Facebook-f Twitter Instagram

Your CRM’s Tracking Code Just Got a Partial Legal Reprieve — Here’s What Still Gets You Sued

Your CRM’s Tracking Code Just Got a Partial Legal Reprieve — Here’s What Still Gets You Sued

On September 30, 2026, California Governor Gavin Newsom signed SB 690, stripping private plaintiffs of the right to sue over the “pen register” theory that has powered thousands of website-tracking lawsuits since 2023. If you run HubSpot’s tracking code, a Salesforce-powered chat widget, or Zoho SalesIQ on a public website, the single most popular shakedown theory of the last three years is going away on January 1, 2027 — and it applies retroactively to cases filed on or after January 1, 2025. The problem: the law touches exactly one subsection of the California Invasion of Privacy Act. The wiretapping and eavesdropping provisions that target your chat transcripts, session-replay recordings, and recorded sales calls are untouched, and Florida and Pennsylvania plaintiffs never needed CIPA in the first place. This is a guide to what actually changed, what didn’t, and the consent configuration work your CRM admin should do in the next 60 days.

Key Takeaways

  • SB 690 was signed September 30, 2026 and takes effect January 1, 2027. It makes CIPA’s pen register and trap-and-trace provision (Penal Code § 638.51) enforceable only by the California Attorney General for conduct on websites and mobile apps, and reaches back to claims in actions commenced on or after January 1, 2025.
  • CIPA §§ 631 and 632 — wiretapping and eavesdropping — were not amended. Those are the provisions behind chat-widget, session-replay, and call-recording claims, and they carry $5,000 per violation or treble damages.
  • Two of the biggest CRM platforms are already in the case law and the complaints: Salesforce was the chat vendor in the Ninth Circuit’s Gutierrez v. Converse decision, and HubSpot has been named among the tracking tools at issue in CIPA filings.
  • Florida’s FSCA, Pennsylvania’s WESCA, the federal Wiretap Act, and California’s CDAFA are all unaffected by SB 690, and filings in those venues are growing.
  • The fix is mostly configuration, not legal strategy: control when tags fire relative to consent, get chat consent before transcript capture, set region-aware call-recording consent, and store proof of consent as a record in the CRM.

What SB 690 Actually Changed

CIPA is a 1967 wiretapping statute. The provision at the center of SB 690, § 638.51, prohibits installing or using a “pen register” or “trap and trace device” without a court order — language written for devices that capture dialing and routing information from a telephone line, not the content of a call.

In Greenley v. Kochava (S.D. Cal., July 2023), a federal court became the first to hold that this language could reach software: a data broker’s SDK that fingerprinted devices and collected user signals could qualify as a pen register, because a “device or process” need not be a physical machine. Plaintiffs’ firms took the opening. If an analytics script, advertising pixel, or fingerprinting library captures a visitor’s IP address and routing data, the argument went, it is a pen register — and no content needs to be intercepted at all.

The volume that followed is what moved the legislature. According to legislative testimony cited by Spencer Fane, filings under § 638.51 climbed from roughly 600 to more than 4,000 after the bill was introduced, driven largely by a handful of plaintiffs’ firms using repeat plaintiffs. SB 690’s sponsor pointed to thousands of suits and tens of thousands of demand letters. With statutory damages of $5,000 per violation — and plaintiffs arguing each visit is its own violation — even a mid-market company with modest California traffic faced numbers that made a five-figure settlement look rational regardless of the merits.

SB 690 amends § 637.2, CIPA’s private-right-of-action section, so that a § 638.51 claim arising from conduct on an internet website, online application, or mobile application may be brought only by the California Attorney General. The underlying conduct is still unlawful. Only the plaintiff’s bar loses the key.

What SB 690 Did Not Change

Everything else. Specifically:

Section 631(a) — wiretapping. This is the provision behind most live-chat and session-replay claims, and it is where the fight moves next. As Proskauer’s analysis puts it, plaintiffs will now have to focus on a narrower category of sites where testing shows the technology captured substantive communications — keystrokes and clicks recorded by a session-replay vendor, form submissions, on-site search terms, or URLs that themselves reveal something sensitive, such as a medical or legal topic.

Sections 632 and 632.7 — recording confidential communications. All-party consent. This covers recorded phone calls and, in plaintiffs’ framing, chat sessions too.

Everything outside California. Barnes & Thornburg’s 2026 review describes what was a California-specific problem becoming a multistate campaign: Florida’s Security of Communications Act and Pennsylvania’s Wiretapping and Electronic Surveillance Control Act are both all-party-consent statutes with damages up to $1,000 per violation, and plaintiffs are also stacking federal Wiretap Act claims and California’s Comprehensive Computer Data Access and Fraud Act. Massachusetts went the other way — its high court held in Vita v. New England Baptist Hospital (October 2024) that the state’s 1968 wiretap law does not stretch to website browsing — but that is one state, not a trend.

