Home › C² Privacy Engine™ › California

California Website Tracking, Privacy & Wiretap Litigation

Published by Crandall Consulting · Informational litigation intelligence · Last intelligence update: October 13, 2026

98/100

Risk Guideline

Very High

Risk Level

96%

Evidence Confidence

stable

Trend

Tracked Lawsuits

Tracked Matters

Tracked Demand Letters

Reported Claims

Currently required

GPC Opt-Out Signal Status

Lawsuits, demand letters, tracked matters, and reported claims are counted separately and are not interchangeable. Last intelligence update: October 13, 2026.

Risk scores, classifications, statistics, and technical findings are informational guidelines based on observed website behavior and publicly available litigation activity, statutes, court decisions, legal commentary, and other public sources. They are not legal advice, legal opinions, or determinations of liability.

Current Landscape

The supplied California dataset reports 36 lawsuits, 3 tracked matters, and 0 tracked demand letters. These are dataset counts, not statewide totals; the zero demand-letter count does not establish that no letters have been sent. The sources describe litigation involving CIPA §§ 631, 632, and 638.51 and technologies including cookies, pixels, session replay, analytics, SDKs, and chat tools, alongside separate administrative privacy enforcement.

Court outcomes are mixed and must be distinguished by procedural posture. D’Antonio v. Smith & Wesson reportedly survived a motion to dismiss, leaving technical issues for factual development rather than establishing liability. The supplied Yardi ruling is tentative, not an established final order. Popa and several subsequent cases address insufficient allegations of concrete injury for federal standing; those standing rulings do not themselves resolve the merits of the underlying tracking claims. Other courts have dismissed website pen-register claims on statutory interpretation grounds.

The California Privacy Protection Agency adopted stipulated final orders involving Ford, PlayOn Sports, and Tractor Supply. Ford’s and PlayOn’s summaries identify fines and specified compliance measures. The Tractor Supply excerpt does not disclose specific conduct, penalties, or remedial obligations. These are administrative resolutions, not court-filed lawsuits.

A supplied report states that SB 690 was signed September 30, 2026, and will limit private civil remedies for covered § 638.51 website and application claims beginning January 1, 2027. Other summaries describe earlier, pending versions of the legislation, so they should not be treated as statements of its final scope. In Variety Media, the Court of Appeal requested briefing on mootness and possible exceptions; no final merits or mootness decision is reported.

Current Litigation Activity

Current litigation component: 100/100.

October 18, 2024 – October 18, 2026

Research Window

rising

Current Filing Trend

Filing Velocity

Filed Cases (est.)

Tracked Matters

Important New Filings

Variety Media LLC v. Superior Court · August 21, 2026
Ortega, et al., v. Emanate Health Medical Center
D'Antonio et al v. Smith & Wesson Inc. · September 8, 2026
Barrales et al v. Reckitt Benckiser LLC · July 31, 2026
Lutge v. Timex.com, Inc. · September 14, 2026
Tanner v. FCA US LLC · September 16, 2026
Doe v. Engel et al · September 29, 2026
Kimmons v. NFL Enterprises LLC · September 28, 2026

Current Filing & Litigation Trends

The dataset documents substantial website-tracking litigation involving class allegations, pleading disputes, standing challenges, and differing interpretations of CIPA’s pen-register provisions. Sources also report increased filings and demand-letter activity, but the supplied counts do not provide a consistent time series from which to quantify growth. Administrative matters should be described separately from lawsuit filings. Recurring subjects include pixels, session replay, analytics, SDKs, alleged tracking after opt-outs, and sharing of browsing or identifying information.

Precedent Landscape: What Courts Have Decided

Precedent component: 91/100. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately — a high number of filings does not by itself indicate strong plaintiff-favorable binding precedent.

3 plaintiff-favorable and 4 defense-favorable decision(s) tracked; 2 carry binding authority.

