California Governor has signed SB 690, a law that limits claims brought under the California Invasion of Privacy Act (CIPA) — the state statute that trial lawyers have used in hundreds of lawsuits against websites for using session-replay software, analytics pixels and chat tools that track visitor behavior without consent.

For photography businesses, the practical target is clear: the wave of CIPA "website tracking" lawsuits that hit companies operating e-commerce sites, portfolios with analytics, and booking platforms. Under the prior litigation environment, a studio running standard tools — Google Analytics, Meta Pixel, session-recording software, live-chat widgets — faced exposure to class claims alleging unlawful wiretapping of site visitors, even where the business collected no payment data and the visitor suffered no measurable harm.

The law tightens standing requirements and narrows what counts as an actionable interception under CIPA in the website context. In practice, it raises the bar for plaintiffs who previously needed only to allege that a third-party tracking technology captured their browsing activity. Claims that survived early motions under the old framework often settled in the low-to-mid five figures per defendant, a cost structure that made fighting them uneconomic for small and mid-sized visual-arts businesses.

Clark Hill's analysis of the new statute points to the legislative intent: curbing what lawmakers characterized as abusive litigation rather than weakening substantive privacy protections. The firm notes the law responds to years of defense-side arguments that CIPA, drafted in 1967 for telephone wiretapping, was never designed for browser-based analytics.

Photography businesses should treat this as risk reduction, not immunity. The law does not eliminate privacy obligations in California. Businesses still must comply with the CCPA/CPRA regime, which governs disclosure of data collection, opt-out rights for "sharing" and sale of personal information, and contractual requirements with service providers. A portfolio site serving California visitors that uses third-party analytics still falls within that regulatory perimeter, even if the private-lawsuit threat under CIPA has narrowed.

The compliance math changes in one specific way: the expected cost of a tracking-related lawsuit drops, which affects whether a business needs specific media-liability or cyber coverage riders covering website wiretapping claims — coverage that carriers began pricing into policies for any business with an online storefront. Studios that bought such riders explicitly because of CIPA exposure may want to revisit those terms at renewal.

Vendors are also affected. Analytics and session-replay providers marketing to creative businesses have spent the past several years selling "CIPA-compliant" configurations — consent banners, data minimization modes, on-premise processing. Some of that product positioning loses urgency as a legal-differentiator, though it retains value for businesses that also operate in the EU under GDPR or serve clients with contractual privacy requirements.

The statute's effective terms matter for calendaring. Businesses currently defending CIPA website-tracking claims should consult counsel on how the new provisions apply to pending cases, since limitations legislation in California has historically applied prospectively absent express retroactivity language. New filings after the effective date face the raised pleading standards.

For photo businesses with California customers, the baseline operational advice stays the same: know which third-party scripts run on your site, disclose them in your privacy policy, and honor opt-out signals. What changes is the enforcement mechanism — fewer private suits under CIPA, with the CCPA's regulator-driven framework carrying more of the load.

Clark Hill signals that further implementing details and early court interpretations will determine how much of the CIPA website-tracking docket actually disappears; expect the first appellate rulings testing the new standing limits within the next 12 to 18 months.