A new California law limits lawsuits filed under the California Invasion of Privacy Act, the Elk Grove Citizen reported, narrowing a statute that portrait studios, wedding photographers, and other small commercial-website operators have faced in copy-and-paste cookie and pixel-tracking actions.

The Elk Grove Citizen's headline — "New Law Limits CIPA Lawsuits" — does not name the bill, list the sponsor, or quote a single operative provision. Photo Trade Wire readers should pull the underlying text from the California Legislative Information site before changing any compliance posture.

Why CIPA hits photo businesses harder than most

CIPA exposure has become a routine operating cost of running a studio website. The statute authorizes statutory damages of $5,000 per violation, and plaintiffs' counsel have argued that each pageview carrying a tracking pixel — Meta, Google Analytics, TikTok, LinkedIn, session-replay scripts — counts as one. Most defendants settle for nuisance sums because defense fees routinely clear $25,000 before any motion is heard and trial verdicts for defendants remain scarce.

The litigation engine ran on Section 631 of the California Penal Code, a wiretap-era provision that bars anyone from "tapp[ing] or mak[ing] any connection" with electronic communications without consent. Plaintiffs recast that language for the cookie-tracking era after a 2022 California appellate decision revived the statute's reach over website analytics. Demand-letter campaigns have hit wedding and portrait operators running booking funnels, client-gallery delivery portals, and print-or-download storefronts.

What the new legislation probably targets

CIPA website-tracking suits have drawn on three provisions:

• Penal Code § 630 — the statute's purpose clause, listing privacy protections.
• Penal Code § 631 — electronic communication interception; the workhorse of website-tracking theory.
• Penal Code § 632 — wiretapping-style audio recording claims.

Any narrowing lands on Section 631. The open question is whether the new law caps damages below $5,000, requires plaintiffs to allege actual harm rather than statutory violation alone, bars retroactive application to pending cases, or carves out common analytics tools. The Elk Grove Citizen excerpt answers none of those points.

Operating posture until the text is verified

Working photographers should continue treating cookie-banner compliance and pixel governance as a billable line item. Operators running conversion pixels on lead-gen or commerce pages can mitigate exposure today by deploying consent-management platforms that block scripts until affirmative opt-in, though those tools are not a legal safe harbor under existing CIPA case law.

Watch for the signing message and legislative findings once they post. Those documents will tell photo operators whether the new law is a meaningful exit ramp from a five-year litigation spree or a marginal tightening that copy-and-paste plaintiffs quickly route around. Pending demand letters remain legally alive until the effective date and retroactivity provisions are confirmed against the enrolled text.