Plaintiff-Favorable

Defense-Favorable

Mixed / Neutral

Binding Decisions

Persuasive Decisions

Key Decisions

Doe v. Adventist Health System/West · mixed · weight: binding
Javier v. Assurance IQ; D Antonio v. CNN · plaintiff favorable · weight: binding
Javier v. Assurance IQ · plaintiff favorable · weight: persuasive high
NetScout Systems, Inc. (case name not specified in article) · defense favorable · weight: persuasive
Blaker v. Netscout Systems · defense favorable · weight: limited
Schallert v. Palo Alto Networks, Inc. · defense favorable · weight: limited
Javier v. Assurance IQ, LLC and Active Prospect Inc. · plaintiff favorable · weight: limited
Rodriguez v. Ink America International Group · defense favorable · weight: limited

A settlement is not a binding precedent, and a procedural dismissal (for example, for lack of standing) is not a holding that the underlying technology is lawful. Where courts disagree, that disagreement is reflected rather than resolved.

Current Laws & Relevant Statutes

California Invasion of Privacy Act (CIPA) § 631 — Cal. Penal Code § 631 · all-party consent · private right of action · statutory damages
CIPA § 632 (Confidential Communications) — Cal. Penal Code § 632 · all-party consent · private right of action · statutory damages
CIPA § 638.51 (Pen Register / Trap and Trace) — Cal. Penal Code § 638.51 · private right of action · statutory damages

Regulatory Enforcement

Regulatory enforcement component: 100/100. Regulatory enforcement (agency investigations, sweeps, settlements, guidance, rulemaking) is tracked separately from private litigation and is never counted as a lawsuit.

California, Colorado, and Connecticut joint GPC investigative privacy sweep — California Privacy Protection Agency and the Attorneys General of California, Colorado, and Connecticut
On September 9, 2025, the agencies announced a joint investigative sweep concerning potential noncompliance with GPC opt-out requests.
Joint California, Colorado, and Connecticut GPC investigative privacy sweep — California Attorney General, California Privacy Protection Agency, and attorneys general of Colorado and Connecticut
The agencies announced an investigative sweep concerning potential noncompliance with GPC and sent compliance letters to businesses.
California Attorney General settlement with Healthline Media LLC — California Department of Justice, Office of the Attorney General
The Attorney General announced a settlement resolving allegations concerning online tracking, advertising data sharing, and consumer opt-out handling on Healthline.com.
CalPrivacy enforcement settlement and Board decision concerning Ford Motor Company — California Privacy Protection Agency
The agency reports a Board decision requiring Ford to pay a $375,703 fine and change its practices following an Enforcement Division settlement.
California Privacy Protection Agency Board decision regarding Ford Motor Company — California Privacy Protection Agency
The Board issued a decision requiring a fine and practice changes following an Enforcement Division settlement.
California Attorney General's CCPA settlement with Disney — California Department of Justice, Office of the Attorney General
The Attorney General announced a $2.75 million settlement resolving allegations concerning Disney's handling of consumer opt-out requests.
Meta Platforms (Cambridge Analytica) — California Department of Justice, Office of the Attorney General
The agency reports a stipulated judgment requiring a $50,000,000 payment to resolve allegations concerning Facebook users’ data and representations about privacy protections.
Joint California, Colorado, and Connecticut investigative privacy sweep concerning GPC — California Privacy Protection Agency; Attorneys General of California, Colorado, and Connecticut
The agencies announced an investigative sweep and are contacting businesses regarding potential noncompliance with GPC sale opt-out requests.
CPPA Board enforcement decision concerning Tractor Supply Company — California Privacy Protection Agency
The agency reports that its Board required Tractor Supply Company to pay a $1,350,000 fine and change its business practices to resolve CCPA claims.
Joint California, Colorado, and Connecticut Global Privacy Control investigative sweep — California Privacy Protection Agency and Attorneys General of California, Colorado, and Connecticut
On September 9, 2025, the agencies announced a joint investigative sweep concerning potential noncompliance with GPC opt-out requests.

Agency Guidance

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Regulatory trend: active.

