A California Solar Company Got Sued for $35,000 Over Its Website — Relief Comes Sept. 30

Gytahnna Loffgren runs a family solar panel installation company in California. She had never been sued before. Then a letter arrived accusing her business of violating a 1967 wiretapping law — over her own website's chat widget and analytics tools. The demand: $35,000.

"We were completely blindsided," Loffgren said. "I've never been sued before... you instantly feel like you've done something terribly wrong."

She isn't alone. Over the past four years, more than 4,000 similar claims have been filed against California businesses, with thousands more demand letters sent to owners who had no idea their websites could trigger a lawsuit. Now, a bill sitting on Governor Gavin Newsom's desk could shut most of this down — but he only has until September 30, 2026, to sign it.

How a 1967 Wiretapping Law Became a Small Business Nightmare

The law at the center of this wave of litigation is the California Invasion of Privacy Act (CIPA), originally written to address phone tapping. Plaintiffs' attorneys discovered that its "pen register" and "trap-and-trace" provisions — rules meant to govern who could intercept and log call data — could be applied to ordinary website technology like cookies, tracking pixels, and analytics tools that log a visitor's IP address and device information.

The catch that makes CIPA so dangerous for small business owners: it doesn't matter whether the data collected was sensitive, or whether the business meant any harm. The law currently allows anyone injured by a violation to seek the greater of $5,000 per violation or three times their actual damages. With multiple "violations" potentially found on a single site — one for each tracking tool, sometimes for each visitor session — those numbers can add up fast.

Small businesses using ordinary tools like Google Analytics or Meta Pixel to understand their website traffic have found themselves targeted right alongside major corporations. The Los Angeles Times reportedly settled a similar claim for $3.85 million, and Meta itself faces potential damages of up to $8 billion in a related case — but it's owners like Loffgren, running businesses with a handful of employees, who often have the least ability to fight back or absorb a settlement.

What SB 690 Actually Changes

SB 690, authored by state Senator Anna Caballero (D-Merced), narrows CIPA's civil-remedies provision so that only the California Attorney General — not private plaintiffs' attorneys — can enforce the pen register and trap-and-trace sections against privately operated websites and apps. That single change targets the exact legal theory driving the bulk of these lawsuits against small businesses.

Both the Assembly and Senate passed the amended bill on August 28, 2026. A spokesperson for Caballero's office described it as reflecting "where we could come to a consensus" after earlier, broader versions of the bill failed to gain enough support.

Here's what business owners need to know about the timeline:

• Now through September 30, 2026: The bill sits on Governor Newsom's desk. He can sign it, veto it, or let it become law without his signature.
• If signed, effective January 1, 2027: The law would become operative at the start of next year.
• Retroactive reach: The bill is written to apply to pending claims in lawsuits filed within the two years before its operative date — meaning cases filed on or after roughly January 1, 2025 could be affected. Legal experts caution this retroactivity provision could itself be challenged in court, and trial courts may not apply it consistently right away.

What This Doesn't Fix

Business owners should be careful not to assume SB 690 makes CIPA risk disappear entirely. The bill only narrows one specific provision of the law — the pen register and trap-and-trace sections. The rest of CIPA, including its wiretapping provisions under Section 631, remains fully in force. Attorneys who track this litigation expect plaintiffs to keep filing claims under those remaining sections, meaning the wave of website-tracking lawsuits is likely to continue in a different form even if SB 690 becomes law.

In other words: this is meaningful relief for one specific legal theory, not a blanket shield. Businesses that already updated their privacy practices in response to CIPA scrutiny should keep those practices in place.

What Small Business Owners Should Do Now

Whether or not Newsom signs SB 690, the underlying exposure that created this wave of lawsuits — third-party scripts collecting visitor data without clear disclosure — isn't going away on its own. A few concrete steps can reduce risk regardless of how the bill turns out:

Audit what's actually running on your website

Many business owners don't know exactly which tracking scripts, chat widgets, or analytics tags are active on their site, especially if a web developer or marketing agency set things up years ago. A basic audit — checking for chat plugins, ad pixels, session-recording tools, and analytics platforms — is the first step toward understanding your exposure.

Update your privacy policy and consent notices

Clear, accurate disclosure about what data your website collects and how it's used remains one of the strongest defenses against these claims, regardless of what happens with SB 690.

Talk to your insurance broker

Because litigation like this can arrive with no warning — as it did for Loffgren — many owners are finding out the hard way whether their existing coverage applies. Reviewing your business insurance policy for cyber liability or general liability coverage that could respond to a privacy claim is worth doing before a demand letter shows up, not after.

Consider your business structure

Lawsuits like this are also a reminder of why choosing the right legal structure matters. Owners operating as sole proprietors carry personal liability exposure that an LLC or corporation can help shield against. If you haven't formalized your business entity, reviewing the basics of LLC formation is a reasonable place to start.

The Bigger Picture

What makes this story resonate beyond California is the pattern it reveals: a law never intended to regulate websites became a source of real financial risk for ordinary business owners simply because they used common, everyday tools to run their operations. Whether Newsom signs SB 690 by the September 30 deadline will determine how much relief is on the way — but the underlying lesson for every small business owner, in California or elsewhere, is the same. The tools running quietly in the background of your website are not risk-free, and it pays to know what they're doing before someone else tells you in a demand letter.

Photo by Towfiqu barbhuiya on Unsplash