Protect Small Businesses from Website Privacy Lawsuit Shakedowns

I urge you to introduce or support legislation that protects small businesses from abusive lawsuits over ordinary website tools. Website-tracking claims under our wiretapping and privacy laws should be enforced by the State and Attorney General. At a minimum, a business should get 60 days to fix a problem before anyone can sue. California just showed this can be done. On September 30, Governor Newsom signed SB 690, which ends private lawsuits over website and app "pen register" claims under the California Invasion of Privacy Act. Only the Attorney General can bring them now. The law reaches back to cases filed since January 1, 2025. Newsom said it stops the vexatious use of lawsuits and demand letters to squeeze settlements out of small businesses. The problem is real. That 1967 law pays $5,000 per violation with no proof of harm, and plaintiffs count each site visit as a violation. Pen register suits grew from about 600 to nearly 4,000 between February 2025 and August 2026. Demand letters typically ask $10,000 to $25,000, which a restaurant or a plumber will often pay rather than fight. The bill's author said a handful of trial lawyers sued over 1,500 businesses and sent thousands more letters. Similar letters now go to businesses nationwide. A business owner who added a free analytics tool or chat box shouldn't get a five-figure demand for it. Real privacy violators can still answer to the Attorney General. Please act before these letters reach more of our local businesses, and tell me where you stand.