Global Privacy Control / Opt-Out Signals

Currently required

GPC / universal opt-out exposure component: 100/100. This component reflects whether the state currently requires or recognizes universal opt-out preference signals (such as GPC) and related enforcement activity, and is a weighted input to the overall risk guideline. It describes the state's legal posture — never any individual website's behavior.

GPC / universal opt-out privacy rights are a different legal theory from wiretap / interception litigation, though both affect third-party website data flows.

Statute	California Consumer Privacy Act (as amended by CPRA)
Citation	Cal. Civ. Code § 1798.135; Cal. Code Regs. tit. 11, § 7025
Applicability	The government announcement states that the coalition is contacting businesses that may not be processing GPC sale opt-out requests as required by law. It also explains California sale and sharing opt-out rights without providing a complete applicability or exemption analysis.
Opt-out scope	Sale and sharing of personal information; the Connecticut discussion also describes opting out of targeted advertising.
Sale opt-out	Yes
Sharing opt-out	Yes
Targeted advertising opt-out	Yes
Universal opt-out requirement	Yes
Recognized mechanisms	Global Privacy Control

GPC is described as a browser setting or extension and an opt-out preference signal. The excerpt does not provide state-specific effective dates or a complete statutory survey.

GPC evidence confidence: 95%.

Learn more about Global Privacy Control → · How GPC posture is weighted in the risk guideline →

Changes Coming in the Next 24 Months

Forward-looking (24-month) component: 100/100. Enacted changes with future effective dates may affect a jurisdiction's forward-looking risk, but are not presented as currently enforceable.

Next material effective date: January 1, 2027 (~2 months until effective).

Coming Into Effect (Enacted)

Law / Regulation	Effective Date	Time Until	What Changes	Who May Be Affected
California Opt Me Out Act AB 566 · GPC-related	January 1, 2027	~2 months until effective	Requires browser companies to offer a built-in opt-out preference signal for requesting that websites not sell or share personal information.	Browser companies and Californians using desktop or mobile web browsers.
SB 690 California Penal Code section 637.2(d)	January 1, 2027	~2 months until effective	Reserves covered civil actions against private actors alleging Section 638.51 claims arising from website or application conduct to the California Attorney General. The limitation also reaches qualifying claims pending January 1, 2027, in actions commenced during the preceding two years. It does not change Section 638.51's substantive prohibition, and private claims under sections 631 and 632 remain available.	Private plaintiffs and defendants in covered website and application Section 638.51 matters, and the California Attorney General.
California Opt Me Out Act AB 566, Lowenthal · GPC-related	Date not identified	—	Requires browsers to offer opt-out preference signals that automatically communicate privacy preferences to websites.	Browser providers and Californians using web browsers.
California SB 690 SB 690; CIPA Section 638.51	January 1, 2027	~2 months until effective	Section 638.51 enforcement will rest solely with the California Attorney General’s Office for these claims, while the substantive prohibition remains. Private claims under Sections 631 and 632 remain intact. The source describes two-year retroactivity potentially reaching claims filed since the beginning of 2025, with application to pending cases left for courts to address.	Businesses using tracking technologies on websites, online applications, and mobile applications; private claimants pursuing covered Section 638.51 claims; and the California Attorney General’s Office.
SB 690 California Penal Code § 637.2(d)(1)–(2)	January 1, 2027	~2 months until effective	Amends CIPA's civil remedy provision, § 637.2, to eliminate private website- and app-based § 638.51 actions. The limitation covers pending claims in actions filed within two years before January 1, 2027; the alert identifies January 1, 2025, as the start of that window. It does not amend § 638.51's substantive requirements or eliminate other private CIPA claims.	Businesses and other private actors facing website- or app-based § 638.51 claims, private plaintiffs bringing those claims, and the California attorney general.
SB 690 SB 690; California Penal Code section 638.51	January 1, 2027	~2 months until effective	Eliminates private rights of action for the specified section 638.51 claims beginning January 1, 2027, with a two-year lookback. Section 631 wiretapping claims remain unaffected.	Businesses facing website or app-based section 638.51 claims, private claimants pursuing those claims, and the California Attorney General.
Senate Bill 690 (amending CIPA Section 638.51) SB 690 (2026)	January 1, 2027	~2 months until effective	Removes private right of action for Section 638.51; authorizes only the California Attorney General to bring Section 638.51 claims against private actors; amendment takes effect January 1, 2027 and applies retroactively to pending claims in actions filed within two years before that date (i.e., filed on or after January 1, 2025).	Entities previously subject to private suits under Section 638.51, including businesses using third‑party advertising or analytics tools that plaintiffs had alleged captured IP addresses or metadata.
SB 690 Senate Bill No. 690 (2025–26 Reg. Sess.)	January 1, 2027	~2 months until effective	Adds subdivision (d) to section 637.2 restricting private-party actions for section 638.51 pen register/trap-and-trace violations that arise from websites or apps to actions brought by the Attorney General; leaves section 631 (wiretap) and section 638.51 criminal/AG civil enforcement unchanged; includes a retroactivity clause applying to pending claims in actions commenced within two years before the operative date.	Private plaintiffs who have brought or considered bringing pen register/trap-and-trace claims arising from websites or apps, website and app operators, and the California Attorney General
Senate Bill 690 (SB 690) Amends Cal. Penal Code §637.2 regarding private right of action for §638.51 · GPC-related	Date not identified	—	Limits private enforcement of §638.51 for website/app conduct to the California Attorney General and provides a retroactivity defense for certain pending claims.	Businesses operating websites, online applications, or mobile applications; plaintiffs who had asserted §638.51 private claims; litigation counsel handling CIPA-related matters.
SB 690 (Caballero) / Chapter 976, Statutes of 2026 Cal. Penal Code § 637.2(d), Stats. 2026, ch. 976 (enrolled Aug. 31, 2026; signed Sept. 30, 2026)	January 1, 2027	~2 months until effective	Rewrites Cal. Penal Code § 637.2 to add subdivision (d) limiting private-actor § 638.51 claims arising from websites/apps to be brought only by the Attorney General; threads the carve-out through the damages and injunction provisions and renumbers an existing savings clause.	Private plaintiffs who might bring § 638.51 actions based on website/app conduct, businesses operating websites/apps, and the California Attorney General's office.

