Law / United States / 
California
Invasion of Privacy Act, Pen Registers and Trap and Trace Devices
Cal. Penal Code §§ 638.50-638.52
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent
As of .
What it requires
- Do not install or use a pen register or a trap and trace device without first obtaining a court order, unless you are a provider of electronic or wire communication service using the device to operate, maintain, or test your own service, to protect your rights or property, to protect users from unlawful or abusive use of the service, to record that a communication was initiated or completed in order to guard against fraudulent, unlawful, or abusive use, or unless the user of the service has consented.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A violation of section 638.51 is punishable by a fine not exceeding $2,500, imprisonment in a county jail not exceeding one year, or both.
Statutory damages
Available through section 637.2's chapter-wide civil action: the greater of $5,000 per violation or three times actual damages, per violation rather than per person.
- As of
- Currency
- USD
- Per person minimum
- 5,000
Who enforces it
Enforcement body
Private civil action under Penal Code section 637.2; a violation is separately prosecuted as a misdemeanor.
Settledness
Whether the section 638.50 definitions reach website tracking or session-replay software that does not operate on a telephone line is recorded here as an open question.
- As of
- Open questions
- Does software that records a website visitor's keystrokes, mouse movements, or session activity, and transmits routing or session-identifying information about that visitor to a third party, fall within the pen register or trap and trace device definitions this section adopts from section 638.50, when neither device operates on a telephone line?
What this law does
Section 638.51(a) makes it unlawful for a person to install or use a pen register (a device or process that records the dialing, routing, addressing, or signaling information an instrument transmits, but not the contents of the communication) or a trap and trace device (a device or process that captures the incoming signals identifying the source of a communication) without first obtaining a court order.
Section 638.51(b) exempts a provider of electronic or wire communication service using the device to operate, maintain, or test its own service, to protect its rights or property, to protect users from unlawful or abusive use, to record that a communication was initiated or completed in order to guard against fraud, or where the user of the service has consented.
Because this section sits within the same Chapter 1.5 (Invasion of Privacy) as sections 631, 632, and 632.7, a violation carries the same civil action under section 637.2, for the greater of $5,000 per violation or three times actual damages, and the same misdemeanor exposure under section 638.51(c) of a fine of up to $2,500, up to a year in county jail, or both.
A bill amending section 637.2, Senate Bill 690 of the 2025-2026 Regular Session, passed both houses of the Legislature on and was enrolled and sent to the Governor on ; if signed, it would let only the Attorney General, not a private plaintiff, bring an action under section 637.2 against a private party for a violation of this section arising from conduct on an internet website, online application, or mobile application, while leaving the private civil action for a violation of sections 631, 632, and 632.7, and for a violation of this section outside that context, unchanged.
When LexLint raises it
When your app profile says your app tracks devices.