California has changed an important part of the law that fueled a wave of website tracking claims against businesses.
On September 30, 2026, Governor Gavin Newsom signed SB 690, which limits private lawsuits under one section of the California Invasion of Privacy Act, commonly known as CIPA.
For law firms, the change matters because website technologies like Google Analytics, call tracking software, advertising pixels, and other tracking tools have increasingly been cited in privacy demand letters and lawsuits.
But there is an important distinction:
SB 690 does not eliminate CIPA or every website privacy claim.
It narrows one specific category of claims involving California’s pen register and trap-and-trace provisions.
At Juris Digital, this issue became more than a theoretical legal development months before SB 690 passed. We were already dealing with website privacy concerns affecting law firm clients and working internally to understand the risks, coordinate the right people, and help clients respond.
That experience reinforced something we believe strongly:
A law firm marketing agency’s responsibility should not stop at rankings, traffic, or leads.
Our clients should be focused on practicing law and helping people. When something involving the website we manage creates a business or legal concern, we should help solve the problem rather than simply point at someone else.
What Is CIPA?
The California Invasion of Privacy Act was enacted in 1967, long before websites, Google Analytics, Meta Pixels, or modern digital advertising existed.
Over the past several years, plaintiffs have increasingly attempted to apply portions of the law to modern website tracking technologies.
Some claims argued that tools used routinely across the internet could improperly intercept or transmit information about website visitors.
For law firms, this created an unusual problem.
The same technologies used to measure whether a website is generating calls and cases are also technologies that can create privacy considerations.
As part of our law firm website design services, we increasingly have to think beyond what a website looks like. We have to consider the technology behind it, how visitors interact with it, how leads are tracked, and how those systems connect to the rest of a firm's marketing.
Common technologies implicated in website privacy allegations have included:
- analytics software
- advertising pixels
- call tracking technology
- chat tools
- session recording software
- website forms
- third-party tracking scripts
The specific facts and legal theories vary from case to case, which is why firms receiving an actual demand should have counsel review the allegations.
Why Law Firms Started Receiving Website Tracking Demands
Modern legal marketing requires measurement.
A law firm wants to understand questions such as:
- Which marketing channels generate signed cases?
- Which landing pages convert?
- Which advertisements produce calls?
- Which search queries generate potential clients?
- Where are visitors abandoning the website?
Those questions are central to effective marketing.
For example, our law firm SEO services are designed around more than rankings. We want to understand whether search visibility is ultimately producing qualified leads and signed cases.
The same is true with PPC management for law firms. Connecting advertising spend to calls, qualified inquiries, and signed cases requires accurate tracking.
Answering those questions commonly requires third-party technology.
The problem is that certain plaintiffs began arguing that the operation of those technologies violated older California privacy statutes.
As these claims became more common, businesses across the country began receiving demand letters and lawsuits.
Law firms were not immune.
We Were Dealing With This Before SB 690 Passed
By June 2026, one of the law firms whose website we managed had received a pre-litigation demand alleging violations of CIPA related to common website tracking technology.
That immediately became more than a development ticket.
Our general counsel reviewed the issue, evaluated the potential risks and defenses, and brought the matter to leadership.
We also began looking more broadly at issues surrounding California privacy practices and website tracking.
That distinction matters to me.
It would have been easy for a marketing agency to say:
“This is a legal issue. Talk to your lawyer.”
Technically, that might be true.
But it would not be much of a partnership.
When we manage a law firm’s website and an issue arises involving the technology running on that website, we should help coordinate the response.
That does not mean a marketing agency replaces legal counsel.
It means we should be able to identify the technology involved, understand how it is configured, assist counsel with the technical facts, make appropriate website changes when needed, and help the client move forward.
Marketing channels should not operate in silos.
Neither should problems.
What Did SB 690 Change?
SB 690 was signed into law on September 30, 2026 and becomes operative on January 1, 2027.
The legislation changes how a specific provision of CIPA can be enforced.
In particular, it restricts private claims involving website or application activity under California Penal Code Section 638.51, which addresses pen registers and trap-and-trace devices.
Under the amended statute, those actions may generally be brought by the California Attorney General rather than private plaintiffs.
That is significant because this provision had become one of the legal theories used in website tracking litigation.
SB 690 also contains provisions addressing certain lawsuits filed before the operative date.
For businesses facing claims based specifically on Section 638.51, the legislation could have a substantial effect.
What SB 690 Does Not Do
This is where some headlines can become misleading.
California did not repeal CIPA.
Other provisions remain.
For example, claims involving CIPA Sections 631 or 632 may still be possible when the legal requirements for those claims are met.
Other California privacy laws can also apply to website data practices.