Legislation to Watch (Pending)

Pending bills are not law and may never take effect; they are listed separately from enacted changes.

California Senate Bill 690 · PENDING LEGISLATION
The September excerpt reports that SB 690 passed both legislative chambers and was sent to the governor for signature; it does not establish enactment.
SB 690 · PENDING LEGISLATION
As of the article’s publication, SB 690 had passed the Legislature and awaited gubernatorial action. The article identifies January 1, 2027 as its conditional operative date.
SB 690 · PENDING LEGISLATION
The source reports legislative passage on August 28, 2026, with gubernatorial action still pending as of publication. It describes a prospective January 1, 2027 operative date if the bill becomes law.
Senate Bill 690 amending the California Invasion of Privacy Act · PENDING LEGISLATION
The source reports that Governor Gavin Newsom signed SB 690 on September 30, 2026. It does not specify the law's effective or operative date, so its current effectiveness cannot be determined from the text.
SB 690 · PENDING LEGISLATION
The article reports legislative passage but no gubernatorial signature.
Assembly Bill 1542 · PENDING LEGISLATION
The source reports legislative passage alongside SB 690 but does not report a gubernatorial signature.
Senate Bill 923 · PENDING LEGISLATION
The source reports legislative passage alongside SB 690 but does not report a gubernatorial signature.
Senate Bill 690 (SB 690) · PENDING LEGISLATION
The article reports that SB 690, after being narrowed, would eliminate the private right of action under Penal Code § 638.51 for pen register claims arising from website, app, or mobile conduct and shift enforcement to the Attorney General, with retroactivity reaching pending claims filed within two years of the bill's operative date; the bill leaves §§ 631 and 632 untouched.
SB 690 · PENDING LEGISLATION
State bill text is referenced for comparison with CIPA; the page suggests readers compare SB 690 and the HAIL Act but does not provide enactment details on the page.
A.B. 1542 (Sensitive Data Sale Prohibition) · PENDING LEGISLATION
A companion bill that would prohibit the sale or sharing of certain categories of sensitive personal information, including precise geolocation and biometric data.

