CIPA § 638.51 · Updated for SB 690

Pen register lawsuits over website tracking

Plaintiffs claim that ordinary pixels and analytics scripts are “pen registers” under California’s privacy law. Here is what those claims allege, what SB 690 changes, and a free scan of exactly what your site fires before visitors consent.

Which law do you want to check?

Got a pen register or trap and trace letter?

Book a 20-min call — we’ll walk your scan results and show what a fix looks like.

Book a call →

What a pen register claim alleges

The California Invasion of Privacy Act (CIPA) makes it unlawful to install or use a pen register or a trap and trace device without a court order or the user’s consent (Penal Code § 638.51). The terms were written for equipment that logged the numbers dialed on a phone line. California defines a pen register as a “device or process” that records dialing, routing, addressing, or signaling information, and plaintiffs argue the word “process” covers software.

The theory: when a tracking script loads, it sends the visitor’s IP address, the page URL, and device details to a third party. Plaintiffs call that routing and signaling information, and the script a pen register installed without consent. CIPA allows $5,000 per violation with no proof of actual harm, which is why these claims arrive in volume.

Pen register

Records outgoing signaling information: on the phone, the numbers you dial. In website claims, the data a tracker sends out about the visitor.

Trap and trace device

Records incoming signaling information that identifies the source: on the phone, who called you. Usually pleaded alongside the pen register count.

What triggers one on your site

Claims name real technologies found on the target’s site, almost always by an automated scan. What they have in common is that they fire before the visitor answers the consent banner.

SB 690: are pen register claims still a risk?

California’s SB 690 has been signed into law and takes effect January 1, 2027. It takes the pen register claim away from private plaintiffs for website and app conduct. It changes who can sue under one section; it does not declare any tracking technology lawful.

  1. Now through Dec 31, 2026

    Private plaintiffs can still file § 638.51 claims, and demand letters citing the section keep arriving.

  2. Lawsuits filed since Jan 1, 2025

    SB 690 reaches back to pending claims in actions filed within two years of its operative date, so the pen register count in these cases should fall away once the law takes effect.

  3. From Jan 1, 2027

    For conduct on a website, online app, or mobile app, only the California Attorney General can bring a § 638.51 claim.

What SB 690 does not change

Expect filings to shift toward § 631, which turns on what a tracker receives rather than which trackers are present. Read the full analysis: SB 690 won’t end CIPA lawsuits.

What to do now

  1. 1

    Find out what fires before consent

    A pen register claim is built on trackers that load before a visitor agrees to them. The free scan above loads your site as a first-time California visitor without touching the banner and records every pixel, analytics call, and script that fires — the same picture a plaintiff’s scanner captures.

  2. 2

    Hold trackers until consent

    Section 638.51 has a consent exception, which makes prior consent the cleanest technical defense however a given court reads the statute. Blocking third-party scripts until the visitor opts in stops new claims from accruing.

  3. 3

    Check what each tracker actually receives

    SB 690 does not touch § 631, CIPA’s wiretapping section, which turns on the contents of a communication: search terms, chat text, form fields, and revealing URLs. Look at the request payloads on your search, chat, form, and checkout pages, not just the list of vendors.

  4. 4

    Bring any letter to counsel

    If you have a pending suit or a letter in hand, read which sections it cites and take it, with your scan report, to a defense attorney. A letter citing § 631 loses none of its leverage under SB 690. PieEye is not a law firm and nothing on this page is legal advice.

Pen register lawsuit FAQ

What is a pen register lawsuit?
A pen register lawsuit claims that a website installed a "pen register" without a court order or the visitor’s consent, in violation of California Penal Code § 638.51. California defines a pen register as a device or process that records dialing, routing, addressing, or signaling information. Plaintiffs argue that tracking scripts fit that definition because they capture IP addresses, page URLs, and device details.
What is the difference between a pen register and a trap and trace device?
In the telephone era, a pen register recorded outgoing call information and a trap and trace device recorded incoming call information. Both capture metadata, not the contents of a communication. Website claims usually plead the two together under § 638.51.
Why did pen register claims take off?
A 2023 federal ruling in Greenley v. Kochava held that software could plausibly be a pen register "process". The claims are also cheap to bring: a plaintiff’s firm can scan a site automatically, list the third-party tags that fire, and allege that each one captured routing data. CIPA allows $5,000 per violation with no proof of actual harm.
Does SB 690 end pen register lawsuits?
For websites and apps, it ends private pen register claims from January 1, 2027, and applies to pending claims in suits filed since January 1, 2025. After that, only the California Attorney General can bring a § 638.51 claim over website or app conduct. It does not change § 631 wiretapping claims, other CIPA sections, federal law, or other states’ wiretap statutes.
I received a pen register demand letter. Can I ignore it because of SB 690?
No. A demand letter is not a lawsuit, and SB 690 does not invalidate one. It weakens the leverage behind a letter that only threatens a § 638.51 suit, but many letters also cite § 631 or other statutes. Read which sections your letter cites and take it to counsel.
Do courts accept the pen register theory?
Courts are split. Some California courts have allowed pen register claims over website tracking past the pleading stage, while others have rejected the theory as a stretch of a telephone-era statute. Because outcomes vary by courtroom, the practical defense is technical: do not let third-party trackers capture visitor data before consent.

Go deeper

Sources

PieEye is a privacy-compliance software company, not a law firm. Nothing on this page is legal advice, and reading it does not create an attorney–client relationship. CIPA case law changes quickly. If you have received a demand letter or been sued, consult a licensed attorney about your specific situation.