Two developments in three weeks have changed the shape of litigation over website tracking technologies. On September 30, 2026, California enacted SB 690, which ends private lawsuits under the “pen register” provision of the California Invasion of Privacy Act (“CIPA”) for conduct on websites and applications, effective January 1, 2027.[1] On October 14, 2026, the Supreme Court of the United States heard argument in Salazar v. Paramount Global, which asks who is a “consumer” entitled to sue under the Video Privacy Protection Act (“VPPA”) when a website shares video-viewing information with Meta through a tracking pixel.[2] One door is closing and another may open. In this Legal Update, we summarize both developments, explain why the litigation will migrate rather than end, and identify the exposure of companies operating in Puerto Rico.
SB 690
CIPA’s pen register and trap-and-trace provision, Penal Code section 638.51, was written for telephone call records. Over the past several years plaintiffs applied it to cookies, pixels, analytics tools and chat widgets, on the theory that software recording a visitor’s IP address or referral URL is a pen register, and thousands of suits and demand letters followed. SB 690 adds a subdivision to section 637.2, CIPA’s civil-remedy provision, so that an action against a private actor for a website or app violation of section 638.51 may be brought only by the California Attorney General. The amendment also reaches pending claims in actions commenced on or after January 1, 2025, so pen register counts in cases already on file will fall away. It does not touch CIPA’s wiretapping and eavesdropping provisions, sections 631 and 632, which remain privately enforceable with statutory damages, and it does not affect claims under the federal Wiretap Act, the VPPA, or the wiretap statutes of other all-party-consent states. The predictable result is a shift in theory, from “the pixel is a pen register” to “the pixel intercepted the contents of my communications,” and a shift in forum.
Salazar v. Paramount Global
The VPPA, enacted in 1988 after a newspaper published Judge Robert Bork’s video rental history, prohibits a “video tape service provider” from knowingly disclosing personally identifiable information about a “consumer,” and provides liquidated damages of $2,500 per violation.[3] Michael Salazar subscribed to a free newsletter from 247Sports.com, a Paramount website, watched videos on the site while logged into Facebook, and alleged that the Meta pixel sent the video titles and his Facebook ID to Meta. The Sixth Circuit held that a newsletter subscriber is not a “consumer” because he did not subscribe to audiovisual goods or services; the Second and Seventh Circuits read the term more broadly, and the D.C. Circuit has sided with the Sixth.[4] At argument on October 14, several Justices appeared receptive to the broader reading, while others pressed the plaintiff on whether it would expose every business with video on its website to class actions. A decision is expected by the end of the Court’s term in June 2027. If the broad reading prevails, any company whose website carries video and a pixel, and whose visitors have signed up for anything, is a potential defendant.
Puerto Rico
California applies CIPA to any website a California resident uses, so companies outside California, Puerto Rico included, have been receiving CIPA demand letters for years. SB 690 removes one of the two theories used against them and leaves the other, the wiretap claim under section 631, in place. Companies with no California visitors never had CIPA exposure. For all of them, the exposure that matters is closer to home, on three fronts.
First, the VPPA already reaches further in Puerto Rico’s home circuit than in most. In Yershov v. Gannett Satellite Information Network, Inc. (1st Cir. 2016), the First Circuit, which hears appeals from the District of Puerto Rico, held that a user of a free mobile application who provided a device identifier and location data was a “subscriber” under the VPPA; no payment is required.[5] What Salazar will decide is whether signing up for something other than video, such as a newsletter, is enough. A Puerto Rico company whose website or app delivers video to users who have provided personal information is within the statute today. If the Court adopts the broad reading, any sign-up will do.
Second, Puerto Rico has no CIPA, but it has something California does not: a constitutional right to privacy in Article II, Section 8 of the Constitution of Puerto Rico that is self-executing and runs against private parties, and an express constitutional prohibition on the interception of telephone communications in Article II, Section 10.[6] We have identified no reported decision applying either provision to website tracking. A plaintiff who did so would seek damages under Article 1536 of the Civil Code and injunctive relief, without statutory damages, which makes the claim less attractive to class counsel than the VPPA but available in every Puerto Rico court.[7]
Third, Puerto Rico regulates what a company says about tracking. Ley Núm. 39-2012 requires operators of commercial websites that collect personal information from Puerto Rico residents to post a privacy policy and provides fines of up to $50,000 for misleading policies, and Section 5 of the FTC Act reaches the same conduct as a deceptive practice.[8] A privacy policy that does not disclose the pixels, session-replay tools and chatbots actually running on the site is the most common exposure, and the most avoidable.
Practical Implications for Companies
We will continue to monitor developments and will provide further updates as warranted. If you have questions about the matters discussed in this Legal Update, please contact the Maceira Zayas lawyers with whom you regularly work.
Endnotes
This publication provides general information on legal developments of interest to clients and friends of Maceira Zayas. It is not a comprehensive treatment of the subject matter and does not constitute legal advice. Readers should consult counsel before acting on any matter discussed here. Developments after the date of this Legal Update are not reflected.
