California SB 690 narrows tracking lawsuits: what Shopify merchants should check

California has signed a targeted reform of website-tracking litigation that matters to Shopify merchants using advertising and analytics pixels. Governor Gavin Newsom approved SB 690 on 30 September 2026.

The change limits who can bring one particular type of privacy claim. It does not give stores blanket permission to run tracking technologies or remove the need to review their consent setup.

Which claims does SB 690 change?

The law amends Penal Code section 637.2. Actions against private actors under section 638.51, arising from conduct on websites, online applications or mobile applications, become enforceable through that provision only by California’s Attorney General.

Section 638.51 concerns pen registers and trap-and-trace devices. In website litigation, those concepts have been applied to technologies collecting routing or signalling information. Law firm Kilpatrick’s analysis stresses that other CIPA claims, including those under sections 631 and 632, remain available.

The reform follows the ordinary 1 January 2027 statutory effective-date timetable. Its text also applies the amendment retroactively to pending claims in actions started within the two years before its operative date. Merchants with an existing demand or lawsuit should have their privacy counsel check the specific claim and procedural position; signing does not itself dispose of an individual case.

Why merchants are paying attention

Sean Frank highlighted the issue in an X post on 1 October, discussing Meta pixels and sharing Ecommerce Innovation Alliance material. His post is industry reaction, rather than the legal test for whether a particular store is compliant.

Sean Frank on California pixel litigation — 1 October 2026

Read Sean Frank’s original post on X.

Check how your Shopify pixels obtain consent

A useful operational response is to document how each advertising, analytics and session-replay tool is installed. Distinguish Shopify Pixels from scripts added manually to a theme or through another integration.

Shopify’s privacy documentation says its cookie banner governs Shopify-specific tools, including Shopify Pixels. Third-party cookies or pixels installed manually or through apps may need a third-party banner or custom logic to respect consent. That is more precise than assuming the native banner either covers every tracker or blocks none of them.

Ask whoever maintains your tracking setup to record each tool’s purpose, consent integration and behaviour when a visitor declines tracking. Review that record with your privacy adviser before changing collection settings. SB 690 is a reason to reassess a specific litigation exposure, not a reason to switch consent controls off.

For a related advertising workflow, see our coverage of ChatGPT Ads and Shopify consent. Treat each platform’s measurement setup as a separate implementation to verify.

This article reports the legislation and platform documentation; it is not advice on an individual legal claim.