Law / United States / 
California
SB 690 (2025-2026), Attorney General-Only Enforcement of the Pen-Register Private Right Against a Website or AppNew, enacted
Cal. Penal Code § 637.2 (SB 690, 2025-2026 Reg. Sess.)
A device storage and tracking consent rule binding private bodies.
- Private right of action
- No
What it requires
- From , a website, online application, or mobile application is still bound by section 638.51: do not install or use a pen register or trap and trace device without first obtaining a court order unless one of that section's exceptions applies; this amendment leaves a claim against a private business over a violation arising there to the Attorney General alone, and does not lift that bar.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Attorney General only, for an action against a private actor for a violation of Penal Code section 638.51 arising from conduct on an internet website, online application, or mobile application.
What this law does
Senate Bill 690 amends Penal Code section 637.2 to provide that an action against a private actor for a violation of section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under section 637.2 only by the Attorney General, removing the private right of action for that class of claim; it does not change the civil action for a violation of sections 631, 632, or 632.7, or for a violation of section 638.51 outside that context.
The amendment applies retroactively to a pending claim in an action commenced within two years before its operative date. Introduced in the California Senate on , the bill passed both houses on and was approved by the Governor on as Chapter 976 of the Statutes of 2026.
The bill carries no urgency clause, so under Government Code section 9600 it takes effect on the January 1 next following a 90-day period from the date of enactment: the period ends on , and the effective date is .
When LexLint raises it
When your app profile says your app tracks devices.
Back to the example · Lint your app
Page updated .