SB 690 narrows specified online interception private claims
Oct 11, 2026 edition · GC-2026-0241 · Published 2026-10-11 · Version 3 · Final
SB 690 limits a specified online pen-register/trap-and-trace civil-action pathway to the Attorney General, including identified pending claims. It changes who may bring those section 637.2 claims against private actors; it does not repeal section 638.51 or resolve every other privacy obligation.
What happened
California enacted SB 690 on September 30 as Chapter 976. New Penal Code section 637.2(d) permits only the Attorney General to bring an action under that section against a private actor for a section 638.51 violation alleged to arise from conduct on an internet website, online application, or mobile application. The amendment expressly applies to pending claims in actions commenced within two years before its operative date. The trigger therefore depends on the defendant, underlying section, online conduct, and claim timing rather than simply whether a case involves website technology.
The surrounding section retains its general damages and injunctive-action framework subject to the new exception, including the rule that actual damages need not be shown, and preserves the referenced Civil Code title. The short act amends section 637.2 rather than repealing the underlying pen-register/trap-and-trace provision or granting general authority to collect health information. Its reach into particular pending litigation or other statutory causes requires separate analysis. The source supports a defined enforcement-pathway change, without establishing that patient tracking, disclosures, or consent practices automatically comply with other law.
Scope and timing
- Authority status
- Final
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
- Recorded date
- 2027-01-01
- Date type
- effective
Why it matters
A litigation-pathway change is not permission to expand patient tracking.
Recommended action
Have privacy counsel assess the precise affected claims while retaining consent, data minimization and health information safeguards.
Sources
- SB690 enacted final textOfficial · California Legislature · 2026-09-30 · Source review 2026-10-11
- California Constitution, Article IV section 8(c), official Assembly 2023–24 editionOfficial · California State Assembly · Source review 2026-10-14
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →