California Passes Compromise SB-690, Keeping CIPA Lawsuits Alive
California passed a compromise SB-690, preserving most CIPA private lawsuit rights, while Big Tech lobbying killed similar provisions in other states, AdExchanger reports.
Updated
The brief
- The California legislature passed the compromise version of SB-690.
- Most private right of action provisions of the California Invasion of Privacy Act remain in place.
- AdExchanger credits massive Big Tech lobbying with blocking private-enforcement privacy laws in other states.
The California legislature has passed the compromise version of SB-690, leaving most of the private right of action provisions of the California Invasion of Privacy Act (CIPA) in place.
That outcome makes California the outlier. Under CIPA, individuals can sue over privacy violations directly, without waiting for a regulator to act. The compromise bill preserves most of that enforcement mechanism, according to the report from AdExchanger.
Other states have not fared as well. AdExchanger attributes the loss of private enforcement provisions elsewhere to "massive lobbying efforts by Big Tech." As a result, consumers outside California have lost opportunities to bring civil lawsuits under their own state privacy laws.
The stakes are significant for marketers. A private right of action converts privacy compliance from a regulatory matter into a litigation risk. Every data collection practice, tracking pixel and wiretapping-adjacent technology becomes a potential class action, not just an enforcement inquiry.
California's retention of CIPA's provisions means that risk persists in the largest state advertising market in the US. Brands, agencies and adtech vendors operating there will continue to face exposure from individual plaintiffs and their counsel.
For advertisers, the practical takeaway is blunt: privacy has shifted from a pure compliance function to a research problem. Understanding which data practices trigger CIPA claims, and how courts interpret the statute, now requires ongoing analysis rather than a one-time checklist.
The divergence among states also complicates national campaigns. Advertisers cannot assume a single privacy standard; they must map their data flows against a patchwork in which only some jurisdictions grant consumers a courtroom route to enforcement.
With SB-690's compromise language passed, attention now turns to how aggressively plaintiffs' lawyers will use the surviving CIPA provisions — and whether other states will revisit private enforcement once lobbying pressure eases.
Based on leginfo.legislature.ca.gov
Filed under privacy, california, cipa, sb-690, adtech
Amara Osei
Show full bio
News editor covering industry trends and analytics at Marketing Herald.