California Governor Gavin Newsom has signed a bill limiting lawsuits brought under the California Invasion of Privacy Act, a 1967 wiretapping statute that plaintiffs have increasingly used to sue websites over tracking technologies. In his signing message, the governor pressed lawmakers to go further, signaling that he expects additional litigation reforms before the industry sees durable relief from the wave of CIPA claims.

The signing matters directly to photo businesses. CIPA suits have become a favored vehicle for class actions targeting websites that embed analytics pixels, session-replay tools, chat functions and other third-party tracking code — the same standard stack most working photographers rely on for portfolio sites, e-commerce galleries, client proofing platforms and booking funnels. Every photographer running a Squarespace, Pixieset, SmugMug or Shopify storefront with standard tracking widgets carries some exposure under the statute's cookie- and pixel-based theories.

For full-time photographers, the practical stakes are cost-side: CIPA claims typically settle in the five-to-six-figure range for small businesses because defending a wiretapping class action outpaces any realistic litigation budget, even where the tracked data has no meaningful value. A statutory limit on these suits reduces the frequency of demand letters targeting small site operators, not just large platforms.

What the new law does not do, based on what Newsom said at signing, is close the question. The governor's push for more legislation indicates he views the signed measure as a partial fix, leaving open which theories of liability — pixel tracking, chat interception, session recording — remain viable in California courts. Until follow-up legislation or appellate decisions clarify the boundaries, photographers and the platforms serving them should treat the risk as reduced but not eliminated.

The timing also intersects with broader privacy enforcement. California already operates under the CCPA/CPRA regime, which imposes its own rules on how photography businesses collect client data through forms, contracts and proofing logins. A CIPA limitation does not relax those obligations; it narrows one private-right-of-action avenue that had grown far beyond the statute's original wiretap framing.

For studio owners and independent shooters making compliance and insurance decisions, the near-term takeaway is straightforward: keep consent disclosures and cookie banners in place, because the governor himself says the fix is incomplete, and plaintiffs' firms will continue testing which claims survive. Watch Sacramento for the follow-on bill Newsom requested — the scope of that legislation will determine whether CIPA exposure for routine website tracking ends or simply shrinks.