Important Cases & Tracked Matters

In the Matter of: FORD MOTOR COMPANY

Court not identified · 2026-02-27 · tracked matter · Outcome: Mixed · Status: SETTLED · Appeal: unknown

What the court decided: The Agency Board adopted a stipulated final order requiring Ford to pay a $375,703 administrative fine and undertake specified compliance measures, including an audit of Ford.com tracking technologies for opt-out preference signals. The order provides a release of specified Agency CCPA claims following Ford's compliance with the stated terms.

Variety Media LLC v. Superior Court

California Court of Appeal · 2026-08-21 · lawsuit · Outcome: Pending · Status: LITIGATION PENDING · Appeal: on appeal

What the court decided: The article reports a tentative ruling rejecting a telephone-only interpretation of section 638.51 but rejecting the plaintiff’s specific IP-address theory because an IP address identifies the communication’s source rather than its destination. The excerpt does not establish a final holding.

What the court did not decide: The court had not finally resolved the Section 638.51 interpretation or mootness questions. Its tentative ruling rejected a telephone-only interpretation of pen register but tentatively found the plaintiff's IP-address theory insufficient; that ruling was neither final nor precedential.

Ortega, et al., v. Emanate Health Medical Center

Superior Court of the State of California, County of Los Angeles · lawsuit · Outcome: Pending · Status: LITIGATION PENDING · Appeal: unknown

The FAQ describes a proposed $777,000 settlement in Ortega, et al., v. Emanate Health Medical Center concerning an alleged “Pixel Disclosure” and California privacy claims. Emanate denies the allegations, and the notice describes final court approval as still pending rather than reporting a merits determination.

What the court did not decide: The notice states that the court did not decide in favor of either plaintiffs or defendant.

Popa v. Microsoft Corp.

U.S. Court of Appeals for the Ninth Circuit · 2025-08-26 · lawsuit · Outcome: Defense-favorable · Status: DECIDED · Appeal: unknown

What the court decided: The article reports that the Ninth Circuit held generalized allegations of web-tracking injury insufficient for constitutional standing and describes Popa as largely governing standing disputes in California federal courts.

What the court did not decide: The excerpt does not establish a merits ruling on the underlying privacy claims.

In the Matter of 2080 Media, Inc., d/b/a PlayOn Sports

Court not identified · 2026-02-27 · tracked matter · Outcome: Neutral · Status: DECIDED · Appeal: unknown

What the court decided: The Agency Board adopted a stipulated final order requiring PlayOn to pay a $1.1 million administrative fine and implement specified compliance measures. The order also credits PlayOn’s remediation efforts.

In the Matter of Tractor Supply Company

Court not identified · 2025-09-26 · tracked matter · Outcome: Unknown · Status: SETTLED · Appeal: unknown

What the court decided: The California Privacy Protection Agency Board adopted the stipulated final order as its decision, effective immediately. The excerpt does not disclose substantive settlement obligations or penalties.

D'Antonio et al v. Smith & Wesson Inc.

N.D. Cal. · 2026-09-08 · lawsuit · Outcome: Plaintiff-favorable · Status: LITIGATION PENDING · Appeal: unknown

What the court decided: According to the article, the court denied the motion to dismiss because the amended complaint provided sufficient detail at the pleading stage. Precise technical details about tracking and interception were not required before factual development.

What the court did not decide: The court did not determine on a complete factual record whether the cookies tracked information within the pen register statute or resolve factual questions concerning the processing platform and actual interception.

Brittanee Jackson, et al. v. Yardi Systems, Inc., et al.

