California Governor Gavin Newsom has signed SB 690, a reform of the state's Consumer Privacy Act litigation landscape that its backers say will protect small businesses and nonprofits from abusive lawsuits.

The measure targets a specific and, for many small operators, costly pattern: demand letters and suits filed under the California Invasion of Privacy Act (CIPA), a decades-old wiretapping statute that plaintiffs' attorneys have increasingly used against companies over website tracking technologies such as session-replay tools, pixels and chat widgets.

For photography businesses, the stakes are direct. Studio owners and independent photographers running e-commerce sites, client galleries and booking portals frequently deploy third-party analytics and marketing pixels — the same tools that have drawn CIPA claims in wave after wave of litigation over the past several years. Settlement demands in such cases have commonly ranged from a few thousand dollars upward, enough to erase the margin on multiple commercial assignments for a solo shooter.

Backers of the bill frame it as a targeted fix rather than a broad rollback of privacy rights. The law aims to stem suits filed against businesses and nonprofits that lack the resources to litigate, while leaving established pathways under the California Consumer Privacy Act intact.

The signing closes a legislative push that drew support from small-business coalitions and nonprofit associations, which argued that CIPA — written in 1967 for telephone-era wiretapping — had been repurposed into a volume business for a subset of plaintiffs' firms sending mass demand letters over ordinary web analytics practices.

What the reform means in practice for photo businesses will depend on how courts interpret its boundaries. Website operators should still expect scrutiny of tracking tools that capture visitor communications, and photographers who manage client-facing sites with chat functions or session recording may want to review what those tools collect. But the legislation signals that California intends to draw a line between actionable privacy harms and litigation aimed at settlement value rather than redress.

The law takes effect as the broader fight over web-tracking litigation continues in California courts, and legal observers will be watching whether the reform meaningfully reduces the volume of CIPA demand letters reaching small businesses — or simply shifts plaintiffs toward other theories.