privacy Protection Agency, “Youth Sports Media Company to Pay $1.10 Million Fine, Change Practices Over Privacy Violations,” March 3, 2026. – https://privacy.ca.gov/2026/03/youth-sports-media-company-to-pay-1-1-million-fine-change-practices-over-privacy-violations/
- California Privacy Protection Agency, “California’s Opt Me Out Act: Your Privacy Just Got Easier,” January 15, 2026. – https://privacy.ca.gov/2026/01/californias-opt-me-out-act-your-privacy-just-got-easier/
- IMA Financial Group, “The Growing Risk of Online Tracking Technologies,” Cyber Q3 2026. – https://imacorp.com/wp-content/uploads/2026/08/TL_Cyber-Q3-26_Growing-Risk-of-Online-Tracking_081326.pdf
