The California Legislature has passed SB 690, a bill that eliminates private pen register claims under the California Invasion of Privacy Act (CIPA) — a change with direct financial implications for any photo business operating a website, portfolio platform, or client-facing analytics stack in the state.

For the past several years, CIPA's pen register and trap-and-trace provisions — originally written in the 1960s to govern law-enforcement wiretaps — have become the backbone of a high-volume litigation industry. Plaintiffs' firms filed thousands of lawsuits against companies whose websites used session-replay software, chat widgets, and third-party analytics trackers, arguing that these tools functioned like pen registers by capturing user interaction data without consent. Settlements in these cases commonly ran into six and seven figures, and the claims frequently traveled in class form.

SB 690 cuts that theory off at the knees for private plaintiffs. Under the bill, private parties can no longer bring pen register claims under CIPA. That removes the statutory hook behind one of the most prolific categories of privacy litigation targeting commercial websites — the digital storefronts through which working photographers sell prints, license images, book sessions, and communicate with clients.

Why does this matter to a full-time photographer or photo studio? Because the practical effect of the pen register lawsuit wave was to treat ordinary web analytics — the tools that tell you which gallery a bride viewed before booking, which print package converted, which email campaign drove traffic — as potential wiretap exposure. Firms running standard stacks such as Google Analytics, Meta Pixel, chat services, and session-recording tools faced demand letters and complaints asserting that tracking a visitor's clicks constituted unlawful interception. Many settled quietly to avoid discovery costs, and some pulled analytics entirely, degrading their marketing data.

If SB 690 is signed and takes effect, the calculus changes. Photographers and photo businesses that stripped tracking tools from their sites in response to litigation pressure can reassess that decision — though they should distinguish what this bill actually does from what it does not. The legislation targets pen register claims specifically. It does not immunize all tracking conduct, and other privacy regimes remain fully in force: the California Consumer Privacy Act (CCPA), its privacy agency regulations, the federal Wiretap Act, and state unfair-competition theories all continue to apply to how businesses collect and use visitor data. Cookie banners, consent management, and data-minimization practices remain necessary compliance work, not optional hygiene.

The bill also does not retroactively erase pending cases by its own terms, and how courts treat the thousands of already-filed pen register complaints — many of them stayed awaiting legislative or appellate resolution — will shape how quickly the litigation pipeline actually drains. Businesses currently defending such a claim should expect procedural fights over the bill's application to live cases rather than automatic dismissal.

For platform vendors serving the photo industry — gallery hosts, e-commerce providers, CRM and booking platforms — the development eases one specific compliance pressure point. Vendors that had rearchitected their tracking features, or excluded California traffic from analytics, may revisit those restrictions, which degraded conversion measurement for their photographer customers.

The prudent read: this is a meaningful reduction in one category of legal risk, not a general license to track. Photographers who operate lean businesses without general counsel should still audit what third-party scripts run on their sites, maintain a current privacy policy, and confirm their consent tooling matches what they actually deploy — because the next enforcement wave, if it comes, is more likely to arrive through the CCPA's administrative machinery or through claims this bill leaves untouched.

The legislation now heads to Governor Gavin Newsom, whose signature — and the effective date it sets — will determine when the private pen register claim formally disappears from the California docket and how quickly the settlements that defined this litigation era wind down.