California's SB 690 and the wave of website-tracking claims built on the state's wiretapping statute, CIPA, have moved from niche privacy-law story to a direct operational risk for businesses that run commercial websites — including photography studios, stock agencies, licensing platforms and portfolio hosts with California-facing traffic. A new legal analysis published on JD Supra walks through what companies should know, and its implications reach any photo business collecting visitor data through embedded third-party tools.

The core issue is straightforward. California's Invasion of Privacy Act (CIPA), a decades-old wiretapping law, has become the basis for private lawsuits alleging that websites improperly intercept communications — typically through session-replay software, chat widgets, analytics pixels and similar tracking technologies that capture user activity, sometimes keystrokes and mouse movements, before or while a visitor interacts with the page. Plaintiffs argue that a third-party tracker on the wire constitutes a prohibited interception. Defendants argue no meaningful content was captured. Courts have split on the details, and the litigation volume has grown large enough that legislators stepped in.

SB 690 is the legislative response. Signed in 2024 with an urgency clause, it amends CIPA (Section 631 of the Penal Code) to provide that a website operator does not violate the statute merely because the operator uses third-party analytics or advertising technology to collect, analyze or transmit information about a visitor's browsing behavior on the operator's own site. The carve-out is conditional: it applies where the data collection meets the statutory definition — essentially information about a user's interaction with the site, gathered from the site itself — and it does not immunize collection of communication content, such as the substance of messages a user types into a chat window or fields the user fills out before submitting. The JD Supra analysis frames the practical takeaway around that boundary: behavioral analytics are now largely outside CIPA's wiretapping provision, but content capture remains exposed.

For photo businesses, the exposure surfaces in specific, everyday tools. Client galleries that track which images a buyer views. Chat widgets on studio sites that log typed text before send. Session-replay tools that record how visitors move through a licensing portal. Form fields on booking pages. The distinction between "information about browsing" and "communication content" determines which of those fall under the safe harbor and which do not — and plaintiffs' firms continue to test the line in filed cases.

The analysis also flags procedural stakes. CIPA carries statutory damages, and claims have typically been pleaded as class actions, which converts a single visitor interaction into aggregate exposure across all California users of a site during the relevant period. Retroactivity questions remain contested: SB 690's legislative intent language suggests it clarifies rather than changes the law, but courts are still sorting how it applies to conduct predating the amendment. Businesses facing pending claims, and those deciding whether to modify or remove tracking tools now, get no clean answer from the statute alone.

The recommended posture from the analysis is unglamorous but concrete: inventory the third-party scripts running on your site, determine which capture content versus behavior, check vendor contracts and data-flow documentation, and align chat and form tooling so nothing transmits user-typed text to a third party before submission. That is workflow work, not legal theory.

Expect the next twelve months of CIPA litigation to turn on two questions the statute left open — what counts as "content" in modern web tooling, and how SB 690 applies to pre-enactment conduct — and expect photo platforms with high-traffic, form-heavy sites to stay squarely in the plaintiff bar's target set.