The defense side has had real wins worth knowing about. In Thomas v. Papa John’s (Ninth Circuit, 2025), involving FullStory session-replay software, the court applied the party exception: a business operating its own website is a party to communications on that site, so embedding code to monitor activity on your own property is not eavesdropping. Third-party liability requires evidence the vendor acted independently of the business. And in Gutierrez v. Converse, the Ninth Circuit affirmed summary judgment for Converse on a § 631(a) claim over its Salesforce-powered chat, finding no evidence Salesforce willfully read the contents of any communication — messages were encrypted in transit and stored behind password protection, and the plaintiff showed at most that the vendor could read them.

That last distinction is the whole ballgame for CRM buyers, and it is why contract terms and platform settings matter more than your privacy policy’s wording.

Theory Statute Who can sue after Jan 1, 2027 Typical target Exposure
Pen register / trap and trace Cal. Penal Code § 638.51 California AG only (web/app conduct) Pixels, fingerprinting libraries, analytics SDKs capturing IP and routing data $5,000 per violation, AG enforcement
Wiretapping Cal. Penal Code § 631(a) Private plaintiffs Chat transcripts, session replay capturing keystrokes and form content $5,000 per violation or 3x actual damages
Eavesdropping on confidential communications Cal. Penal Code §§ 632, 632.7 Private plaintiffs Call recording, AI notetakers, chat $5,000 per violation or 3x actual damages
Federal Wiretap Act 18 U.S.C. § 2511 Private plaintiffs Pixel data shared with ad platforms Statutory damages plus fees
Florida FSCA Fla. Stat. ch. 934 Private plaintiffs Same technology, Florida visitors Up to $1,000 per violation
Pennsylvania WESCA 18 Pa. C.S. § 5701 et seq. Private plaintiffs Same technology, Pennsylvania visitors Up to $1,000, plus punitive damages and fees

Where This Touches Your CRM Specifically

Most companies treat this as a marketing-website problem and hand it to whoever owns the cookie banner. In practice, four of the five exposed systems live inside the CRM:

1. The CRM tracking script. HubSpot’s tracking code, Salesforce Account Engagement tracking, and Zoho’s visitor-tracking scripts de-anonymize visitors and tie page views to contact records. HubSpot has been named directly among the tracking tools at issue in CIPA filings. If your script loads on page load, before any consent choice, you are in the fact pattern plaintiffs look for.

2. Live chat and AI chat agents. HubSpot Conversations, Salesforce Embedded Service and Agentforce channels, and Zoho SalesIQ all route visitor messages through a vendor before the transcript lands on a contact record. Gutierrez is defense-friendly, but it was won on evidence about what Salesforce actually did with the data — not on a theory that chat vendors are categorically safe.

3. Forms and enrichment. A form that posts to the CRM and simultaneously fires ad-platform conversion tags is the highest-risk object on most sites, because the form fields are content.

4. Call recording and AI notetakers. Your dialer, your Service Cloud Voice or Zoho Voice recordings, and any AI notetaker joining calls all sit squarely under the all-party-consent provisions SB 690 left alone.

5. Vendor data-reuse rights. The question that decides third-party cases is whether the vendor can use your visitors’ data for its own purposes. That answer is in your contract and your platform settings, not in your sitemap.

The Consent Audit to Run Before January

  1. Scan for what actually fires, in what order. Not what your tag manager says is installed — what loads on a cold visit before any click. HubSpot customers should turn on cookie scanning under Settings > Privacy & Consent > Cookies; note HubSpot’s own caveat that its banner cannot control cookies placed by other scripts unless you use the scanner tool. If you are still on the v1 consent banner, migrate: HubSpot is sunsetting it in favor of the v2 editor, which supports opt-in or opt-out behavior and consent grouped by cookie category.
  2. Gate chat before the transcript starts. In Zoho SalesIQ this is explicit: Settings > Brands > your brand > Configurations > Privacy, then enable the consent banner, with the .privacy.chatbannercontent() JavaScript API to customize the pre-chat consent text and .privacy.getCookieList() and .privacy.updateCookieConsent() to integrate with your own CMP. Salesforce and HubSpot equivalents live in pre-chat forms and consent-to-process settings.
  3. Exclude sensitive pages entirely. Health, financial, login, and account pages should be tag-free zones. This is the single change that most reduces § 631 exposure, because it removes the “substantive content” hook.
  4. Make call recording region-aware. HubSpot documents a recording consent message that plays before the rep picks up, plus inbound and outbound exceptions by phone number, user, or region. Configure it for all-party-consent states rather than relying on rep discretion, and extend the same rule to AI notetakers.
  5. Store consent as CRM data. Salesforce ships a consent data model for this — ContactPointConsent (API 48.0+) for channel-level consent and AuthorizationFormConsent (API 46.0+) for form acceptance, with capture date and method. HubSpot and Zoho equivalents exist. If you cannot produce a timestamped record showing a specific visitor consented before a specific tag fired, you have no defense worth filing.
  6. Read the vendor’s data-use rights. Look for any right to use your data for the vendor’s own product improvement, model training, or audience building, and turn those off or negotiate them out. That clause is what converts a party-exception win into a third-party-eavesdropper loss.
  7. Reconcile the privacy policy with the scan. Courts in 2025 and 2026 have increasingly looked at whether disclosures matched actual data flows. A policy describing a stack you retired two years ago is evidence against you.
  8. If you have a pending claim, talk to counsel this month. Fisher Phillips, K&L Gates, and others are advising defendants with § 638.51 claims in actions commenced on or after January 1, 2025 to evaluate dismissal motions and renegotiate open demand letters from a stronger position.

