The California Legislature has passed SB 690, a bill that narrows the private right of action under the California Invasion of Privacy Act (CIPA) for so-called "pen register" claims tied to website tracking technology. For photographers and photo businesses operating portfolio sites, client galleries, and e-commerce storefronts in California, the change matters because CIPA litigation has become a routine source of demand letters and class actions targeting websites that embed third-party analytics, chat, and advertising tools.

The bill's core effect is procedural: it restricts who can sue and on what basis under CIPA's pen register provisions when the alleged interception involves website code rather than a traditional wiretap. Until now, plaintiffs' firms have treated CIPA — a 1967-era statute written for telephone-era surveillance — as a vehicle for claims against companies whose sites use session-replay scripts, pixels, and similar trackers that capture user behavior.

That litigation wave has not spared the photo industry. Businesses running online booking systems, proofing platforms, and print-sales pages have faced the same category of exposure as larger retailers, since the tracking tools at issue are standard components of web analytics and marketing stacks.

SB 690 does not eliminate CIPA exposure entirely, and the precise contours of the narrowed private right of action will depend on how courts interpret the amended statute. Companies that have already settled or budgeted for CIPA-related defense costs should treat this as a reduction in one specific litigation risk, not a wholesale safe harbor. Other privacy regimes — California's CCPA/CPRA among them — continue to apply to visitor data collection.

For studios and agencies weighing compliance spend, the practical question is whether tracker-audit budgets shift. Firms that commissioned privacy counsel to review embedded scripts under pen register theory may see reduced urgency on that specific claim type, while obligations under consumer privacy statutes remain unchanged.

The measure now moves through the final steps of the legislative process before reaching Governor Newsom's desk. Industry observers expect the amendment to stem the volume of website-tracking suits filed in California courts, though plaintiffs' attorneys will likely test the law's boundaries in early cases.