A local solar installation company. A billion-dollar lawsuit against Meta. And a bill in Sacramento that connects the two.
For Gytahnna Loffgren, whose family runs a small solar panel installation business, the letter that arrived in May felt like a nightmare. Her company was being sued for more than $35,000 over claims that its website violated California privacy law.
“We were completely blindsided,” Loffgren told CalMatters. “I’ve never been sued before… you instantly feel like you’ve done something terribly wrong.”
Loffgren’s case is one of thousands filed under the California Invasion of Privacy Act, a decades-old wiretapping law originally written to stop people from tapping telephone lines. Today, it’s being used against small businesses across the state over how their websites track visitors.
The California Legislature passed a bill Friday aimed at curbing these lawsuits, sending it to Gov. Gavin Newsom’s desk. Senate Bill 690 is being pitched as relief for beleaguered small-business owners who say they’ve been targeted by opportunistic lawyers. But critics say the legislation is something else entirely: a carefully engineered effort by Silicon Valley to escape accountability, dressed up as a favor to Main Street.
Backing the bill is a lineup of major tech companies, including Meta, Amazon, Google and X. Opposing it are some of the country’s most prominent privacy watchdogs, including the ACLU, the Tech Oversight Project and the National Consumer Law Center.
Those opponents argue that SB 690 is a Trojan horse, built on real frustration from small-business owners but shaped by tech industry lobbyists to serve a much larger purpose — eliminating the ability of everyday consumers to sue tech companies over data tracking violations. In its final form, the bill would strip individuals of the right to sue over these issues, leaving enforcement solely to the state attorney general’s office. It also includes a retroactivity provision that critics warn could unravel major ongoing privacy lawsuits against tech giants.
A spokesperson for the bill’s author, Sen. Anna Caballero, a Merced Democrat, said the goal has always been to stop what she considers frivolous lawsuits.
“Our bill accomplishes what we were able to achieve this year and reflects where we could come to a consensus,” the spokesperson said. “We recognize there is more work to do, and the Legislature will likely need to revisit this issue in a future session to address the remaining concerns.”
How a 1967 wiretapping law became a modern legal weapon
The California Invasion of Privacy Act dates back to 1967, when it was designed to prevent illegal phone-line eavesdropping. A 2015 amendment expanded the law to bar unauthorized use of devices that log routing or signaling information — a provision written with old-school “pen registers” and “trap and trace” devices in mind.
That update inadvertently opened the door for a wave of modern litigation. Attorneys have argued that everyday website tools — cookies, analytics trackers, even the Meta Pixel — function like digital pen registers because they log visitor information such as IP addresses. Over the past four years, lawyers representing targeted businesses estimate more than 4,000 lawsuits have been filed, with thousands more warning letters sent to business owners across the state.
“This is modern ambulance chasing, but it’s worse because at least with ambulance chasing, someone was harmed,” said Jim Monagle, an attorney with Mullen Coughlin who has defended healthcare clients against these claims. “Nobody’s really screaming out about the fact that a portion of their IP address was turned into a different unique ID… It doesn’t affect anyone.”
What makes the law so costly is its built-in penalty: $5,000 per violation, regardless of whether any real harm occurred. For small businesses running standard tools like Google Analytics, that can add up fast, often pressuring owners into costly settlements just to make the lawsuits go away.
Larger companies aren’t immune either. Earlier this year, the Los Angeles Times settled a similar class-action case for $3.85 million. Amazon and Meta are both fighting ongoing CIPA-related lawsuits tied to online tracking.
Even federal judges have criticized how the law is being applied. In an October 2025 ruling, U.S. District Judge Vince Chhabria — who oversees cases in the Bay Area — called the 1967 statute a “total mess” when stretched to cover modern internet technology, urging state lawmakers to rewrite the law from scratch.
