Defending Pending Website-Tracking Suits After SB 690: The Pen-Register Lookback and the Conversion Window

Tyler J. Thompson, Partner | Reed Smith LLP

Tyler J. Thompson is a partner in the Denver office of Reed Smith LLP, where his work includes helping defend clients against CIPA, CADAFA, ECPA, TCPA, Daniel’s Law, BIPA, and STL claims and building proactive defense strategies that discourage nuisance claims tied to digital compliance. He advises businesses on data privacy and protection, websites and mobile apps, technology contracts, digital accessibility, and artificial intelligence, with a focus on bringing a client’s website, platform, or app into compliance without sacrificing the user experience.

• Education & Credentials

Tyler earned his J.D. in 2015 and his B.A. in 2012, both from the University of Colorado, Boulder, and he is admitted in Colorado and Arizona. The American Bar Association and the International Association of Privacy Professionals (IAPP) accredit him as a Privacy Law Specialist. He also holds the IAPP’s Fellow of Information Privacy (FIP), CIPP/US, CIPP/E, CIPP/A, CIPP/C, CIPM, CIPT, and Artificial Intelligence Governance Professional (AIGP) designations, as well as ISACA’s Certified Data Privacy Solutions Engineer (CDPSE) credential.

• Recognition & Leadership

Tyler currently chairs the IAPP KnowledgeNet Phoenix Chapter. 5280 Magazine named him a Top Lawyer for 2024 through 2026, and The Best Lawyers in America listed him among its Ones to Watch in Privacy and Data Security in 2023. He was a team member when U.S. News – Best Lawyers named the firm Law Firm of the Year in Information Technology Law for 2024. His commentary has appeared in The New York Times, Forbes, Yahoo, and Morning Brew, and on CBS and ABC affiliates.

• Professional Involvement

Tyler is a member of the IAPP and the International Franchise Association. From 2019 to 2022 he taught Business Law and Public Policy as an adjunct professor in the MBA Program at the University of Denver’s Daniels College of Business. He speaks regularly on privacy and technology developments, with recent CLE programs on biometric privacy rules, contracting for AI, and privacy compliance at physical locations.

• Experience

Tyler has assisted in the defense of numerous CIPA claims along with CADAFA, ECPA, TCPA, Daniel’s Law, BIPA, and STL matters, and he led a mass arbitration defense over the enforceability of an international sporting goods brand’s terms of use. He defended an adtech client in an FTC investigation and ran a full gap assessment for a large quick-serve restaurant franchise group that addressed adtech compliance, transparency, and privacy by design. His broader practice includes privacy programs built for GDPR, CCPA, and HIPAA compliance for a Fortune 500 pharmaceutical company, website terms of use and public-facing policies for Fortune 500 consumer brands, and advice to national grocery chains on state privacy compliance and consumer-facing arbitration. He has also worked in-house for Fortune 500 companies in Silicon Valley and Denver.

Abigail Walker, Associate | Reed Smith LLP

Abigail Walker is an associate in the Denver office of Reed Smith LLP and a member of the firm’s Emerging Technologies Group. She helps clients respond to demands and lawsuits brought under the California Invasion of Privacy Act, the Video Privacy Protection Act, the California Shine the Light law, and similar state and federal laws. She also addresses AdTech, cookie preference management, chatbot, and accessibility issues on client websites and works directly with client web development teams on practical website management.

• Education & Credentials

Abigail received her J.D. from the University of Colorado School of Law in 2024 and her B.A. from the University of Georgia in 2018. She is admitted in Colorado.

• Recognition & Leadership

Her recent writing includes a Technology Law Dispatch piece on the California legislature amending CIPA to remove the private right of action (August 2026) and a Viewpoints piece on wiretap and eavesdropping lawsuits aimed at AI listening (November 2025). She is credited on Chapter 7 of the ABA Law of Digital Content, Privacy Regulation of Artificial Intelligence in the United States (July 2025), and was featured in a 2026 Westlaw Today Q&A on biometric privacy laws.

