AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Online Tracking Liability Is Splitting Into More Legal Paths
Yesterday’s legal reporting made one point clearer: narrowing a single route for website-tracking suits would not settle the underlying exposure. California’s SB 690 could limit a category of CIPA claims if enacted, but courts are still examining whether banners, opt-outs, and privacy notices meaningfully cover third-party tracking.
A separate Supreme Court case could test the boundary for streaming platforms. Its forthcoming review of whether free viewers qualify for VPPA protection puts viewing histories linked to advertising identifiers at the center of a statutory question that has not kept pace neatly with free-to-use digital services.
California lawmakers have passed SB 690, which would narrow private CIPA pen-register and trap-and-trace claims if signed and effective in 2027. But analysis from Bass, Berry & Sims and JD Supra shows that wiretapping, federal, out-of-state, and tracker-based theories remain available. Recent federal decisions also turned on the practical adequacy of consent and disclosure design, including whether a cookie banner or telehealth policy actually informed users about third-party sharing.
The Supreme Court will hear Salazar v. Paramount Global on October 14. As The New Republic reported, the case asks whether free online viewers are protected as consumers under the VPPA when a service allegedly shares viewing histories and Facebook identifiers for advertising. The Sixth Circuit found that free viewers did not qualify; the Supreme Court’s answer could reshape exposure for streaming and advertising-supported video services.
Key Points
- The legal risk is becoming less about whether a company has a privacy notice and more about whether its specific data flow is described, consented to, and controllable in practice. That is a harder compliance standard to satisfy with generic disclosures.
- Recent briefings already showed divergent lower-court outcomes on sensitive website tracking. Yesterday added a different kind of uncertainty: legislatures and courts may narrow or expand particular paths to liability without producing a uniform rule for online data sharing.
Implications
Organizations using pixels, cookies, session-replay tools, or advertising integrations should not treat a potential California rollback as a safe harbor. Their exposure may turn on the tracker, the data involved, the jurisdiction, and the operation of consent and opt-out controls.
For streaming businesses, free access may become a more consequential legal distinction if the Supreme Court defines VPPA consumer status narrowly or broadly. Until then, linking viewing data to advertising identifiers remains a material area for review rather than a settled compliance question.
Watchpoints
Watch
Whether California SB 690 is signed, its final effective terms, and how courts address qualifying pending claims.
Watch
How the October 14 Salazar argument frames free-viewer status and the disclosures covered by the VPPA.
Watch
Further rulings on CIPA section 631, tracker consent, and disclosures of sensitive data to advertising platforms.
Fallout
The day’s consequential privacy developments were legal rather than technological: both concern how older privacy statutes apply to contemporary tracking and advertising data flows.
Website Tracking Litigation After SB 690
California may narrow one category of website-tracking claims, but litigation risk remains distributed across other statutes, jurisdictions, and fact-specific consent practices.
Fresh developments
Reporting examined SB 690’s prospective limits on certain CIPA claims alongside August decisions scrutinizing tracker disclosures, opt-outs, and third-party sharing of browsing and health-related information.
Why we noticed
The practical lesson is that compliance exposure does not disappear with one statutory change. Tracker governance still depends on the data flow and whether notice and user controls work as represented.
Watch for:
- Final enactment and effective-date terms for SB 690.
- Judicial treatment of pending claims.
- Further rulings on consent, opt-outs, and sensitive-data disclosures.
VPPA Coverage for Free Streaming Viewers
The Supreme Court’s review in Salazar v. Paramount Global could define whether free online viewers receive VPPA protection when viewing information is linked to advertising identifiers.
Fresh developments
The Court is scheduled to hear the case on October 14 after the Sixth Circuit held that free viewers were not statutory consumers.
Why we noticed
The case could determine whether an advertising-supported business model changes the scope of a video-privacy law, with direct consequences for data-sharing and consent practices.
Watch for:
- The questions and arguments at the October 14 hearing.
- Whether the Court focuses on consumer status, the alleged disclosure, or both.
- The eventual scope of any ruling for streaming and ad-tech businesses.
Final Thought
The direction is not toward a single, settled rule for online tracking. It is toward more exacting scrutiny of the particular data shared, the legal theory invoked, and the reality behind a company’s consent controls.