SB 690 narrows specified online interception private claims
Oct 4, 2026 edition · GC-2026-0241 · Published 2026-10-04 · Version 2 · Final
SB 690 reserves a specified online pen-register or trap-and-trace claim under Penal Code section 637.2 to the Attorney General. Its limited retrospective application concerns pending claims filed within two years before operation and does not eliminate other privacy obligations.
What happened
California enacted SB 690 on September 30 to amend Penal Code section 637.2. The new subdivision (d) allows only the Attorney General to bring an action under that section against a private actor for a section 638.51 violation alleged to arise from conduct on an internet website, online application or mobile application. The underlying section otherwise provides specified damages and injunctive actions for invasion-of-privacy violations. The amendment is therefore focused on a particular statutory cause of action, type of alleged violation, defendant and online context. The enactment is the event reported here; the applicable commencement of these provisions must be confirmed separately.
The final text applies the limitation retroactively to pending claims in actions commenced within two years before the legislation’s operative date. It does not supply a calendar date for that lookback merely by stating the September signature date. Section 637.2 also preserves the cited Civil Code title, and the amendment does not generally repeal confidentiality or consent duties for patient information. A narrowed private litigation route should not be treated as a determination that a tracking technology is lawful or that every other claim has been eliminated.
Scope and timing
- Authority status
- Final
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
Why it matters
Website and app tracking decisions still require analysis of the data, permissions and applicable health-information safeguards. This litigation amendment can affect claim assessment without deciding whether a particular collection or disclosure was permitted.
Recommended action
Confirm the applicable commencement before treating the new provisions as current duties. Prepare the following for implementation at that commencement: Have privacy counsel identify the exact claims, private actors and pending-action dates affected by the amendment. Maintain consent, minimization and medical-information controls while evaluating litigation implications. Do not expand patient tracking solely because this specified private action is narrowed.
Sources
- SB690 enacted final textOfficial · California Legislature · 2026-09-30 · Source review 2026-10-05
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →