California Is About to Kill a Pixel-Lawsuit Theory. The Lawsuits Won't Stop.
A bill on the governor's desk ends one of the biggest tracking-pixel theories this month, and a Supreme Court argument two weeks later reshapes another. Neither shrinks the wave. Both redirect it, into the theories that survive and the states that welcome them.
A tracking pixel is a speck of code, an invisible tag that fires when a page loads and quietly reports what a visitor did back to Meta, Google, TikTok, or a data broker. Almost every commercial website runs one.
Over four years, plaintiffs turned that ubiquity into one of the largest class-action campaigns in the country, and they did it without a single statute written for the internet, reaching instead for a 1980s video-rental law, telephone wiretap statutes, and pen-register rules meant to stop police from logging phone numbers.
This month, for the first time, one of those borrowed theories is being taken away. California's Legislature has passed a bill that would end private pixel suits under its pen-register provision, and the governor must decide whether to sign it by September 30.
The natural read is that pixel litigation is about to shrink. It is the wrong read. The bill leaves the larger wiretap theory untouched, a Supreme Court case argued two weeks later could widen a third theory, and a newer breed of state health-privacy law is opening doors the California bill cannot close.
What is happening is not a contraction. It is a redistribution, and knowing where the cases flow next is worth more than knowing which one just closed.
The shape of the wave, by the numbers
The scale explains why the redirection matters. Rain's tracking counts more than 1,160 pixel and website-tracking suits filed since 2023, and the curve is still bending upward, roughly 66 filings in 2023, 244 in 2024, 361 in 2025, and 480 in just the first nine months of 2026, already past last year's full-year total.
Around 300 pre-suit investigations sit behind those filings. Crucially, the docket is not one theory but four, and, because a single complaint often pleads several at once, they are very differently exposed to what is coming:
CIPA wiretap (Penal Code §631): roughly 610 filings, the single largest bucket, and the one the California bill does not touch.
Trap-and-trace / pen register (§638.51): roughly 340 filings, nearly a third of the docket, and precisely what the bill removes from private hands.
Health and tax data tracking: roughly 230 filings, the highest-stakes lane, increasingly powered by state statutes rather than California's.
VPPA video pixel: roughly 160 filings, whose reach the Supreme Court is about to define.
The suits are overwhelmingly filed in California, and a small group of firms drives them, Bursor & Fisher and Tauler Smith each with well over a hundred filings.
Defendants, by contrast, are scattered across technology, healthcare, media, retail, financial services, and hospitality: essentially anyone running an ordinary advertising and analytics stack.
What SB 690 kills, and what it deliberately spares
SB 690 is the immediate event. Passed unanimously on August 28, 2026, and awaiting the governor's signature by September 30, it would end private lawsuits under CIPA's pen-register and trap-and-trace provision when the claim arises from a website or app, leaving only the Attorney General to sue.
It takes effect January 1, 2027, and, unusually, applies retroactively to cases filed on or after January 1, 2025, meaning it could sweep away a large share of the roughly 340 pending pen-register cases at a stroke.
That sounds like a body blow, and for one theory it is. But read what the bill leaves alone. It does not touch §631, CIPA's traditional wiretapping provision, which is behind the largest slice of the docket and, as discussed below, the newest AI-driven claims.
An Attorney General is not going to file pen-register suits at anything approaching the plaintiffs' bar's volume, so those cases do not simply vanish, the lawyers behind them re-plead.
The practical effect of SB 690 is less an off-switch than a funnel: it pushes the most vulnerable theory's energy into the wiretap theory, the VPPA, and other states. Defense counsel treating the bill as the end of pixel exposure are misreading it.
The wiretap theory absorbs the overflow, and it is splitting
Section 631 becomes the center of gravity by default, and it is genuinely contested. Two questions divide the courts.
The first is the “party exception”: a participant in a conversation cannot wiretap it, so is the website a party, and is a vendor like Meta an eavesdropper or just another party?
The Third Circuit, applying Pennsylvania's wiretap law in Popa v. Harriet Carter Gifts, refused to let the vendor claim the exception, a reading that helps plaintiffs.
The second is timing: several courts have dismissed claims because a pixel or session-replay tool reads data only after it is stored and reassembled, not “in transit,” defeating the real-time interception the statute demands, and Massachusetts's highest court held in Vita v. New England Baptist Hospital that its 1968 wiretap law reached recorded conversations, not website browsing.
The same pixel can be an unlawful wiretap in one forum and lawful analytics in the next, which is exactly why the theory can absorb displaced pen-register cases: there is enough favorable law to keep filing.
The frontier: chatbots and AI that allegedly eavesdrop
The most important thing about §631 surviving is where it is heading. The fastest-growing corner of this litigation is no longer the classic ad pixel but the chat window and the AI assistant.
Chatbot wiretapping matters under CIPA grew from two in 2021 to about thirty in 2025, and the theory is a close cousin of the pixel claim: when a company embeds a third-party chat vendor, such as Salesforce, LivePerson, or Zendesk, or an AI customer-service tool that transcribes and analyzes conversations in real time, plaintiffs allege the vendor is a third party unlawfully intercepting the chat.
Session-replay tools that record keystrokes and mouse movements, like the software at issue in a suit against Papa John's, are pleaded the same way.