Superior Court of California, County of Santa Barbara · lawsuit · Outcome: Plaintiff-favorable · Status: LITIGATION PENDING · Appeal: unknown

What the court decided: The tentative ruling overrules Yardi Systems, Inc. and RentCafe, LLC's demurrer to the complaint and directs them to answer by October 9, 2026. The excerpt does not establish that the tentative ruling became a final order.

What the court did not decide: The excerpt does not establish liability, class certification, or a final merits disposition. It does not provide the court's reasoning for overruling the demurrer.

The People of the State of California v. Healthline Media, LLC

Superior Court of the State of California for the City and County of San Francisco · lawsuit · Outcome: Unknown · Status: UNKNOWN · Appeal: unknown

The People of the State of California filed a complaint against Healthline Media, LLC in San Francisco Superior Court on July 1, 2025, seeking an injunction, civil penalties, and other equitable relief. The complaint alleges deficiencies in Healthline.com's advertising-tracker opt-outs, contractual privacy protections, and disclosures of health-related article titles; the excerpt contains no judicial ruling or subsequent case disposition.

Barrales et al v. Reckitt Benckiser LLC

U.S. District Court for the Northern District of California, San Jose Division · 2026-07-31 · lawsuit · Outcome: Mixed · Status: LITIGATION PENDING · Appeal: unknown

What the court decided: The court granted in part and denied in part Reckitt's motion to dismiss, with leave to amend. The excerpt does not identify which claims or grounds received each disposition.

What the court did not decide: The excerpt does not provide claim-specific rulings or the court's substantive reasoning and does not establish liability.

Lutge v. Timex.com, Inc.

United States District Court for the Northern District of California · 2026-09-14 · lawsuit · Outcome: Procedural only · Status: DISMISSED PROCEDURALLY · Appeal: unknown

What the court decided: The alleged collection of nonsensitive shopping information did not establish concrete injury sufficient for Article III standing.

What the court did not decide: The court did not reach transfer or the merits.

Tanner v. FCA US LLC

United States District Court for the Eastern District of California · 2026-09-16 · lawsuit · Outcome: Mixed · Status: LITIGATION PENDING · Appeal: unknown

What the court decided: Sensitive checkout-data allegations supported Article III standing and survival of ECPA, CIPA § 631(a), and constitutional privacy claims; other claims were dismissed. ([docs.justia.com](https://docs.justia.com/cases/federal/district-courts/california/caedce/2%3A2026cv01475/486758/22))

What the court did not decide: The order did not determine ultimate liability, damages, or class certification. ([docs.justia.com](https://docs.justia.com/cases/federal/district-courts/california/caedce/2%3A2026cv01475/486758/22))

Technologies Appearing in Claims

cookies
web beacons
pixels
Global Privacy Control
chatbots
session-replay
website tracking
IP address collection
analytics tools
trackers
third-party data brokers
chat services
fraud tools
SDKs
analytics tags
session replay
third-party pixels
chat transcripts
form-field tracking
tag manager histories
beacons
software development kits (SDKs)
web analytics
IP addresses
session-replay tools

Historical Risk Guideline

Date	Risk Guideline	Level	Confidence	Tracked Lawsuits
October 13, 2026	98	Very High	96%	35
October 13, 2026	98	Very High	96%	35
October 13, 2026	98	Very High	96%	35
October 13, 2026	98	Very High	96%	36
October 13, 2026	98	Very High	96%	36
October 13, 2026	98	Very High	96%	36
October 13, 2026	98	Very High	96%	36
October 13, 2026	98	Very High	96%	36
October 13, 2026	98	Very High	96%	36
October 13, 2026	98	Very High	96%	36
October 13, 2026	98	Very High	96%	36
October 13, 2026	98	Very High	96%	36

What Businesses Should Review

Review tracking inventories and actual data flows, including pixels, SDKs, analytics, session replay, chat services, form fields, transcripts, and IP addresses. Compare implementation with disclosures, consent timing, preference-management settings, and opt-out signal handling, including Global Privacy Control where required. Review vendor configurations, contractual privacy protections, and tag-manager histories. Legal review should distinguish the asserted statute, federal standing, procedural posture, and the reported scope and effective date of SB 690 rather than treating all website-tracking claims alike.

