Defending Pending Website-Tracking Suits After SB 690: The Pen-Register Lookback and the Conversion Window

This session delivers a precise statutory reading of California SB 690 and its two-year retroactivity mechanic against the backdrop of nearly 4,000 active California pen-register cases. Attorneys learn exactly which pending § 638.51 claims fall inside and outside the January 1, 2025 lookback cutoff, how the bill’s scope compares to earlier drafts, and what the statute leaves entirely untouched—including §§ 631 and 632, CDAFA (Penal Code § 502), and all federal theories. The session maps those surviving theories side by side: how ECPA’s federal wiretap provision tracks CIPA § 631(a)’s interception prohibition but turns on a one-party consent standard; how courts have split over whether the crime-tort exception requires a specific criminal or tortious purpose or is satisfied where a commercially motivated interception itself results in a qualifying wrong; how plaintiffs plead HIPAA violations and violations of the DOJ Bulk Sensitive Data rule (restricting transfers of sensitive personal data to “countries of concern”) to supply the predicate at the pleading stage. Attendees also examine CDAFA’s elements (knowing, unpermitted access to and taking or use of data), its lack of a minimum loss threshold, and the defenses courts have credited, including lack of cognizable damage or loss and the distinction between code on the defendant’s website and access to the user’s own device. Attendees leave with a concrete audit framework for triaging pending dockets and identifying the claim-conversion risk before January 1, 2027.

This session equips defense counsel with a concrete litigation strategy for resolving pending California CIPA § 638.51 pen-register website-tracking cases before SB 690’s January 1, 2027 operative date. Attorneys will learn how to triage cases by filing date, evaluate stay motions, re-calibrate settlement value, and draft releases that account for the § 631 wiretapping tail risk that SB 690 does not eliminate. Attorneys will also be briefed on risks of amended or refiled claims under ECPA and CDAFA. The session then addresses how to prepare for crime-tort exception theories premised on HIPAA disclosures or Bulk Sensitive Data rule transfers, how to assess forum risk in light of the current district court split, and what early motion-to-dismiss arguments remain available, including the party exception, lack of a criminal or tortious purpose independent of the interception, insufficient specificity as to the health or sensitive data disclosed, and CDAFA’s damage-or-loss and access requirements. Attendees leave with a decision framework covering three procedural postures — stay, settle, and move to dismiss — mapped to the specific facts of their pending matter and to the follow-on federal and CDAFA exposure that may outlast SB 690.