SB 690 therefore should not be interpreted as:
“Website privacy does not matter anymore.”
That would be the wrong takeaway.
The better takeaway is:
One heavily litigated theory has been substantially restricted, while website privacy and tracking compliance remain important.
Does Your Law Firm Still Need Cookie Consent?
Potentially, yes.
SB 690 does not automatically eliminate the reasons a website may need consent mechanisms, privacy disclosures, or controls around third-party tracking technology.
Those requirements may depend on:
- where website visitors are located
- which technologies are running
- what information is collected
- where that information is transmitted
- how that information is used
- which state or federal privacy laws apply
This is one reason we believe website technology should be reviewed as part of the overall operation of a law firm's online presence.
A modern law firm website is no longer just a digital brochure.
It can include advertising platforms, analytics systems, CRM connections, call tracking, intake software, chat systems, conversion tracking, and dozens of third-party scripts.
Every additional integration adds capability.
It can also add complexity.
If you are trying to understand the structural side rather than hire someone to build it for you, our guide explains how to structure a law firm website, including the relationship between practice areas, locations, attorneys, internal links, and conversion paths.
What Law Firms Should Review
Law firms do not need to become privacy engineers.
But someone should know what is operating on the website.
A sensible review can include:
1. Identify the tracking technologies running on the website
Create an inventory of third-party scripts, pixels, analytics tools, chat software, call tracking, and advertising technologies.
2. Review the privacy policy
Make sure the firm's privacy disclosures actually reflect how the website operates today.
Website technology changes frequently. Privacy policies often do not.
3. Evaluate consent tools
Where appropriate, evaluate whether tracking should be blocked until a visitor provides the required consent.
4. Review forms and intake technology
Law firm websites often collect particularly sensitive information.
Contact forms, chat conversations, and intake systems deserve additional scrutiny.
5. Know where data goes
Understand which third parties receive information from the website and what those vendors do with it.
6. Have a response process
If the firm receives a privacy demand, there should be a clear escalation process involving:
Client → Marketing Team → Technical Team → Legal Counsel
The worst time to figure that process out is after a demand letter arrives.
Website Compliance Should Be Part of Website Management
We increasingly believe that managing a law firm's website means more than keeping WordPress updated or making sure pages load.
A modern website sits at the center of the firm's marketing operation.
That includes:
- SEO
- advertising
- analytics
- intake
- tracking
- conversion optimization
- accessibility
- privacy
- security
That is why our law firm website design and development services treat the website as marketing infrastructure rather than simply a design project.
For firms that are researching before they are ready to redesign a website, we also maintain a collection of law firm website design guides covering strategy, structure, design, performance, and conversion.
The distinction is intentional.
Our service pages explain what Juris Digital can do for a law firm.
Our guides explain how these things work so attorneys can make better decisions whether they hire us or not.
The Bigger Lesson for Marketing Agencies
There is a bigger lesson here than SB 690.
Marketing agencies sometimes define their job too narrowly.
SEO agencies say they are responsible for rankings.
PPC agencies say they are responsible for leads.
Website companies say they are responsible for keeping the website online.
But none of those metrics pays a law firm's payroll by itself.
The actual objective is helping the law firm grow responsibly.
That is why our law firm SEO services focus on attracting the searches and potential clients that matter to the firm's business rather than simply producing more rankings.
It is also why tracking matters.
If a marketing company cannot connect its work to qualified inquiries, signed cases, and revenue, it becomes very easy to optimize for metrics that look good in a report but do not actually grow the firm.
And when something threatens the systems responsible for producing those results, the agency should help solve it.
Our Clients Should Be Practicing Law
Law firms already have enough complexity.
Attorneys should not have to spend their afternoon figuring out what a Meta Pixel does, whether Google Tag Manager fired before a consent banner loaded, or which vendor receives information from a contact form.
That is our job to understand.
Our clients should be focused on the people calling them for help.
When an issue arises around the marketing systems we manage, our goal is to help coordinate the solution and reduce the burden on the firm.
SB 690 may reduce one category of website tracking litigation in California.
But the experience reinforced something broader for us.
Being a law firm's marketing partner means taking responsibility for more than marketing metrics.
It means protecting the systems behind the firm's growth, staying alert when the environment changes, and helping clients focus on what they do best.
Helping people who need legal help.
Want Us to Review Your Law Firm's Marketing Infrastructure?
If Juris Digital already manages your marketing and you have questions about the technology running on your website, talk with your Juris Digital team.
If we do not currently work together and you want a marketing partner that thinks beyond rankings, learn more about our law firm digital marketing services or schedule a discovery call.
This article provides general information and is not legal advice. Businesses facing a CIPA demand or website privacy claim should consult qualified legal counsel regarding their specific circumstances.
