California's Sept. 30 bill signing deadline has produced what a new National Law Review briefing calls the most significant change to website tracking litigation in years. For anyone trying to understand the California website tracking law 2026 landscape, the headline is about lawsuits. The practical question for everyday users is different: what do tracking tools actually collect, and what can you do about it?
The source briefing offers only a short summary of the changes, so this article sticks to what has been reported and avoids guessing at details of the final legislation.
What California Changed for Website Tracking
The National Law Review's October 2026 privacy briefing describes the signing deadline as a turning point for website tracking litigation. Other legal commentary points to the same area. One law firm alert from mid-September reported that the California Legislature unanimously passed SB 690 on August 28, 2026, a bill that would eliminate private lawsuits under the California Invasion of Privacy Act (CIPA) over certain tracking practices. Another firm described the broader package as covering consumer rights, data brokers, and civil remedies for website privacy litigation.
It helps to understand the background. CIPA is an older state law that plaintiffs have used against websites that deploy third-party tracking tools such as pixels and session-recording scripts. Courts have been divided on whether the law applies to that kind of tracking, which created years of uncertainty for businesses and consumers alike.
Two things are worth keeping separate:
- Litigation rules determine who can sue a website over tracking and what remedies are available.
- Privacy rights under laws like the California Consumer Privacy Act (CCPA) determine what companies must do when you ask not to be tracked.
Changes to the first do not erase the second. Reporting from CalMatters in April noted that the CCPA requires businesses to acknowledge opt-out controls and not track people who use them, and that a survey found many sites failing to honor them.
How Tracking Pixels and Cookies Actually Work
Most people have heard of cookies, but pixels and similar scripts work a little differently.
Cookies are small files a website stores in your browser. First-party cookies keep you logged in or remember your cart. Third-party cookies, set by other companies embedded in the page, can follow you across different sites.
Tracking pixels are tiny, often invisible elements loaded from another company's server. When your browser loads the page, it contacts that server, which can receive details such as your IP address, the page you visited, your browser and device type, and sometimes actions you took on the page.
Other tools, including beacons and software development kits in apps, can record a user's activity in similar ways. One legal summary of the 2026 rules lists cookies, pixels, beacons, and SDKs as the technologies at the center of the claims.
The key point is that these tools run inside the web page you are viewing. That detail matters when we get to VPNs.
What Consumers Can Do to Limit Tracking
Legal changes will take time to play out. Settings you control can reduce tracking today.
- Turn on a global opt-out signal. California's Opt Me Out Act, signed in 2025, is aimed at making it easier for Californians to send an opt-out preference through their browser. Check whether your browser offers a built-in setting or a supported extension for this kind of signal.
- Block third-party cookies. Most major browsers let you do this in privacy settings.
- Use tracker-blocking tools. Content blockers and browsers with built-in tracking protection can stop many pixels from loading at all.
- Review app permissions. On your phone, limit ad identifiers and location access for apps that do not need them.
- Submit opt-out and deletion requests. If you are a California resident, you can ask businesses to stop selling or sharing your data and to delete it.
- Clear cookies periodically and avoid staying logged in to services you do not use often.
None of these is perfect, and sites vary in how well they honor your choices. Still, layering a few of them makes a measurable difference.
Where VPNs Help and Where They Fall Short
VPNs are often described as a cure-all for privacy, and they are not. A VPN encrypts the traffic between your device and the VPN server and hides your real IP address from the sites you visit. That is useful on untrusted networks and for keeping your internet provider from seeing which sites you connect to.
But a VPN does not stop on-page trackers. If you log in to a site, accept its cookies, or load a page with an embedded pixel, the tracker still runs in your browser. It can still link your activity to your account or a browser fingerprint, even if your IP address is masked.
In practical terms:
- A VPN helps with network-level privacy, such as protecting your connection on shared networks. Our secure public WiFi guide explains those risks in detail.
- A VPN does not help with cookies, pixels, session-recording scripts, or what you hand over by logging in.
If you travel often or work remotely, our digital nomad security guide covers how to combine network protection with account and device hygiene. If you use a VPN across borders, it is also worth checking VPN legality by country before you go.
What This Means For You
The California website tracking law 2026 changes mostly reshape who can sue and under what conditions. They do not mean tracking has stopped. If you live in California, your CCPA rights to opt out and request deletion remain your most direct tools. If you live elsewhere, browser-level protections matter even more, since they work regardless of where you are.
Expect more commentary as lawyers analyze the signed bills. The details of final text, effective dates, and exceptions are best confirmed from the legislation itself or from the California Privacy Protection Agency.
Actionable Takeaways
- Review your browser and phone privacy settings this week. Block third-party cookies and enable any opt-out preference signal available.
- Add a tracker blocker for the pixels that cookie settings alone will not catch.
- Use opt-out and deletion requests if you are covered by California law.
- Treat a VPN as protection for your network traffic, not as a shield against on-page trackers.
- Read our secure public WiFi guide to understand where a VPN fits in your setup, and where other settings must do the work.
The California website tracking law 2026 story is still developing, but the steps above keep you in control while it does.
