The California legislature has passed the compromise version of SB-690, leaving most of the private right of action provisions of the California Invasion of Privacy Act (CIPA) in place.
Thanks to massive lobbying efforts by Big Tech, other states have lost out on their own opportunities for privacy laws enforceable by individuals via civil lawsuits. But California legislators found out that they somehow had private right of action all along and decided to keep it.
The result will be a shift in privacy compliance priorities from bureaucratic to jury-focused, which is good news for legitimate companies.
How we got here
Starting around 2024, some attorneys realized that CIPA, which addresses “advances in science and technology,” can apply to internet data collection, too, not just the 1967 phone system in particular.
The resulting cases have gone in different directions, including everything from early dismissals and settlements to a jury verdict against Meta for data collection from the Flo menstrual tracking app.
In a court order last October, US District Judge Vince Chhabria scolded the California legislature. “The state of affairs with CIPA is untenable. Courts are issuing conflicting rulings, and companies have no way of telling whether their online business activities will subject them to liability … Under these circumstances, it is imperative for the legislature to bring CIPA into the modern age.”
At the time, a version of SB-690 that would have drastically cut CIPA by exempting any “commercial business purpose” was stalled, passed by the state senate but not taken up by the assembly. SB-690 was even chosen as the Worst State Anti-Privacy Bill of 2025 by Oakland Privacy (a statewide NGO) and opposed by other privacy groups.
On the other hand, more than 4,000 CIPA lawsuits have been filed, mostly against legitimate businesses, not Big Tech. Some now-common marketing data practices are at issue, and those cases show that some marketing features that are easiest to add to a site or app are also some of the most legally risky.
The legislature’s SB-690 compromise is the clarification Judge Chhabria was waiting for. Private right of action over online tracking is still a thing, which means that juries, not regulators, are the most important standard-setters for the data practices that are and aren’t acceptable.
That’s a big deal for judges, but an even bigger one for marketers. We’re in for priority-setting and budget shifts, and a pivot to data practices that future jurors are willing to accept, even when explained as clearly as a plaintiff’s lawyers and experts can. Clever dialogues and workarounds won’t work. Meta users supposedly “agree” to a set of terms longer than the US Constitution, but that didn’t help Meta with the Flo jury.
Know your jury. Know your customer.
The good news is that jurors and customers are the same people, and marketing is supposed to be able to understand customers. There’s already plenty of research on people’s attitudes toward various data practices.
The fractional chief privacy officer of the near future will go beyond just scrubbing the site of lawsuit-magnet tracking scripts and look to customer research to understand what uses of personal information are acceptable. People are concerned about the inflationary effects of surveillance pricing, social apps designed to inflict mental health harms and the costs and pollution of data center projects.
In recent polls of US 18-34-year-olds, Google CEO Sundar Pichai is doing about as well as Osama Bin Laden. Research will give smaller and customer-centric businesses a sustainable advantage over Big Tech (while creating a temporary hiring crunch for research-driven fractional chief privacy officers).
We can expect more Big Tech misinformation about CIPA, but astroturf-style. The shadowy “Alliance for Legal Fairness,” run from a WeWork in Virginia, doesn’t reveal any members. They will keep fighting CIPA, because the data practices that customers/jurors reject are the same data practices that power Big Tech’s ongoing squeeze on customer acquisition costs. That “creepy” data sharing from a site or app doesn’t just sound bad to a jury; it feeds into what Tatari’s Vicky Chang calls “a billion-dollar measurement illusion” perpetrated against the legit advertiser.
Moving toward customer-acceptable data practices is not just relatively straightforward as a web project, but a long-term win. Even if the immediate reason to remove a tracking script or pixel is to avoid a lawyer letter, the biggest consequence is to cut off the data flow that Big Tech uses to support ever-increasing value extraction from legit companies.
The data practices that are acceptable to customers are the same data practices that will sustain a future, fairer online economy. And, who knows, maybe I’ll see you at jury duty for the next big privacy trial.
“Data-Driven Thinking” is written by members of the media community and contains fresh ideas on the digital revolution in media.
Follow Don Marti and AdExchanger on LinkedIn.
For more articles featuring Don Marti, click here.
