E-commerce businesses received welcome news on September 30, 2026 when Governor Gavin Newsom signed Senate Bill 690, a pro-business measure aimed at curbing the recent epidemic of lawsuits and demand letters brought under the California Invasion of Privacy Act (CIPA). Based on CIPA’s anti-surveillance wording dating back to the 1970s, plaintiffs had been using the statute to target e-commerce websites for using common website tracking technologies.
There has been an increasing number of lawsuits threatened and filed in the last year against ecommerce marketers and other online companies based on their use of analytical and other “non essential” marketing-related cookies. These actions typically allege violations of various federal and state privacy statutes—most notably the California Invasion of Privacy Act (“CIPA”), including California Penal Code §§ 631(a), 632, 632.7, and 638.51—and challenge widely used online advertising and tracking practices such as the usage of cookies, pixels or the alleged interceptions of communications. It is important to note that there have been no definitive legal rulings on these claims, and this is an ever-changing area of the law, which is being increasingly exploited by plaintiff’s attorneys.