The common mistakes are predictable: installing a banner but never changing tag-firing logic, so everything loads anyway; assuming one banner satisfies California, Florida, and Pennsylvania at once, when consent built for one statute does not necessarily satisfy another; and treating this as a website project while the CRM’s own scripts, chat, and dialer go unexamined.

CRM Experts Online’s Perspective

We implement and maintain these platforms, so here is the blunt version: in almost every engagement where we audit this, the consent banner and the actual tag-firing order disagree. Marketing installs the banner. Someone else adds a pixel through the tag manager for a campaign. Nobody re-tests. Six months later the site is collecting form content before consent and the privacy policy describes none of it.

SB 690 is good news and it changes very little about the work. The pen register theory was the one that required the least from plaintiffs — no content, no interception, just a pixel and a California IP address. Removing it means the remaining theories demand actual evidence about what your tools captured and what your vendors could do with it. That is a technical and contractual question, and it is answerable: a clean tag inventory, consent captured before collection, sensitive pages excluded, recording consent configured by region, vendor data-reuse rights switched off, and consent stored as a queryable record on the contact.

Our recommendation for the next 60 days is narrow and cheap: run the scan, fix the firing order, turn on the consent features your CRM already includes, and get proof of consent into the database. If a demand letter arrives in 2027 under § 631 instead of § 638.51, the difference between a nuisance settlement and a dismissal is whether you can show, with records, what happened on the visit in question. Nothing here is legal advice — have counsel review your posture — but most of what counsel will tell you to fix is configuration we can do with you.

FAQ

When does SB 690 take effect? January 1, 2027. It was signed September 30, 2026, and the amendment applies to claims in actions commenced on or after January 1, 2025.

Does this mean website tracking lawsuits are over in California? No. It removes the private right of action for the § 638.51 pen register and trap-and-trace theory in the website, app, and online-application context. CIPA’s wiretapping and eavesdropping provisions, the federal Wiretap Act, CDAFA, and other states’ statutes remain fully available to private plaintiffs.

Can we stop worrying about our cookie banner? No — and if anything, consent timing matters more now. The surviving theories turn on whether substantive content was captured without consent, which is exactly what a correctly wired banner prevents.

Are we safe because we use a well-known chat vendor? Not automatically. Gutierrez v. Converse went Converse’s way because the record showed Salesforce did not read message contents and data was encrypted in transit and stored behind password protection. The vendor’s brand did not win the case; the evidence about data handling did.

What about our recorded sales calls and AI notetakers? Those sit under CIPA §§ 632 and 632.7 and similar all-party-consent laws in Florida, Pennsylvania, and other states. SB 690 does not touch them. Configure a recording consent message and region-based exceptions in your dialer, and apply the same disclosure when an AI notetaker is on the call.

We’re not in California. Does any of this matter? Yes. These statutes follow the visitor, not your headquarters. Florida and Pennsylvania claims target the same pixels and chat widgets, and a Florida visitor on your site is enough.

If we have an open demand letter, should we settle now? Talk to counsel first. If the claim rests on § 638.51 and the action was commenced on or after January 1, 2025, your position is materially stronger than it was in August.

How long does a consent audit take? For a typical mid-market site with one CRM, a tag manager, and a chat widget, about a week to inventory and test, and two to four weeks to remediate firing order, chat consent, call recording, and consent storage.

Conclusion

SB 690 closes the cheapest door into your website and leaves the harder ones open. That is a meaningful win if you use the window to fix the underlying configuration, and a trap if you read it as permission to stop paying attention. The companies that will be fine in 2027 are the ones that can prove, from their own CRM records, that consent came before collection.

If you want someone to run that audit against your actual HubSpot, Salesforce, or Zoho configuration — tags, chat, forms, dialer, and consent records — and hand your counsel a clean picture of what the stack really does, schedule a consultation with CRM Experts Online. We will tell you what to turn off, what to rewire, and what to document, before a letter shows up.

Further Reading