Disclaimer: Freshpaint does not provide legal advice. This article is for general informational purposes only. Organizations should consult qualified legal and privacy professionals about their specific circumstances.

On September 30, California Governor Gavin Newsom signed SB 690, significantly narrowing one of the California Invasion of Privacy Act (CIPA) theories plaintiffs have used to challenge tracking technologies on websites and apps.

For healthcare marketers who have watched everyday technologies become the subject of demand letters and lawsuits — and been forced to become wiretapping experts in their own rights — this brings some relief. 

That said, I caution you not to treat it as a permission slip to relax your privacy controls or to take down your cookie consent banners.

Let’s explore why.

First, what changed?

SB 690 addresses claims arising under one section of CIPA, limiting who can bring certain claims involving pen registers and trap-and-trace devices when the alleged conduct occurs on a website, online application, or mobile app. Under the new law, the California Attorney General has exclusive authority to bring those specific claims. 

In recent years, plaintiffs have enthusiastically leveraged CIPA’s pen register and trap-and-trace provision to challenge the use of website tracking technologies — and they are in part to thank for SB 690. Take the fact that there were 4,000 associated lawsuits filed against California businesses by mid-2026, up a whopping 567% from the number of lawsuits in early 2025, according to an analysis of SB 690 conducted by the Assembly Committee on Privacy and Consumer Protection. 

SB 690 applies retroactively to certain pending claims filed within two years before the law’s operative date of Jan. 1, 2027. In his signing message, Governor Newsom also said other CIPA provisions “remain susceptible to abuse by overly aggressive litigants” and called for a “fair balance between protecting private information and preventing rapacious litigation.” 

In plain English: one California wiretapping pathway private plaintiffs have used to pursue website- and app-tracking claims is now materially narrower. 

While CIPA may be more narrowly applied, litigation risk hasn’t disappeared

While SB 690 provides some relief, it’s one carve-out in California only. Other CIPA provisions remain, along with obligations created by state consumer privacy and health-data laws, federal consumer-protection law, consent requirements, and an organization’s own privacy representations.

For marketing teams, the practical message is straightforward: SB 690 is a single thread in the greater patchwork of privacy laws, and it's a reason to continue embedding privacy in your measurement, activation, and technology strategy. 

As we know, a pageview, appointment request, or intake response can reveal something about a person’s health interests. Regardless of changes to CIPA, healthcare organizations have an obligation and greater consumer expectation to protect health information, and as such, healthcare marketers still require a clear view of the data their tools collect, the platforms that receive the data, a stance on consent and documentation around their privacy and risk policies and decision-making.

It’s also important to remember that plaintiffs tend to adapt — and are creative! When one legal theory becomes harder to pursue, plaintiffs’ attorneys often find other avenues to test. SB 690 will shape the next wave of website privacy litigation, and that wave may rely on different laws, like the Electronic Communications Privacy Act (ECPA), which underpinned the recent $20.5 million settlement with CVS Health & Criteo and telemedicine company American Wellness Corp. (Amwell). 

Claims may also come from different regulatory agencies altogether. States and the federal government continue to scrutinize how health and sensitive information is collected, processed, and shared. The recent FTC and state complaint against Hims & Hers illustrates the attention regulators are giving to the relationship between privacy promises and actual data practices in healthcare. Hims disputes the allegations.

Two things I’d do next

1. Get an organization-specific readout from counsel.

Ask legal counsel to explain how SB 690 affects your organization’s current exposure. Request a legal summary covering the theories that remain relevant to your marketing stack, including the top risks and obligations, and use it to plan any changes or improvements to your marketing tech stack and strategy. 

2. Embed privacy into your performance strategy.

I’ve seen too many healthcare organizations make the same mistake of treating privacy as a destination, which leads to a false sense of security that changes they made years ago or in response to one legal theory still hold up in today’s environment. 

Organizations that embed privacy in the corners of their systems, processes, and teams experience less disruption and higher growth than teams who treat privacy as an afterthought or check-the-box tactic. Our Privacy by Design playbook for healthcare marketers is a great starting point.

The Takeaway

While SB 690 provides some relief from CIPA claims, it doesn’t go as far as many healthcare marketers were hoping for. It provides a useful moment to sharpen your understanding of privacy risk and revisit your privacy and performance strategy. 

The strongest teams will have continuous visibility into the technologies operating across their digital properties, control over the data sent downstream, and a reliable way to confirm that consent choices and privacy statements match real-world data flows. A privacy-first healthcare marketing platform like Freshpaint gives you the foundation to do that as laws, vendors, and campaign strategies evolve.

Privacy and performance, together? 

Yes, we said it. Here’s how we bring it to life for you.