California has changed a privacy law that was being used to sue small businesses, including HVAC contractors, over routine website tracking tools like chat boxes, analytics, and ad pixels. Gov. Gavin Newsom signed SB 690 on Sept. 30, which removes the ability of individuals to file private lawsuits over this type of tracking under the California Invasion of Privacy Act. Previously, companies anywhere in the country could be sued if a California resident visited their site and tracking software logged the visit — one local HVAC company faced a suit seeking $5,000 for every visit to its website, not every visitor. More than 800 such claims were filed in 2025 alone.
Under the new law, these particular claims can now only be brought by the state Attorney General, not by private plaintiffs or the law firms that filed them on residents' behalf. The change takes effect Jan. 1, 2027, and also applies to pending cases filed within the two years before that date.
This story is about contractors' legal exposure, not a direct homeowner issue, but it is worth knowing about if you have hired or are researching a local heating and cooling company. The law doesn't erase all website privacy risk; lawsuits over other parts of the same statute, dealing with consent and communication interception, can still go forward. So while the flood of lawsuits tied to this specific tracking issue should ease, it does not mean a company's website is entirely free of privacy rules.
Email me when California rebates change
Free weekly digest. Unsubscribe anytime. Privacy policy.
Rebates change. See what California pays now.
Every federal, state, and utility program in one place, each stamped with the date it was last verified against the administering agency.