Supporters of SB 690 say it answers that call, arguing that California’s existing privacy law, the California Consumer Privacy Act, already offers sufficient protection. But legislative analysts have pushed back on that claim. A report prepared for the Assembly Public Safety Committee found that the 2018 consumer privacy law doesn’t allow individuals to sue over routine tracking at all, leaving enforcement to an attorney general’s office that doesn’t have the staffing to monitor every website in the state.
Behind the scenes: a campaign built to look grassroots
Tracing the money behind SB 690 isn’t easy. California’s lobbying disclosure rules require organizations to report quarterly spending, but not how much goes toward any single bill — making it difficult to see exactly who is funding what.
One exception is the Alliance for Legal Fairness, a group created in 2024 specifically to push for changes to the wiretapping law and, eventually, to get SB 690 passed. It was founded by Andrew Kingman, a privacy attorney and lobbyist who also serves as general counsel for the State Privacy and Security Coalition, an influential industry group backed by companies including Amazon, Meta, Google and Mastercard that lobbies on data privacy issues nationwide.
In just two legislative quarters this year, Kingman’s Alliance spent more than $234,000 solely to advance the bill through the Capitol.
To build public support, the coalition identified small-business owners caught up in these lawsuits and encouraged them to testify in Sacramento. Supporters of the bill say it simply restores reasonable limits, pointing out that even some privacy advocacy groups use similar tracking tools on their own websites. But opponents argue the strategy is more calculated than that — using sympathetic small-business stories to build political cover while tech companies avoid direct scrutiny.
The financial muscle behind the bill goes well beyond one advocacy group. Companies including Meta, X Corp, Amazon, Chipotle, Mastercard and Chick-fil-A have collectively spent millions on lobbying in Sacramento this year, with a portion specifically earmarked for shaping SB 690.
Matt Schwartz, a policy analyst with Consumer Reports, said his organization has watched Kingman use a similar approach in privacy fights across “dozens and dozens” of states, making it difficult for lawmakers — let alone the public — to understand who is actually driving the legislation.
“These Big Tech companies rarely come into state legislatures with lobbyists saying that they’re from Meta or Google or Amazon and testify at the committee level with those affiliations out front,” Schwartz said. “Their own brand as giant companies might be too toxic to be out front, so they use smaller organizations as the mouthpiece. At the end of the day, it distorts the process — and it makes it almost impossible for lawmakers to see who’s actually pulling the strings until it’s too late.”
Kingman declined to comment on the record when asked whether his coalition is acting as a proxy for tech industry interests.
What’s really at stake: enforcement power and a retroactive clock
As originally written, SB 690 offered blanket protection for commercial tracking tools against both wiretapping and pen-register claims. After pushback from labor and privacy groups, Caballero narrowed the bill to focus only on pen-register claims, which involve metadata like IP addresses rather than the content of communications.
But as the bill moved through the Legislature, Caballero also added a retroactivity clause and altered how the law would be enforced — changes privacy advocates see as significant victories for the tech industry. They also warn that exempting metadata tracking altogether opens a serious loophole.
“California should be leading on tech regulation, but SB 690 does the exact opposite; it makes it easier for companies to spy on us,” said Jenna Sherman, campaign director at the women’s advocacy group Ultraviolet.
Ultraviolet joined the opposition largely because of the bill’s two-year retroactivity window, which could affect major ongoing cases — including Frasco v. Flo Health Inc., in which a San Francisco jury unanimously found Meta liable for improperly collecting sensitive reproductive health data, including details about users’ menstrual cycles and sexual activity, from the Flo Health period-tracking app without consent.
A judge overseeing that case has signaled Meta could owe as much as $8 billion in damages. The company has appealed the ruling and declined to comment when contacted by CalMatters.
Attorneys for the plaintiffs in that case say that if SB 690 had been law when they filed, they never would have been allowed to bring it — enforcement would have rested solely with the state.
That’s the outcome privacy advocates fear most. If Newsom signs SB 690, the five-year legal fight waged by the Flo Health plaintiffs may end up being remembered not as a turning point in data privacy law, but as one of the last times ordinary Californians were able to hold a tech giant accountable in front of a jury.
Original source: CalMatters
