California Governor Gavin Newsom signed SB 690 on September 30, ending private lawsuits that treat website and app tracking as an illegal "pen register" under the California Invasion of Privacy Act (CIPA). From January 1, 2027, only the state Attorney General can bring those claims. Three days earlier he signed SB 923, which widens the CCPA right to delete, and the week before, the Federal Trade Commission opened an inquiry into the ad-optimization tools platforms sell to advertisers. Each one moves legal risk to a different part of the marketing stack.
SB 690 removes one theory of pixel litigation, not all of them
SB 690 amends Section 637.2 of the Penal Code. A claim under Section 638.51, the pen register and trap-and-trace provision, can now only be brought by the Attorney General when the alleged conduct happened on a website, online application or mobile application (California Legislature, SB 690). The limit applies retroactively to pending claims in actions filed on or after January 1, 2025 (Covington, Inside Privacy).
The final law is narrower than the first draft. An earlier version would have exempted disclosures made for a "commercial business purpose" as defined in the CCPA. That exemption was removed in a July 1 amendment (CIPAWorld).
The wiretapping provision, Section 631, and the confidential-recording provision, Section 632, remain open to private plaintiffs. Those sections concern the contents of a communication, and plaintiffs continue to use them against session replay tools, chat features and pixels (National Law Review). Newsom's signing message said SB 690 addresses only one category of CIPA claims and asked the Legislature to revisit other provisions next year (Covington, Inside Privacy).
For marketing teams, the tags that still carry private-suit exposure are the ones that capture content: session replay, chat widgets, form-field capture and pixels on pages where visitors type. SB 690 is not a reason to pause consent and disclosure work on those tools. The sensible move is to review the tag inventory with counsel rather than read the headline as a general all-clear.
SB 923 makes enriched data deletable
Under current law, the CCPA right to delete covers personal information a business collected from the consumer. SB 923, signed September 27, extends it to any personal information the business collected about the consumer, including data obtained from third parties (California Legislature, SB 923). Where the data did not come from the consumer, the business may keep a record of the request and the minimum data needed to make sure the information stays deleted. Businesses that operate only online must also offer a web form or portal for privacy requests, not only an email address. The changes take effect January 1, 2027 (Venable).
This reaches directly into the CDP. Data appended by an enrichment vendor, bought from a broker or passed over by a partner has sat outside a deletion request. From January it does not. Deletion now has to reach profiles assembled through identity resolution and third-party append, and it has to hold: a person deleted in October should not reappear after the next enrichment sync.
The practical work is lineage. Marketing operations teams need to know which profile fields came from which source, whether their CDP can delete across merged identities, and whether enrichment and data-sharing contracts require vendors to act on a deletion downstream. The minimal-record allowance in the bill is what makes suppression possible without keeping the full profile.
The FTC is looking at the ad tools themselves
On September 24, the FTC issued an advance notice of proposed rulemaking asking whether it should update its Rule on Impersonation of Government and Businesses, or take other action, to stop platforms' ad-optimization practices from furthering impersonation scams (FTC). The notice covers ad copy, image and video generation, product listing creation and audience targeting using consumer data. It asks about measures including advertiser vetting, monitoring of posted ads and disciplinary action against offending advertisers (Mayer Brown). Comments are due November 30, 2026 (Federal Register).
An advance notice is the first step in a rulemaking, not a rule. It places no obligation on advertisers and changes nothing in an ad account today. The measures it names, such as vetting and monitoring, would apply to platforms if adopted, and advertisers would meet them through each platform's own verification and ad review processes.
Brands are also the impersonated party in these scams. Companies whose names are regularly spoofed in paid ads have a direct reason to file comments describing what platforms do, and fail to do, when they report impersonation.
What to watch next
The FTC comment window closes November 30. SB 690 and SB 923 both take effect January 1, 2027. After that, two signals matter: whether the California Attorney General brings any pen register cases under its now-exclusive authority, and whether the Legislature takes up the broader CIPA reform Newsom asked for in his signing message.