An amendment to Senate Bill 690 narrows the scope of exposure under the California Invasion of Privacy Act (CIPA), according to an analysis published by the law firm Norton Rose Fulbright.

For photography businesses operating in California — studios handling client data, agencies licensing work through web forms, and platforms collecting visitor information — CIPA has become a recurring source of litigation risk. The statute, which governs wiretapping and electronic communications privacy, has been invoked in recent years in lawsuits over tracking technologies embedded in websites and customer-facing digital tools.

The amendment narrows who can be sued and under what circumstances, effectively reducing the pool of potential plaintiffs and the range of conduct that triggers liability. Norton Rose Fulbright's analysis frames the change as a meaningful contraction of CIPA-based exposure rather than a wholesale repeal of the underlying risk.

The practical stakes for photo businesses are concrete. Any operation that runs a commercial website — booking systems, client galleries, e-commerce print sales, portfolio sites with analytics or chat widgets — has faced the possibility of demand letters and class claims under CIPA theories tied to session-replay software, pixels, and third-party trackers. Defense costs alone have pushed some small studios toward settlements regardless of merit.

A narrowed statute changes that calculus. Where a claim previously could proceed on thinner showings of injury or involvement, the amendment raises the threshold, which should cut down on speculative claims filed against businesses whose connection to the alleged tracking is indirect — for example, a photographer using a standard website platform or a third-party client-proofing service.

That said, the amendment does not eliminate CIPA. Conduct that falls within the statute's remaining scope still carries statutory damages, and plaintiffs' firms continue to test theories against businesses of all sizes. Studios and agencies should still audit what their websites, CRM tools, and gallery platforms actually collect from California visitors, and should review contracts with platform vendors to understand who bears liability when tracking tools are switched on by default.

The full terms of the amendment, including its effective date and how courts apply it to pending cases, will determine how much of the current wave of CIPA litigation recedes. Norton Rose Fulbright's analysis suggests businesses with California-facing digital operations should expect reduced exposure but not a return to pre-litigation norms.