• Professional Involvement

Abigail has presented in Reed Smith CLE webinars, including Biometric Bonanza: New Rules and Risks (June 2026) and Virtual Life Sciences CLE Week: AI and Life Sciences (November 2025). She also writes on Colorado AI Act developments, including the 2026 SB 26-189 rewrite and the Act’s 2025 delay.

• Experience

Abigail builds privacy compliance programs that account for the EU’s General Data Protection Regulation, the California Consumer Privacy Act, the Colorado Privacy Act and other U.S. state laws, the Children’s Online Privacy Protection Act, the Telephone Consumer Protection Act, and the CAN-SPAM Act. She advises on consent mechanisms, data workflows, data subject rights requests, and loyalty programs, and she has drafted privacy policies, terms of use, service agreements, data privacy impact assessments, and intracompany data transfer agreements. Her practice also covers privacy and IT issues in mergers and acquisitions, vendor compliance within technology transactions, and AI governance work such as internal AI policies, vendor intake forms, AI addenda, AI impact assessments, and public-facing AI notices under the Colorado AI Act and the EU AI Act.

SESSION 1 – What SB 690 Actually Ends: Reading the Statute Against a Pending Pen-Register Docket | Tyler J. Thompson & Abigail Walker | 2:30pm – 3:30pm

This session delivers a precise statutory reading of California SB 690 and its two-year retroactivity mechanic against the backdrop of nearly 4,000 active California pen-register cases. Attorneys learn exactly which pending § 638.51 claims fall inside and outside the January 1, 2025 lookback cutoff, how the bill’s scope compares to earlier drafts, and what the statute leaves entirely untouched—including §§ 631 and 632, CDAFA (Penal Code § 502), and all federal theories. The session maps those surviving theories side by side: how ECPA’s federal wiretap provision tracks CIPA § 631(a)’s interception prohibition but turns on a one-party consent standard; how courts have split over whether the crime-tort exception requires a specific criminal or tortious purpose or is satisfied where a commercially motivated interception itself results in a qualifying wrong; how plaintiffs plead HIPAA violations and violations of the DOJ Bulk Sensitive Data rule (restricting transfers of sensitive personal data to “countries of concern”) to supply the predicate at the pleading stage. Attendees also examine CDAFA’s elements (knowing, unpermitted access to and taking or use of data), its lack of a minimum loss threshold, and the defenses courts have credited, including lack of cognizable damage or loss and the distinction between code on the defendant’s website and access to the user’s own device. Attendees leave with a concrete audit framework for triaging pending dockets and identifying the claim-conversion risk before January 1, 2027.

BREAK | 3:30pm – 3:40pm

SESSION 2 – Stay, Settle, or Move: Closing Out Pen-Register Cases Before January 1, 2027 | Tyler J. Thompson & Abigail Walker | 3:40pm – 4:40pm

This session equips defense counsel with a concrete litigation strategy for resolving pending California CIPA § 638.51 pen-register website-tracking cases before SB 690’s January 1, 2027 operative date. Attorneys will learn how to triage cases by filing date, evaluate stay motions, re-calibrate settlement value, and draft releases that account for the § 631 wiretapping tail risk that SB 690 does not eliminate. Attorneys will also be briefed on risks of amended or refiled claims under ECPA and CDAFA. The session then addresses how to prepare for crime-tort exception theories premised on HIPAA disclosures or Bulk Sensitive Data rule transfers, how to assess forum risk in light of the current district court split, and what early motion-to-dismiss arguments remain available, including the party exception, lack of a criminal or tortious purpose independent of the interception, insufficient specificity as to the health or sensitive data disclosed, and CDAFA’s damage-or-loss and access requirements. Attendees leave with a decision framework covering three procedural postures — stay, settle, and move to dismiss — mapped to the specific facts of their pending matter and to the follow-on federal and CDAFA exposure that may outlast SB 690.