SB 690 and the Future of CIPA: Will a Safe Harbor Ever Arrive?
California SB 690 represents legislative pushback against the CIPA website litigation wave, aiming to carve out a safe harbor for standard analytics and marketing tools. Here's what that would mean if enacted.
Everything else in this series has been about how to reduce risk under CIPA as it currently stands. This piece is about the other half of the picture: legislative efforts, including California SB 690, aimed at narrowing or clarifying CIPA’s application to ordinary website technology in the first place. If that kind of reform succeeds, it would change the underlying calculus this whole series is built around.
What a bill like this is generally trying to do
The core complaint from industry groups and defense-side commentators about the current CIPA litigation wave is that a 1967 wiretapping statute is being applied to technology, pixels, analytics, chat widgets, that Californians interact with constantly and that Californians’ lawmakers plainly weren’t thinking about when the statute was written. A safe-harbor style reform generally aims to add explicit statutory language exempting standard, disclosed website analytics and marketing tools from the wiretapping framework, while still preserving the statute’s original purpose around genuine covert interception.
Why this is harder to pass than it sounds
Any safe-harbor proposal runs into a real tension: carve the exemption too broadly, and you undercut legitimate privacy protections along with the litigation abuse; carve it too narrowly, and it doesn’t meaningfully change the exposure this series has been describing. Privacy advocates and plaintiffs’-side interests have institutional reasons to resist a broad carve-out, while business and technology interests push for one, which is a normal, slow-moving legislative dynamic, not unique to this bill.
Enzuzo
Regardless of where a safe-harbor bill ends up, proper consent gating is the one mitigation that works whether or not the law changes, which is why it's worth doing now rather than waiting to see how legislation shakes out.
Why we’re not telling you it’s already resolved
Legislative status changes, bills get amended, stall in committee, get reintroduced in a later session, or pass in a substantially different form than originally proposed. We’re not going to state a current pass/fail status here with confidence, because by the time you’re reading this, the situation may well be different than it was when this was written. If you want the current status, checking the California Legislative Information site directly, or asking counsel who tracks this specific area, will be more reliable than any snapshot in a blog post.
What this means for your planning, either way
The practical guidance from the rest of this series doesn’t change based on the legislature’s timeline. If a safe-harbor bill eventually passes, businesses that already closed the pre-consent tracking gap lose nothing, they were already following the more conservative standard. If it doesn’t pass, or passes in a narrower form than hoped, the businesses that waited for legislative relief before addressing their tracking setup are exactly where this whole series started: exposed to the pattern described in our overview of who should actually be concerned.
The bottom line
Legislative reform is worth watching, and it’s a legitimate reason for optimism that this area of law eventually becomes less ambiguous. It’s not a reason to delay the mechanical fix, proper consent gating, that addresses your exposure regardless of how or when that reform lands.
This is a general analysis of legislative dynamics, not a current legal status report and not legal advice. Legislative status changes frequently, verify current status independently. Consult a privacy attorney for guidance on how any pending legislation might affect your specific situation.