Courts are already dividing here too, and along the same lines.
A California federal court in Valenzuela v. Nationwide let §631 claims proceed and allowed an aiding-and-abetting theory against the company that deployed the third-party interception tool, while other courts, including in a January 2026 decision favoring an AI vendor, have thrown such claims out.
Because SB 690 leaves §631 alone, this AI-eavesdropping front is untouched by the reform and positioned to grow, and it is where the wiretap theory most obviously collides with the broader wave of AI litigation.
For companies deploying conversational AI, the exposure is not hypothetical; it is the next chapter of a campaign already running at scale.
The Supreme Court takes the video pixel
The second reckoning is federal. On October 14, 2026, the Supreme Court hears Salazar v. Paramount Global, where a plaintiff who subscribed to a newsletter on a Paramount sports site, watched videos there, and allegedly had his viewing disclosed to Meta says the site violated the Video Privacy Protection Act.
The question is narrow but decisive: is a protected “consumer” only someone who subscribes to audiovisual goods or services, or does subscribing to anything qualify? The circuits are split, the Second and Seventh reading it broadly, the Sixth narrowly.
A narrow ruling would gut a large share of the roughly 160 video-pixel cases; a broad one would supercharge them. Either way, the decision, expected in 2027, redraws the boundary of the one federal theory in the mix.
Healthcare, where the money and the regulators are
No sector has paid more than healthcare, where pixels on hospital sites and patient portals allegedly sent protected health information to Meta. The HHS Office for Civil Rights lit the fuse with a 2022 HIPAA bulletin, and the FTC and OCR jointly warned about 130 providers.
Hospitals won part of the fight, American Hospital Association v. Becerra vacated the most aggressive piece, that an IP address plus a visit to an unauthenticated page is protected health information, but left the rest standing, so authenticated portals remain exposed.
More than 200 provider suits followed, consolidated in part as In re Meta Pixel Healthcare Litigation, with settlements into nine figures collectively, including roughly $12.2 million from Advocate Aurora Health over disclosures affecting about three million patients and $1.8 million from Atrium Health.
In parallel, the FTC used the Health Breach Notification Rule to extract a $1.5 million penalty from GoodRx, its first under that rule, and $7.8 million from BetterHelp.
The other door, opening as California's closes
The most consequential place the health cases are migrating is not a courtroom but a statute.
Washington's My Health My Data Act protects “consumer health data” far beyond HIPAA's limits and, unlike almost every other state privacy law, carries a private right of action, treble damages up to $25,000 and attorney's fees through the state consumer-protection act.
It is already producing pixel and SDK suits, including against Amazon's advertising SDKs and a cannabis retailer's website trackers, and other states are drafting their own versions. The pattern is the mirror image of SB 690: California narrows a private right of action while Washington and its imitators create new ones.
For the plaintiffs' bar, a closing door in one state is a map to the open ones.
The sequence, and what to watch
2022 The OCR HIPAA bulletin and the first VPPA and CIPA pixel filings begin the wave.
Jun 2024 AHA v. Becerra vacates the most aggressive HIPAA tracking guidance; authenticated-portal exposure survives.
2024–2025 Pen-register filings surge in California; Washington's My Health My Data Act takes effect with a private right of action; chatbot claims climb toward thirty a year.
Jan 2026 The Supreme Court grants review in Salazar v. Paramount.
Aug 28, 2026 California's Legislature passes SB 690.
Sep 30, 2026 Deadline for the governor to sign or veto SB 690.
Oct 14, 2026 The Supreme Court hears argument in Salazar.
For four years the pixel wave moved in one direction, up, as a handful of firms filed the same theories against a widening set of defendants. This fall it starts moving sideways.
The pen-register theory is being legislated out of private hands, and its cases will resurface as wiretap claims.
The wiretap theory is fracturing across courts even as it expands into chatbots and AI. The video theory is at the Supreme Court.
The health-data theory is migrating from HIPAA and California into state statutes purpose-built with private rights of action. The pixel itself has not changed.
What is changing is the map of which law can reach it, and the useful question for any company running ordinary tracking is no longer whether it will be sued under the theory that just closed, but under the three that did not.
Does California's SB 690 end tracking-pixel lawsuits?
No, and as of late September 2026 it is not yet law, it passed the legislature on August 28 and awaits Governor Newsom's decision by September 30.
If enacted, SB 690 would remove the private right of action only for CIPA "pen register / trap-and-trace" claims (§638.51) arising from websites and apps, leaving the Attorney General as the enforcer, with an operative date of January 1, 2027 and retroactive effect to claims filed on or after January 1, 2025.
It would leave CIPA's wiretap provision (§631), the VPPA, and state health-data laws untouched, so pixel litigation is expected to shift into those theories rather than stop.
See the cases change lanes before one reaches yours.
This wave does not crest, it reroutes: pen register into wiretap, HIPAA into state health-data laws, ad tags into chatbots and AI.
Rain's trend reports show every filing sorted by theory, statute, jurisdiction, and the firms working each lane, so the next turn is visible before it lands on your industry.
Open the pixel-tracking report to see where the cases are moving now, or take 30 minutes with us and we will map your exposure, or your target list, to the theories still standing after this month.