On August 28, 2026, the California Legislature unanimously passed Senate Bill 690, a measure that would strip private plaintiffs of the right to sue websites and apps under CIPA's pen register and trap and trace provision and hand enforcement of those claims to the California Attorney General. Governor Newsom has until September 9, 2026, to sign or veto the bill. Observers expect enactment.

For photographers and photo businesses running portfolio sites, client galleries, e-commerce storefronts or licensing platforms, the bill targets a specific and fast-growing source of statutory-damages exposure: lawsuits and demand letters under California Penal Code Section 638.51, a 1967-era surveillance statute that plaintiffs have repurposed to challenge everyday tracking technologies.

What does SB 690 actually change?

If signed in its current form, SB 690 makes two principal changes for CIPA claims based on conduct on a website, online application, or mobile application:

• It eliminates the private right of action for claims alleging violations of Section 638.51 and reserves enforcement exclusively to the California Attorney General.
• It applies retroactively to pending claims asserted in actions commenced within two years before the statute's operative date.

The retroactivity clause could reach cases already pending in California state and federal courts. Defendants facing private Section 638.51 claims could argue those claims can no longer be maintained and should be dismissed — but courts will ultimately decide how the provision applies case by case.

Why has CIPA litigation hit photo and content businesses?

The California Invasion of Privacy Act dates to 1967, decades before the internet, and originally targeted wiretapping and electronic surveillance. Plaintiffs have revived three of its provisions against common site technologies:

• Section 631 (wiretapping): claims that website tools improperly intercept or disclose communications.
• Section 632 (eavesdropping): claims that technologies record keystrokes, mouse movements, chatbot exchanges, and screen content without consent.
• Section 638.51 (pen register/trap and trace): claims that cookies, tracking pixels, analytics tools, session replay software, and SDKs collect IP addresses, device identifiers, and referral URLs the way telephone-era surveillance devices captured routing information.

CIPA became an attractive vehicle because, unlike the CCPA and CPRA — which regulators principally enforce — CIPA's civil remedies provision lets private plaintiffs seek statutory damages. That asymmetry fueled a substantial volume of demand letters and lawsuits across industries, exposing businesses to potentially significant damages over routine website functionality.

What survives SB 690?

The bill's scope is narrow. It does not amend Sections 631 or 632, so private wiretapping and eavesdropping claims would likely remain available under current law. Plaintiffs may continue asserting those theories based on the same underlying technologies — analytics, chat features, cookies, pixels, and session replay tools that most commercial photography sites deploy.

SB 690 also leaves California's broader privacy framework untouched. Businesses remain responsible for CCPA and CPRA requirements covering privacy disclosures, consumer rights, data-sharing practices, and tracking technologies, and the bill does not limit the Attorney General's or other regulators' authority to investigate and enforce.

Practical steps for photo businesses

For studios, agencies, and platforms weighing litigation exposure against compliance costs, the bill changes the enforcement mechanism, not the underlying practices. Businesses with pending Section 638.51 claims, demand letters, or settlement discussions should factor in the possibility that claim viability and settlement value could shift if the bill becomes law. Reviews of privacy disclosures, consent mechanisms, and analytics and advertising vendor relationships should continue regardless.

Until Newsom signs the bill and courts interpret its operative language, businesses should treat SB 690 as a potential reduction in litigation exposure — not a substitute for ongoing privacy compliance.