Privacy is a research problem now

California's legislature has passed the compromise version of SB-690, leaving most of the private-right-of-action provisions of the California Invasion of Privacy Act (CIPA) in place, writes Don Marti of Aloodo. The result, he argues, is a shift in privacy compliance from bureaucratic to jury-focused: more than 4,000 CIPA lawsuits have already been filed, mostly against legitimate businesses rather than Big Tech, and a jury verdict against Meta over data collection from the Flo menstrual-tracking app showed what juries will do. Marti's thesis is that the practices jurors and customers reject are the same practices that power Big Tech's squeeze on customer-acquisition costs, so moving to customer-acceptable data practices is both a compliance fix and a competitive win.

The crux

With private enforcement intact, juries - not regulators - become the real standard-setters for which data practices survive, and the marketing features easiest to bolt onto a site or app are also the most legally exposed.

Sell-side read

Publishers should treat every tracking pixel and data-sharing feature as a potential jury exhibit; scrubbing the lawsuit-magnet scripts is now a yield-protection move, because a $5,000-per-violation exposure on programmatic data flows is a direct threat to the revenue those flows support.

Watch

Which CIPA sections actually survive to January 2027 and where the next wave of private suits lands as the statute's carve-outs are tested.