Crimes: invasion of privacy.

Plain English Breakdown

The official source material does not provide specific details on how businesses will determine if a commercial business purpose exists.

Privacy Rules for Business

The bill changes privacy laws by allowing businesses to intercept communications for certain business purposes and clarifies the use of pen registers and trap and trace devices without breaking the law.

What This Bill Does

• Allows businesses to intercept communications if it is for a commercial business purpose, such as processing personal information.
• Defines 'commercial business purpose' as when a company uses personal data to further its business or follows rules that allow customers to opt-out of certain practices.
• Specifies that pen registers and trap and trace devices do not include processes used in a manner consistent with a commercial business purpose.

Who It Names or Affects

• Businesses that process personal information
• People whose personal information is processed by businesses

Terms To Know

Pen Register

A device or method used to record phone numbers dialed from a specific phone line, but not the content of calls.

Trap and Trace Device

A tool that captures information about incoming communications to identify where they came from, without capturing the actual message contents.

Limits and Unknowns

• The bill does not explain how businesses will decide if processing personal information is for a commercial business purpose.
• It applies retroactively to cases pending as of January 1, 2026.

Official Summary Text

SB 690, as amended, Caballero.
Crimes: invasion of privacy.
(1) Existing law prohibits tapping a communication wire or intercepting or recording a telephone communication, as specified, without the consent of all parties. Existing law exempts specified communication intercepts, including those in a correctional institution and those required for utility maintenance purposes. A violation of these provisions is punishable as either a misdemeanor or a felony.
This bill would also exempt communication intercepts for a commercial business purpose from those prohibitions. The bill would define a commercial business purpose to mean the processing of personal information either performed to further a business purpose or subject to a consumer’s opt-out rights.
(2) Existing law defines a “pen register” for these purposes to
mean a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted but not the contents of a communication, with specified exceptions. Existing law defines a “trap and trace device” as a device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication but not the contents of a communication.
The bill would specify that a pen register does not include a device or process used in a manner consistent with a commercial business purpose. This bill would also specify that a trap and trace device does not include a device or process that is used in a manner consistent with a commercial business purpose.
(3) Existing law authorizes a person who has been injured by a violation of those prohibitions to bring an action against the person who committed the violation to enjoin and restrain the violation, as well as to bring an action for monetary damages, as specified.
This bill would specify that this authorization does not apply to the processing of personal information for a commercial business purpose.
(4)
This bill would make its provisions retroactive and applicable to any case pending as of January 1, 2026.

Current Bill Text

Download Bill PDF