Data Quality

195

Primary Sources

520

Total Tracked Sources

fresh

Evidence Freshness

October 10, 2026

Last Research Run

October 13, 2026

Most Recent Source

520 source(s), 195 primary; evidence is fresh.

Methodology & Limitations

Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.

The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.

Sources

Doe v. Cedars-Sinai Health System — U.S. Court of Appeals for the Ninth Circuit · Tier A (Primary authority)
Frequently Asked Questions | Global Privacy Control — Global Privacy Control · Tier E (General web)
Litigation Updates — Privacy Litigation Report: Takeaways From August 2026 Decisions — Troutman Pepper Locke — Privacy + Cyber + AI · Tier C (Professional analysis)
Utah sues Hims & Hers for charging consumers without consent and sharing private health data — Utah Attorney General · Tier A (Primary authority)
Nation’s Largest Rural Lifestyle Retailer to Pay $1.35M Over CCPA Violations — California Privacy Protection Agency · Tier A (Primary authority)
California Governor Signs SB 690, Curtailing CIPA Pen-Register Litigation — Procopio · Tier C (Professional analysis)
Attorney General Bonta Announces Largest CCPA Settlement to Date, Secures $1.55 Million from Healthline.com — California Department of Justice, Office of the Attorney General · Tier A (Primary authority)
CIPA Update: SB 690 Is Law and Variety Media May Be Its First Casualty — Jones Walker LLP · Tier C (Professional analysis)
Frequently Asked Questions — Ortega, et al., v. Emanate Health Medical Center — Emanate Health Privacy Settlement Administrator · Tier E (General web)
CIPA Tech Tracking Suits Highlight Uncertain Legal Ground — Law360 · Tier B (Authoritative secondary)
Ford Motor Company — Stipulated Final Order — California Privacy Protection Agency · Tier A (Primary authority)
Privacy Enforcement Actions — Including Healthline Media LLC Website Tracking Settlement — California Department of Justice, Office of the Attorney General · Tier A (Primary authority)
Enable OOPS — California Privacy Protection Agency · Tier A (Primary authority)
Federal Wiretap Act claim against Blue Shield dismissed by US federal judge — MLex · Tier B (Authoritative secondary)
CONSUMER ALERT: Attorney General Ken Paxton Warns Texans of Scam Demand Letters Alleging Website Privacy Violations — Texas Office of the Attorney General · Tier A (Primary authority)
Law & Regulations — Opt-out Preference Signals and Reducing Friction in the Exercise of Privacy Rights — California Privacy Protection Agency · Tier A (Primary authority)
Swarts v. Home Depot — Order Granting Motion to Dismiss — U.S. District Court for the Northern District of California (via GovInfo) · Tier A (Primary authority)
Nation's Largest Rural Lifestyle Retailer to Pay $1.35M Over CCPA Violations — California Privacy Protection Agency · Tier A (Primary authority)
Dividing Lines Emerge in CIPA Rulings As California Reforms the Law — Cybersecurity and AI Law Report · Tier B (Authoritative secondary)
In the Matter of 2080 Media, Inc., d/b/a PlayOn Sports: Order of Decision and Stipulated Final Order — California Privacy Protection Agency · Tier A (Primary authority)
Osheske v. Silver Cinemas Acquisition Co. — U.S. Court of Appeals for the Ninth Circuit · Tier A (Primary authority)
CCPA Enforcement Case Examples — California Department of Justice, Office of the Attorney General · Tier A (Primary authority)
AMENDED ORDER GRANTING IN PART MOTION TO DISMISS — Justia · Tier A (Primary authority)
Press & Announcements | Global Privacy Control — Global Privacy Control · Tier E (General web)
Calif. Appeals Court Signals Wiretap Law Applies To Trackers — Law360 · Tier B (Authoritative secondary)

All State Pages

Is Your Website Creating Hidden Tracking Risk?

Scan your site for third-party tracking and potential wiretap exposure. Free, no account required.

Scan My Website